# articles

feed_id: https://krebsonsecurity.com/?p=38864
title: Dual-Use Software Criminal Case Not So Novel
uri: Dual-Use-Software-Criminal-Case-Not-So-Novel
url: https://krebsonsecurity.com/2017/04/dual-use-software-criminal-case-not-so-novel/
content:
<p><em>&#8220;He built a piece of software. That tool was pirated and abused by hackers. Now the feds want him to pay for the computer crooks&#8217; crimes.&#8221;</em></p>
<p>The above snippet is the subhead of a story published last month by the <em>The Daily Beast </em>titled, &#8220;FBI Arrests Hacker Who Hacked No One.&#8221; The subject of that piece &#8212; a 26-year-old American named <strong>Taylor Huddleston</strong> &#8212; faces felony hacking charges connected to two computer programs he authored and sold: An anti-piracy product called <strong>Net Seal</strong>, and a <strong>R</strong>emote <strong>A</strong>dministration <strong>T</strong>ool (RAT) called <strong>NanoCore</strong> that he says was a benign program designed to help users remotely administer their computers.</p>
<div id="attachment_38879" style="width: 286px" class="wp-caption alignright"><img class=" wp-image-38879" src="media/25fd5594.huddlestoncuff.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/huddlestoncuff.png" alt="Photo illustration by Lyne Lucien/The Daily Beast" width="276" height="279" /><p class="wp-caption-text">Photo illustration by Lyne Lucien/The Daily Beast</p></div>
<p>The author of the Daily Beast story, <a href="https://en.wikipedia.org/wiki/Kevin_Poulsen" target="_blank">former black hat</a> hacker and <em>Wired.com</em> editor <strong>Kevin Poulsen</strong>, argues that Huddleston&#8217;s case raises a novel question: When is a programmer criminally responsible for the actions of his users?</p>
<p>&#8220;Some experts say [the case] could have far reaching implications for developers, particularly those working on new technologies that criminals might adopt in unforeseeable ways,&#8221; Poulsen wrote.</p>
<p>But a closer look at the government&#8217;s side of the story &#8212; as well as public postings left behind by the accused and his alleged accomplices &#8212; paints a more complex and nuanced picture that suggests this may not be the case to raise that specific legal question in any meaningful way.</p>
<p><strong>Mark Rumold</strong>, senior staff attorney at the <strong>Electronic Frontier Foundation</strong> (EFF), said cases like these are not so cut-and-dry because they hinge on intent, and determining who knew what and when.</p>
<p>&#8220;I don’t read the government&#8217;s complaint as making the case that selling some type of RAT is illegal, and if that were the case I think we would be very interested in this,&#8221; Rumold said. &#8220;Whether or not [the government&#8217;s] claims are valid is going to be extraordinarily fact-specific, but unfortunately there is not a precise set of facts that would push this case from being about the valid reselling of a tool that no one questions can be done legally to crossing that threshold of engaging in a criminal conspiracy.&#8221;</p>
<p>Citing group chat logs and other evidence that hasn&#8217;t yet been made public, U.S. prosecutors say Huddleston intended NanoCore to function more like a <strong>R</strong>emote <strong>A</strong>ccess <strong>T</strong>rojan used to remotely control compromised PCs, and they&#8217;ve indicted Huddleston on criminal charges of conspiracy as well as aiding and abetting computer intrusions.</p>
<p>Poulsen depicts Huddleston as an ambitious &#8212; if extremely naive &#8212; programmer struggling to make an honest living selling what is essentially a dual-use software product. Using the nickname &#8220;<strong>Aeonhack</strong>,&#8221; Huddleston marketed his NanoCore RAT on <strong><a href="https://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank">Hackforums[dot]net</a></strong>, an English-language hacking forum that is overrun with young, impressionable but otherwise low-skilled hackers who are constantly looking for point-and-click tools and services that can help them demonstrate their supposed hacking prowess.</p>
<p>Yet we&#8217;re told that Huddleston was positively shocked to discover that many buyers on the forum were using his tools in a less-than-legal manner, and that in response he chastised and even penalized customers who did so. By way of example, Poulsen writes that Huddleston routinely used his Net Seal program to revoke the software licenses for customers who boasted online about using his NanoCore RAT illegally.</p>
<div class="Text">
<p>We later learn that &#8212; despite Net Seal&#8217;s copy protection abilities &#8212; denizens of Hackforums were able to pirate copies of NanoCore and spread it far and wide in malware and phishing campaigns. Eventually, Huddleston said he grew weary of all the drama and sold both programs to another Hackforums member, using the $60,000 or so in proceeds to move out of the rusty trailer he and his girlfriend shared and buy a house in a low-income corner of Hot Springs, Arkansas.</p>
<p>From the story:</p>
</div>
<p><span id="more-38864"></span></p>
<div class="Text">
<blockquote><p>&#8220;Now even Huddleston’s modest home is in jeopardy,&#8221; Poulsen writes. &#8220;As part of their case, prosecutors are seeking forfeiture of any property derived from the proceeds of NanoCore, as well as from Huddleston’s anti piracy system, which is also featured in the indictment. &#8216;Net Seal licensing software is licensing software for cybercriminals,&#8217; the indictment declares.</p>
<p>&#8220;For this surprising charge—remember, Huddleston use the licenses to fight crooks and pirates—the government leans on the conviction of a Virginia college student named <strong>Zachary Shames</strong>, who pleaded guilty in January to selling hackers a keystroke logging program called <strong>Limitless</strong>. Unlike Huddleston, Shames embraced malicious use of his code. And he used Net Seal to protect and distribute it.</p></blockquote>
</div>
<div class="Text">
<blockquote><p>&#8220;Huddleston admits an acquaintanceship with Shames, who was known on HackForums as &#8216;<strong>Mephobia</strong>,&#8217; but bristles at the accusation that Net Seal was built for crime. &#8216;Net Seal is literally the exact opposite of aiding and abetting&#8217; criminals, he says. &#8216;It logs their IP addresses, it block their access to the software, it stops them from sharing it with other cyber criminals. I mean, every aspect of it fundamentally prevents cybercrime. For them to say that [crime] is its intention is just ridiculous.&#8217;”</p></blockquote>
<p>Poulsen does note that Shames <a href="https://www.theregister.co.uk/2017/01/14/students_keylogger_guilty/" target="_blank">pleaded guilty</a> in January to selling his Limitless keystroke logging program, which relied on Huddleston&#8217;s Net Seal program for distribution and copy protection.</p>
<p>Otherwise, The Daily Beast story seems to breeze over relationship between Huddleston and Shames as almost incidental. But according to the government it is at the crux of the case, and a review of the indictment against Huddleston suggests the two&#8217;s fortunes were intimately intertwined.</p>
<p>From the government&#8217;s indictment:</p>
<blockquote><p>&#8220;During the course of the conspiracy, Huddleston received over 25,000 payments via PayPal from Net Seal customers. As part of the conspiracy, Huddleston provided Shames with access to his Net Seal licensing software in order to assist Shames in the distribution of his Limitless keylogger. In exchange, Shames made at least one thousand payments via PayPal to Huddleston.&#8221;</p>
<p>&#8220;As part of the conspiracy, Huddleston and Shames distributed the Limitless keylogger to over 3,000 people who used it to access over 16,000 computers without authorization with the goal and frequently with the result of stealing sensitive information from those computers. As part of the conspiracy, Huddleston provided Net Seal to several other co-conspirators to assist in the profitable distribution of the malicious software they developed, including prolific malware that has repeatedly been used to conduct unlawful and unauthorized computer intrusions.&#8221;</p></blockquote>
<div id="attachment_38877" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/dcd3cd5d.mephobia-autobuy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/mephobia-autobuy.png"><img class="wp-image-38877 size-medium" src="media/ed4e2b97.mephobia-autobuy-580x431.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/mephobia-autobuy-580x431.png" alt="A screen shot of Zach &quot;Mephobia&quot; Shames on Hackforums discussing the relationship between his Limitless keylogger and Huddleston's Net Seal anti-piracy and payment platform." width="580" height="431" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/mephobia-autobuy-580x431.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/mephobia-autobuy.png 652w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A screen shot of Zach &#8220;Mephobia&#8221; Shames on Hackforums discussing the relationship between his Limitless keylogger and Huddleston&#8217;s (Aeonhack) Net Seal anti-piracy and payment platform.</p></div>
<p><strong>Allison Nixon</strong>, director of security research for New York City-based security firm <strong>Flashpoint</strong>, observed that in the context of Hackforums, payment processing through Paypal is a significant problem for forum members trying to sell dual-use software and services on the forum.</p>
<p>&#8220;Most of their potential customer base uses PayPal, but their vendor accounts keep getting suspended for being associated with crime, so people who can successfully get payments through are prized,&#8221; Nixon said. &#8220;Net Seal <em>can</em> revoke access to a program that uses it, but it is a payment processing and digital rights management (DRM) system. Huddleston can claim the DRM is to prevent cybercrime, but realistically speaking the DRM is part of the payment system &#8212; to prevent people from pirating the software or initiating a Paypal chargeback. Just because he says that he blocked someone&#8217;s license due to an admission of crime does not mean that was the original purpose of the software.&#8221;</p>
<p>Nixon, a researcher who has spent countless hours profiling hackers and activities on Hackforums, said selling the NanoCore RAT on Hackforums and simultaneously scolding people for using it to illegally spy on people &#8220;could at best be seen as the actions of the most naive software developer on the Earth.&#8221;</p>
<p>&#8220;In the greater context of his role as the money man for Limitless Keylogger, it does raise questions about how sincere his anti-cybercrime stance really is,&#8221; Nixon said. &#8220;Considering that he bought a house from this, he has a significant financial incentive to play ignorant while simultaneously operating a business that can&#8217;t make nearly as much money if it was operated on a forum that wasn&#8217;t infested with criminals.&#8221;</p>
</div>
<p>Huddleston makes the case in Poulsen&#8217;s story that there’s a corporate-friendly double standard at work in the government&#8217;s charges, noting that malicious hackers have used commercial remote administration tools like <strong>TeamViewer</strong> and <strong>VNC</strong> for years, but the FBI doesn’t show up at their corporate headquarters with guns drawn.</p>
<p>But Nixon notes that RATs sold on Hackforums are extremely dangerous for the average person to use on his personal computer because there are past cases when RAT authors divert infected machines to their own botnet.</p>
<p>Case in point: The author of the <strong>Blackshades Trojan</strong> &#8212; once a wildly popular RAT sold principally on Hackforums before <a href="https://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" target="_blank">its author and hundreds of its paying customers were arrested in a global law enforcement sweep</a> &#8212; wasn&#8217;t content to simply rake in money from the sale of each Blackshades license: He also included a backdoor that let him secretly commandeer machines running the software.</p>
<div id="attachment_38878" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/33f31fde.blackshadesstealingbots.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/blackshadesstealingbots.png"><img class="wp-image-38878 size-medium" src="media/4a309606.blackshadesstealingbots-580x493.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/blackshadesstealingbots-580x493.png" alt="A Hackforums user details how the Blackshades RAT included a backdoor that let the RAT's original author secretly access systems infected with the RAT." width="580" height="493" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/blackshadesstealingbots-580x493.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/blackshadesstealingbots-768x653.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/04/blackshadesstealingbots.png 938w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">A Hackforums user details how the Blackshades RAT included a backdoor that let the RAT&#8217;s original author secretly access systems infected with the RAT.</p></div>
<p>&#8220;If a person is using RAT software on their personal machine that they purchased from Hackforums, they are taking this risk,&#8221; Nixon said. &#8220;Programs like VNC and Teamviewer are much safer for legitimate use, because they are actual companies, not programs produced by teenagers in a criminogenic environment.&#8221;</p>
<p>All of this may be moot if the government can&#8217;t win its case against Huddleston. The EFF&#8217;s Rumold said while prosecutors may have leverage in Shames&#8217;s conviction, the government probably doesn&#8217;t want to take the case to trial.</p>
<p>&#8220;My guess is if they want a conviction, they&#8217;re going to have to go to trial or offer him some type of very favorable plea,&#8221; Rumold said. &#8220;Just the fact that Huddleston was able to tell his story in a way that makes him come off as a very sympathetic character sounds like the government may have a difficult time prosecuting him.&#8221;</p>
<p>A copy of the indictment against Huddleston is available <a href="media/7c36ec2c.W.D.Ark_._null_null_0.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/04/W.D.Ark_._null_null_0.pdf" target="_blank">here</a> (PDF).</p>
<p>If you enjoyed this story, take a look at <a href="https://krebsonsecurity.com/2016/07/canadian-man-is-author-of-popular-orcus-rat/" target="_blank">a related piece</a> published here last year about a different RAT proprietor selling his product on Hackforums who similarly claimed the software was just a security tool designed for system administrators, despite features of the program and related services that strongly suggested otherwise.</p>


feed_id: https://krebsonsecurity.com/?p=38914
title: Self-Proclaimed ‘Nuclear Bot’ Author Weighs U.S. Job Offer
uri: Self-Proclaimed-Nuclear-Bot-Author-Weighs-U-S-Job-Offer
url: https://krebsonsecurity.com/2017/04/self-proclaimed-nuclear-bot-author-weighs-u-s-job-offer/
content:
<p>The author of a banking Trojan called <strong>Nuclear Bot</strong> &#8212; a teenager living in France &#8212; recently released the source code for his creation just months after the malware began showing up for sale in cybercrime forums. Now the young man&#8217;s father is trying to convince him not to act on a job offer in the United States, fearing it may be a trap set by law enforcement agents.</p>
<p>In December 2016, <strong>Arbor Networks</strong> released <a href="https://www.arbornetworks.com/blog/asert/dismantling-nuclear-bot/" target="_blank">a writeup on Nuclear Bot</a> (a.k.a. NukeBot) after researchers <a href="https://twitter.com/Bry_Campbell/status/805142112148791297" target="_blank">discovered</a> the malware package for sale in the usual underground cybercrime forums for the price of USD $2,500.</p>
<p>The program&#8217;s author claimed the malware was written from scratch, but that it functioned similarly to the <a href="https://krebsonsecurity.com/?s=zeus&amp;x=0&amp;y=0" target="_blank">ZeuS banking trojan</a> in that it could steal passwords and inject arbitrary content when victims visited banking Web sites.</p>
<div id="attachment_38918" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-38918" src="media/7e40d2a4.nukebotpanel-580x298.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/nukebotpanel-580x298.png" alt="The administration panel for Nuclear Bot. Image: IBM X-Force." width="580" height="298" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/nukebotpanel-580x298.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/nukebotpanel-768x394.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/04/nukebotpanel-940x482.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/04/nukebotpanel.png 1540w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The administration panel for Nuclear Bot. Image: IBM X-Force.</p></div>
<p>Malware analysts at <strong>IBM&#8217;s X-Force</strong> research division also examined the code, primarily because the individual selling it claimed that Nuclear Bot could bypass <a href="https://krebsonsecurity.com/2010/04/a-closer-look-at-rapport-from-trusteer/" target="_blank">Trusteer Rapport</a>, an IBM security product that many banks offer customers to help blunt the effectiveness of banking trojans.</p>
<p>&#8220;These claims are unfounded and incorrect,&#8221; IBM&#8217;s researchers wrote. &#8220;Rapport detection and protection against the NukeBot malware are effective on all protection layers.&#8221;</p>
<p>But the malware&#8217;s original author &#8212; 18-year-old <strong>Augustin Inzirillo</strong> &#8212; begs to differ, saying he released the source code for the bot late last month in part because he wanted others be able to test his claims.</p>
<p>In an interview with KrebsOnSecurity, Inzirillo admits he wrote the Nuclear Bot trojan as a proof-of-concept to demonstrate a method he developed that he says bypasses Rapport. But he denies ever selling or marketing the malware, and maintains that this was done without his permission by an acquaintance with whom he shared the code privately.</p>
<p>&#8220;I&#8217;ve been interested in malware since I [was] a child, and I wanted to have a challenge,&#8221; Inzirillo said. &#8220;I was excited about this, and having nobody to share this with, I distributed the code to &#8216;friends&#8217; who tried to profit off my work.&#8221;</p>
<p>After the source code for Nuclear Bot was <a href="https://github.com/aainz/TinyNuke" target="_blank">released on Github</a>, IBM followed up with a more <a href="https://securityintelligence.com/the-nukebot-trojan-a-bruised-ego-and-a-surprising-source-code-leak/" target="_blank">in-depth examination of it</a>, which argued that the author of the code appeared to release it in a failed bid to shore up his fragile ego.</p>
<p>According to IBM, a hacker calling himself &#8220;Gosya&#8221; tried to sell the malware in such a clumsy and inexperienced fashion that he managed to get himself banned from multiple cybercrime forums for violating specific rules about how such products should be sold.</p>
<p>&#8220;He did not have the malware tested and certified by forum admins, nor did he provide any test versions to members,&#8221; IBM researchers <strong>Limor Kessem</strong> and <strong>Ilya Kolmanovich </strong>wrote. &#8220;At the same time, he was attacked by existing competition, namely the FlokiBot vendor, who wanted to get down to the technical nitty gritty with him and find out if Gosya’s claims about his malware’s capabilities were indeed viable.&#8221;</p>
<p>The IBM authors continued:</p>
<blockquote><p>&#8220;In posts where he replied to challenging questions, Gosya got nervous and defensive, raising suspicion among other forum members. This was likely a simple case of inexperience, but it cost him the trust of potential buyers.&#8221;</p>
<p>&#8220;For his next wrong move, Gosya started selling on additional forums under multiple monikers. When fraudsters realized that the same person was trying to vend under different names, they got even more suspicious that he was a ripper, misrepresenting or selling a product he does not possess. The issue got worse when Gosya changed the malware’s name to Micro Banking Trojan in one last attempt to buy it a new life.&#8221;</p></blockquote>
<p>Inzirillo said the main reason he released his code was to prevent others from profiting off his creation. But now he says he regrets that decision as well.</p>
<p>&#8220;It was a big mistake, <span class="s1">because now I know people will reuse my code to steal money from other people,&#8221; Inzirillo told KrebsOnSecurity in an online chat. </span></p>
<p>Inzirillo released the code on Github with a short note explaining his motivations, and included a contact email address at a domain (inzirillo.com) set up long ago by his father, <strong>Daniel Inzirillo</strong>.</p>
<p>KrebsOnSecurity also reached out to Augustin&#8217;s dad, and heard back from him roughly an hour before Augustin replied to requests for an interview. Inzirillo the elder said his son used the family domain name in his source code release as part of a misguided attempt to impress him.</p>
<p>&#8220;He didn’t do it for money,&#8221; said Daniel Inzirillo, whose <a href="http://inzirillo.com/cven/" target="_blank">CV</a> shows he has built an impressive career in computer programming and working for various financial institutions. <span class="pullquote pqright">&#8220;He did it to spite all the cyber shitheads. The idea was that they wouldn’t be able to sell his software anymore because it was now free for grabs.&#8221;</span></p>
<p>Daniel Inzirillo said he&#8217;s worried because his son has expressed a strong interest in traveling to the United States after receiving a job offer from a supposed recruiter at a technology firm which said it was impressed by Augustin&#8217;s coding skills.</p>
<p>&#8220;I am very worried for him, because some technology company told him they wanted to fly him to the U.S. for a job interview as a result of him posting that online,&#8221; Daniel Inzirillo said. &#8220;There is a strong possibility that in one or two weeks he’s going to be flying to California, and I am concerned that maybe some guy in some law enforcement agency has his sights on him.&#8221;<span id="more-38914"></span></p>
<p>Augustin&#8217;s dad said he had hoped his son might choose a different profession than his own.</p>
<p>&#8220;I didn’t want him to do software development, I always wanted him to do something else,&#8221; Daniel said. &#8220;He was introduced to programming by a math teacher at school. As soon as he learned about this it became a passion for him. But I was so pissed off about this. Even though I have been doing software all my life, I didn’t have a good opinion about this profession. I got a degree in software development as a kind of &#8216;Plan B,&#8217; but I always felt there was something missing there, that it wasn’t intellectually satisfying.&#8221;</p>
<p>Nevertheless, Daniel said he is proud of his son&#8217;s intellectual abilities, noting that Augustin is completely self-taught in computer programming.</p>
<p>&#8220;I haven’t taught him anything, although sometimes he comes and he asks me some questions,&#8221; Daniel said. &#8220;He’s a self-made made man. In terms of software security and hacking, nearly everything he knows he learned by himself.&#8221;</p>
<p>Daniel said that after he and his wife divorced in 2012, his son went from being the first or second best student in his class to dropping out of school. After that, computers became an obsession for Augustin, he said.</p>
<p>Daniel said his son is extremely opinionated but not very emotionally intelligent, and he believes Augustin has strong misgivings about his chosen path. By way of example, he related a story about an incident in which Augustin was recently arrested after an altercation at a local establishment.</p>
<p>&#8220;When he got arrested, for no reason, he blurted out everything he was doing on his computer,&#8221; Daniel recalled. &#8220;The policemen couldn’t believe he was telling them that for no reason. I realized at that moment that he just wanted to get out. He didn’t want to continue doing what he was doing.&#8221;</p>
<p>Daniel said he&#8217;s deeply concerned for his kid&#8217;s future, but also recognizes that his son won&#8217;t listen to his counsel.</p>
<p>&#8220;He respects me, he admires me, and he knows in terms of software development I’m very good, and he wants to become like me but on the other hand he doesn’t want to listen to me,&#8221; Daniel said. &#8220;If my vision of things is written about, that might help him. But I&#8217;m also worried now that he might feel I have hijacked his notoriety. This is his story, his way of surpassing me, and he might hate me for being here.&#8221;</p>
<p class="p1"><span class="s1">Augustin said he wasn&#8217;t interested in discussing his father or his family life, but he did confirm (without elaborating) that he recently was offered a job in the United States. He remains somewhat ambivalent about the opportunity, but indicated he is leaning toward accepting it.</span></p>
<p class="p1"><span class="s1">&#8220;Well, I don&#8217;t think it&#8217;s fair that I would feel bad about getting a job because of this code, I just feel bad about having released the code,&#8221; he said. &#8220;I</span><span class="s1">f people want to offer me something interesting as a result, I don&#8217;t think it makes sense me saying no.&#8221;</span></p>


feed_id: https://krebsonsecurity.com/?p=38927
title: Gamestop.com Investigating Possible Breach
uri: Gamestop-com-Investigating-Possible-Breach
url: https://krebsonsecurity.com/2017/04/gamestop-com-investigating-possible-breach/
content:
<p>Video game giant <strong>GameStop Corp.</strong>  [NSYE: <a href="https://www.nyse.com/quote/XNYS:GME" target="_blank">GME</a>] says it is investigating reports that hackers may have siphoned credit card and customer data from its website &#8212; <strong>gamestop.com</strong>. The company acknowledged the investigation after being contacted by KrebsOnSecurity.</p>
<p><img class="alignright size-full wp-image-38928" src="media/fdb6c183.gs.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/gs.png" alt="gs" width="285" height="266" />&#8220;GameStop recently received notification from a third party that it believed payment card data from cards used on the GameStop.com website was being offered for sale on a website,&#8221; a company spokesman wrote in response to questions from this author.</p>
<p>&#8220;That day a leading security firm was engaged to investigate these claims. Gamestop has and will continue to work non-stop to address this report and take appropriate measures to eradicate any issue that may be identified,&#8221; the company&#8217;s statement continued.</p>
<p>Two sources in the financial industry told KrebsOnSecurity that they have received alerts from a credit card processor stating that Gamestop.com was likely compromised by intruders between mid-September 2016 and the first week of February 2017.</p>
<p>Those same sources said the compromised data is thought to include customer card number, expiration date, name, address and card verification value (CVV2), usually a 3-digit security code printed on the backs of credit cards.</p>
<p>Online merchants are not supposed to store CVV2 codes, but hackers can steal the codes by <a href="https://krebsonsecurity.com/2016/04/all-about-fraud-how-crooks-get-the-cvv/" target="_blank">placing malicious software on a company&#8217;s e-commerce site</a>, so that the data is copied and recorded by the intruders before the data is encrypted and transmitted to be processed.</p>
<p>GameStop would not comment on the possible timeframe of the suspected breach, or say what types of customer data might be impacted.</p>
<p><span id="more-38927"></span></p>
<p>Based in Grapevine, Texas, GameStop generated more than <a href="http://news.gamestop.com/phoenix.zhtml?c=130125&amp;p=irol-newsArticle&amp;ID=2256191" target="_blank">$8.6 billion in revenue in 2016</a>, although it&#8217;s unclear how much of that came through the company&#8217;s Web site. GameStop operates more than 7,000 retail stores through the United States, Canada, Australia, New Zealand and Europe. There is currently no indication that the company&#8217;s retail store locations may have been affected.</p>
<p>According to Web site statistics firm <strong>Alexa.com</strong>, Gamestop.com is the 269th most popular Web site in the United States.</p>
<p>&#8220;We regret any concern this situation may cause for our customers,&#8221; Game Stop said in its statement. &#8220;GameStop would like to remind its customers that it is always advisable to monitor payment card account statements for unauthorized charges. If you identify such a charge, report it immediately to the bank that issued the card because payment card network rules generally state that cardholders are not responsible for unauthorized charges that are timely reported.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=38941
title: Alleged Spam King Pyotr Levashov Arrested
uri: Alleged-Spam-King-Pyotr-Levashov-Arrested
url: https://krebsonsecurity.com/2017/04/alleged-spam-king-pyotr-levashov-arrested/
content:
<p>Authorities in Spain have arrested a Russian computer programmer thought to be one of the world&#8217;s most notorious spam kingpins.</p>
<p>Spanish police arrested <strong>Pyotr Levashov</strong> under an international warrant executed in the city of Barcelona, according to <a href="http://www.reuters.com/article/us-spain-russia-idUSKBN17B0O2" target="_blank">Reuters</a>. Russian state-run television station <strong>RT</strong> (formerly <em>Russia Today</em>) reported that Levashov was arrested while vacationing in Spain with his family.</p>
<div id="attachment_13548" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/9845b5d8.SeveraSpamdot.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot.png"><img class="wp-image-13548 size-medium" src="media/cb42cc90.SeveraSpamdot-600x414.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot-600x414.png" alt="Spamdot.biz moderator Severa listing prices to rent his Waledac spam botnet." width="580" height="400" srcset="http://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot-600x414.png 600w, http://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot-1024x706.png 1024w, http://krebsonsecurity.com/wp-content/uploads/2012/01/SeveraSpamdot.png 1249w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Spamdot.biz moderator Severa listing prices to rent his Waledac spam botnet.</p></div>
<p>According to numerous <a href="https://krebsonsecurity.com/?s=peter+severa&amp;x=0&amp;y=0" target="_blank">stories here at KrebsOnSecurity</a>, Levashov was better known as &#8220;<strong>Severa</strong>,&#8221; the hacker moniker used by a pivotal figure in many Russian-language cybercrime forums. Severa was the moderator for the spam subsection of multiple online communities, and in this role served as the virtual linchpin connecting virus writers with huge spam networks &#8212; including some that Severa allegedly created and sold himself.</p>
<p>Levashov is currently <a href="https://www.spamhaus.org/rokso/spammer/SPM893/peter-severa-peter-levashov" target="_blank">listed as #7</a> in the the world&#8217;s <a href="https://www.spamhaus.org/statistics/spammers/" target="_blank">Top 10 Worst Spammers</a> list maintained by anti-spam group <strong>Spamhaus</strong>. The U.S. Justice Department maintains that Severa was the Russian partner of <a href="https://en.wikipedia.org/wiki/Alan_Ralsky" target="_blank">Alan Ralsky</a>, a convicted American spammer who specialized in &#8220;<a href="https://en.wikipedia.org/wiki/Pump_and_dump" target="_blank">pump-and-dump</a>&#8221; spam schemes designed to artificially inflate the value of penny stocks.</p>
<p>Levashov allegedly went by the aliases <strong>Peter Severa</strong> and <strong>Peter of the North </strong>(Pyotr is the Russian form of Peter). My reporting indicates that &#8212; in addition to spamming activities &#8212; Severa was responsible for running multiple <a href="http://krebsonsecurity.com/2011/07/spam-fake-av-like-ham-eggs/" target="_blank">criminal operations that paid virus writers and spammers to install &#8220;fake antivirus&#8221; software</a>. So-called &#8220;fake AV&#8221; uses malware and/or programming tricks to bombard the victim with misleading alerts about security threats, hijacking the PC until its owner either pays for a license to the bogus security software or figures out how to remove the invasive program.</p>
<div id="attachment_10861" style="width: 567px" class="wp-caption aligncenter"><a class="lightbox" href="media/6e97a76f.sevdownload.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload.png"><img class="wp-image-10861 size-full" src="media/6e97a76f.sevdownload.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload.png" alt="A screenshot of a fake antivirus or &quot;scareware&quot; affiliate program run by &quot;Severa,&quot; allegedly the cybercriminal alias of Pyotr Levashov, the Russian arrested in Spain last week." width="557" height="550" srcset="http://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload-300x296.png 300w, http://krebsonsecurity.com/wp-content/uploads/2011/07/sevdownload.png 557w" sizes="(max-width: 557px) 100vw, 557px" /></a><p class="wp-caption-text">A screenshot of a fake antivirus or &#8220;scareware&#8221; affiliate program run by &#8220;Severa,&#8221; allegedly the cybercriminal alias of Pyotr Levashov.</p></div>
<p>There is <a href="https://krebsonsecurity.com/2012/01/mr-waledac-the-peter-north-of-spamming/" target="_blank">ample evidence</a> that Severa is the cybercriminal behind the <a href="https://en.wikipedia.org/wiki/Waledac_botnet" target="_blank">Waledac</a> spam botnet, a spam engine that for several years infected between 70,000 and 90,000 computers and was capable of sending approximately 1.5 billion spam messages a day.</p>
<p>In 2010, Microsoft launched a <a href="https://krebsonsecurity.com/2010/02/microsoft-ambushes-waledac-botnet-shutters-whistleblower-site/" target="_blank">combined technical and legal sneak attack</a> on the Waledac botnet, successfully dismantling it. The company would later do the same <a href="https://krebsonsecurity.com/2012/03/researchers-clobber-khelios-spam-botnet/" target="_blank">to the Kelihos botnet</a>, a global spam machine which shared a great deal of computer code with Waledac.</p>
<p>The connection between Waledac/Kelihos and Severa is supported by data leaked in 2010 after hackers <a title="SpamIt, Glavmed Pharmacy Networks Exposed" href="http://krebsonsecurity.com/2011/02/spamit-glavmed-pharmacy-networks-exposed/" target="_blank">broke into the servers of pharmacy spam affiliate program <strong>SpamIt</strong></a>. According to the stolen SpamIt records, Severa &#8212; this time using the alias &#8220;<strong>Viktor Sergeevich Ivashov&#8221;</strong> &#8212; brought in revenues of $438,000 and earned commissions of $145,000 spamming rogue online pharmacy sites over a 3-year period.</p>
<p>Severa also was a moderator of <strong>Spamdot.biz</strong> (pictured in the first screenshot above), a vetted, members-only forum that at one time attracted almost daily visits from most of Russia&#8217;s top spammers. Leaked Spamdot forum posts for Severa indicate that <a href="https://krebsonsecurity.com/2012/12/a-closer-look-at-two-bigtime-botmasters/" target="_blank">he hails from Saint Petersburg</a>, Russia&#8217;s second-largest city.<span id="more-38941"></span></p>
<p>According to an exhaustive analysis published in my book &#8212; <em><a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank">Spam Nation: The Inside Story of Organized Cybercrime</a> &#8212; </em>Severa likely made more money renting Waledac and other custom spam botnets to other spammers than blasting out junk email on his own. For $200, vetted users could hire one of his botnets to send 1 million pieces of spam. Junk email campaigns touting auction and employment scams cost $300 per million, and phishing emails designed to separate unwary email users from their usernames and passwords could be blasted out through Severa’s botnet for the bargain price of $500 per million.</p>
<p>The above-referenced Reuters story on Levashov&#8217;s arrest cited reporting from Russian news outlet RT which associated Levashov with hacking attacks linked to alleged interference in last year&#8217;s U.S. election. But subsequent updates from Reuters cast doubt on those claims.</p>
<p>&#8220;A U.S. Department of Justice official said it was a criminal matter without an apparent national security connection,&#8221; Reuters added in an update to an earlier version of its story.</p>
<p><em>The New York Times</em> <a href="https://www.nytimes.com/2017/04/09/world/europe/peter-severa-levahsov-russia-arrest.html?_r=0" target="_blank">reports</a> that Russian news media <em>did not</em> say if Levashov was suspected of being involved in that activity. However, <em>The Times</em> piece observes that the Kelihos botnet does have a historic association with election meddling, noting the botnet was used during the Russian election in 2012 to send political messages to email accounts on computers with Russian Internet addresses. According to <em>The Times</em>, those emails linked to fake news stories saying that <a href="https://en.wikipedia.org/wiki/Mikhail_Prokhorov" target="_blank">Mikhail D. Prokhorov</a>, a businessman who was running for president against <strong>Vladimir V. Putin</strong>, had come out as gay.</p>


feed_id: https://krebsonsecurity.com/?p=38975
title: Fake News at Work in Spam Kingpin’s Arrest?
uri: Fake-News-at-Work-in-Spam-Kingpin-s-Arrest
url: https://krebsonsecurity.com/2017/04/fake-news-at-work-in-spam-kingpins-arrest/
content:
<p>Over the past several days, many Western news media outlets have predictably devoured thinly-sourced reporting from a Russian publication that the arrest last week of a Russian spam kingpin in Spain was related to hacking attacks linked to last year’s U.S. election. While there is scant evidence that the spammer&#8217;s arrest had anything to do with the election, the success of that narrative is a sterling example of how the Kremlin&#8217;s propaganda machine is adept at manufacturing fake news, undermining public trust in the media, and distracting attention away from the real story.</p>
<div id="attachment_37553" style="width: 290px" class="wp-caption alignright"><img class=" wp-image-37553" src="media/d6e4f446.VPofRT.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/01/VPofRT.png" alt="Russian President Vladimir Putin tours RT facilities. Image: DNI" width="280" height="305" /><p class="wp-caption-text">Russian President Vladimir Putin tours RT facilities. Image: DNI</p></div>
<p>On Saturday, news broke from <a href="https://russian.rt.com/world/article/376746-po-zaprosu-fbr-zaderzhan-programmist" target="_blank">RT.com</a> (formerly <em>Russia Today</em>) that authorities in Spain had arrested 36-year-old <strong>Peter &#8220;Severa&#8221; Levashov</strong>, one of the most-wanted spammers on the planet and the alleged creator of some of the nastiest cybercrime engines in history &#8212; including the <a href="https://en.wikipedia.org/wiki/Storm_Worm" target="_blank">Storm worm</a>, and the <a href="https://krebsonsecurity.com/?s=waledac&amp;x=0&amp;y=0" target="_blank">Waledac</a> and <a href="https://krebsonsecurity.com/?s=kelihos&amp;x=0&amp;y=0" target="_blank">Kelihos</a> spam botnets.</p>
<p>But the RT story didn&#8217;t lead with Levashov&#8217;s alleged misdeeds or his primacy among junk emailers and virus writers. Rather, the publication said it interviewed Levashov&#8217;s wife <strong>Maria</strong>, who claimed that Spanish authorities said her husband was detained because he was suspected of being involved in hacking attacks aimed at influencing the 2016 U.S. election.</p>
<p>The RT piece is fairly typical of one that covers the arrest of Russian hackers in that the story quickly becomes not about the criminal charges but about how the accused is being unfairly treated or maligned by overzealous or misguided Western law enforcement agencies.</p>
<p>The RT story about Levashov, for example, seems engineered to leave readers with the impression that some bumbling cops rudely disturbed the springtime vacation of a nice Russian family, stole their belongings, and left a dazed and confused young mother alone to fend for herself and her child.</p>
<p>This should not be shocking to any journalist or reader who has paid attention to U.S. intelligence agency reports on Russia&#8217;s efforts to influence the outcome of last year&#8217;s election. A <a href="https://krebsonsecurity.com/2017/01/dni-putin-led-cyberattack-propaganda-effort-to-elect-trump-denigrate-clinton/" target="_blank">25-page dossier</a> released in January by the <strong>Office of the Director of National Intelligence </strong>describes RT as a U.S.-based but Kremlin-financed media outlet that is little more than an engine of anti-Western propaganda controlled by Russian intelligence agencies.</p>
<p>Somehow, this small detail was lost on countless Western media outlets, who seemed all too willing to parrot the narrative constructed by RT regarding Levashov&#8217;s arrest. With a brief nod to RT&#8217;s &#8220;scoop,&#8221; these publications back-benched the real story (the long-sought capture of one of the world&#8217;s most wanted spammers) and led with an angle supported by the flimsiest of sourcing.<span id="more-38975"></span></p>
<p>On Monday, the <strong>U.S. Justice Department</strong> released <a href="https://www.justice.gov/opa/pr/justice-department-announces-actions-dismantle-kelihos-botnet-0" target="_blank">a bevy of documents</a> detailing Levashov&#8217;s alleged history as a spammer, and many of the sordid details in the allegations laid out in the government&#8217;s case echoed those in <a href="https://krebsonsecurity.com/2017/04/alleged-spam-king-pyotr-levashov-arrested/" target="_blank">a story I published early Monday</a>. Investigators said they had <a href="https://www.justice.gov/opa/pr/justice-department-announces-actions-dismantle-kelihos-botnet-0" target="_blank">dismantled the Kelihos botnet</a> that Severa allegedly built and used to distribute junk email, but they <em>also emphasized that Levashov&#8217;s arrest had nothing to do with hacking efforts tied to last year&#8217;s election.</em></p>
<p>&#8220;Despite Russian news media reports to the contrary, American officials said Mr. Levashov played no role in attempts by <a href="https://www.nytimes.com/2016/12/13/us/politics/russia-hack-election-dnc.html" data-ss1491915577="1">Russian government hackers to meddle in the 2016 presidential election</a> and support the candidacy of Donald J. Trump,&#8221; The New York Times <a href="https://www.nytimes.com/2017/04/10/technology/us-arrest-russian-email-spam-peter-levashov.html" target="_blank">reported</a>.</p>
<p>Nevertheless, from the Kremlin&#8217;s perspective, the RT story is almost certainly being viewed as an unqualified success: It distracted attention away from the real scoop (a major Russian spammer was apprehended); it made much of the news media appear unreliable and foolish by regurgitating fake news; and it continued to sow doubt in the minds of the Western public about the legitimacy of democratic process.</p>
<p>Levashov&#8217;s wife may well have been told her husband was wanted for political hacking. Likewise, Levashov could have played a part in Russian hacking efforts aimed at influencing last year&#8217;s election. As noted here and in <em>The New York Times</em> earlier this week, the Kelihos botnet does have a historic association with election meddling: It was used during the Russian election in 2012 to send political messages to email accounts on computers with Russian Internet addresses.</p>
<p>According to <em>The Times</em>, those emails linked to fake news stories saying that <a href="https://en.wikipedia.org/wiki/Mikhail_Prokhorov" target="_blank">Mikhail D. Prokhorov</a>, a businessman who was running for president against <strong>Vladimir V. Putin</strong>, had come out as gay. It&#8217;s also well established that the Kremlin has a history of <a href="https://krebsonsecurity.com/2017/03/four-men-charged-with-hacking-500m-yahoo-accounts/" target="_blank">recruiting successful criminal hackers</a> for <a href="https://krebsonsecurity.com/2017/01/the-download-on-the-dnc-hack/" target="_blank">political and espionage purposes</a>.</p>
<p>But the less glamorous truth in this case is that the facts as we know them so far <em>do not</em> support the narrative that Levashov was involved in hacking activities related to last year&#8217;s election. To insist otherwise absent any facts to support such a conclusion only encourages the spread of more fake news.</p>


feed_id: https://krebsonsecurity.com/?p=38974
title: Critical Security Updates from Adobe, Microsoft
uri: Critical-Security-Updates-from-Adobe-Microsoft
url: https://krebsonsecurity.com/2017/04/critical-security-updates-from-adobe-microsoft/
content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> separately issued updates on Tuesday to fix a slew of security flaws in their products. Adobe patched dozens of holes in its <strong>Flash Player</strong>, <strong>Acrobat</strong> and <strong>Reader</strong> products. Microsoft pushed fixes to address dozens of vulnerabilities in <strong>Windows</strong> and related software.</p>
<p><img class="alignright wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="208" height="218" />The biggest change this month for Windows users and specifically for people responsible for maintaining lots of Windows machines is that Microsoft has replaced individual security bulletins for patches with a single &#8220;<a href="https://portal.msrc.microsoft.com/en-us/" target="_blank">Security Update Guide</a>.&#8221;</p>
<p>This change follows closely on the heels of a move by Microsoft to <a href="https://krebsonsecurity.com/2016/10/microsoft-no-more-pick-and-choose-patching/" target="_blank">bar home users from selectively downloading specific updates</a> and instead issuing all monthly updates as one big patch blob.</p>
<p>Microsoft&#8217;s <a href="https://blogs.technet.microsoft.com/msrc/2016/11/08/furthering-our-commitment-to-security-updates/" target="_blank">claims</a> that customers have been clamoring for this consolidated guide notwithstanding, many users are likely to be put off by the new format, which seems to require a great deal more clicking and searching than under the previous rubric. In any case, Microsoft has released <a href="https://technet.microsoft.com/en-us/security/mt791750" target="_blank">a FAQ</a> explaining what&#8217;s changed and what folks can expect under the new arrangement.</p>
<p>By my count, Microsoft&#8217;s patches this week address some 46 security vulnerabilities, including flaws in <strong>Internet Explorer</strong>, <strong>Microsoft Edge</strong>, <strong>Windows</strong>, <strong>Office</strong>, <strong>Visual Studio for Mac</strong>, <strong>.NET Framework</strong>, <strong>Silverlight</strong> and Adobe Flash Player.</p>
<p>At least two of the critical bugs fixed by Microsoft this month are already being exploited in active attacks, including a weakness in Microsoft Word that is showing up in attacks designed to <a href="https://www.proofpoint.com/us/threat-insight/post/dridex-campaigns-millions-recipients-unpatched-microsoft-zero-day" target="_blank">spread the Dridex banking trojan</a>.</p>
<p>Finally, a heads up for any Microsoft users still running <strong>Windows Vista: </strong>This month is <a href="https://support.microsoft.com/en-us/help/13853/windows-lifecycle-fact-sheet" target="_blank">slated</a> to be the last that Vista will receive security updates. Vista was first released to consumers more than ten years ago &#8212; in January 2007 &#8212; so if you&#8217;re still using Vista it might be time to give a more modern OS a try (doesn&#8217;t have to be Windows&#8230;just saying).<span id="more-38974"></span></p>
<p>As it is wont to do on Microsoft&#8217;s Patch Tuesday, Adobe pushed its own batch of security patches. The usual &#8220;critical&#8221; <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-10.html" target="_blank">update for Flash Player</a> fixes at least seven flaws. The newest version is <em>v. 25.0.0.148 </em>for Windows, Mac and Linux systems.</p>
<p>As loyal readers here no doubt already know, I dislike Flash because it&#8217;s full of security holes, is a favorite target of drive-by malware exploits, and isn&#8217;t really necessary to be left installed or turned on all the time anymore.</p>
<p>Hence, if you have Flash installed, you should update, hobble or remove Flash as soon as possible. To see which version of Flash your browser may have installed, check out <a href="http://www.adobe.com/software/flash/about/" target="_blank">this page</a>.</p>
<p>The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. An extremely powerful and buggy program that binds itself to the browser, Flash is a favorite target of attackers and malware. For some ideas about how to hobble or do without Flash (as well as slightly less radical solutions) check out <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to keep Flash, please update it today. The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then.</p>
<p>Adobe also issued security fixes for its Photoshop, Adobe Reader and Acrobat software packages. The <a href="https://helpx.adobe.com/security/products/acrobat/apsb17-11.html" target="_blank">Reader/Acrobat updates</a> address a whopping 47 security holes in these products, so if you&#8217;ve got either program installed please take a moment to update.</p>
<p>As ever, please leave a note in the comment section if you run into any difficulties downloading or installing any of these patches.</p>


feed_id: https://krebsonsecurity.com/?p=39015
title: Shoney’s Hit By Apparent Credit Card Breach
uri: Shoney-s-Hit-By-Apparent-Credit-Card-Breach
url: https://krebsonsecurity.com/2017/04/shoneys-hit-by-apparent-credit-card-breach/
content:
<p>It&#8217;s Friday, which means it&#8217;s time for another episode of &#8220;Which Restaurant Chain Got Hacked?&#8221; Multiple sources in the financial industry say they&#8217;ve traced a pattern of fraud on customer cards indicating that the latest victim may be <strong>Shoney&#8217;s</strong>, a 70-year-old restaurant chain that operates primarily in the southern United States.</p>
<div id="attachment_39017" style="width: 290px" class="wp-caption alignright"><img class=" wp-image-39017" src="media/e724c5d6.shoneys-580x360.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/shoneys-580x360.png" alt="Image: Thomas Hawk, Flickr." width="280" height="174" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/shoneys-580x360.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/shoneys-768x477.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/04/shoneys-940x584.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/04/shoneys.png 972w" sizes="(max-width: 280px) 100vw, 280px" /><p class="wp-caption-text">Image: Thomas Hawk, Flickr.</p></div>
<p>Shoney&#8217;s did not respond to multiple requests for comment left with the company and its outside public relations firm over the past two weeks.</p>
<p>Based in Nashville, Tenn., the privately-held restaurant chain includes approximately 150 company-owned and franchised locations in 17 states from Maryland to Florida in the east, and from Missouri to Texas in the West &#8212; with the northernmost location being in Ohio, according to <a href="https://en.wikipedia.org/wiki/Shoney%27s" target="_blank">the company&#8217;s Wikipedia page</a>.</p>
<p>Sources in the financial industry say they&#8217;ve received confidential alerts from the credit card associations about suspected breaches at dozens of those locations, although it remains unclear whether the problem is limited to those locations or if it extends company-wide. Those same sources say the affected locations were thought to have been breached between December 2016 and early March 2017.</p>
<p>It&#8217;s also unclear whether the apparent breach affects corporate-owned or franchised stores &#8212; or both. In last year&#8217;s card breach involving <a href="https://krebsonsecurity.com/?s=wendy%27s+breach&amp;x=0&amp;y=0" target="_blank">hundreds of Wendy&#8217;s restaurants</a>, only franchised locations were thought to have been impacted. In the case of <a href="https://krebsonsecurity.com/2017/02/fast-food-chain-arbys-acknowledges-breach/" target="_blank">the intrusion at Arby&#8217;s</a>, on the other hand, only corporate stores were affected.<span id="more-39015"></span></p>
<p>The vast majority of the breaches involving restaurant and hospitality chains over the past few years have been tied to point-of-sale devices that were remotely hacked and seeded with card-stealing malicious software.</p>
<p>Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register. Thieves can then sell the data to crooks who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to buy gift cards and high-priced goods from big-box stores like Target and Best Buy.</p>
<p>Many retailers are now moving to install card readers that can handle transactions from more secure chip-based credit and debit cards, which are far more expensive for thieves to clone. Malware that makes it onto point-of-sale devices capable of processing chip card transactions can still intercept data from a customer&#8217;s chip-enabled card, but that information cannot later be used to create a cloned physical copy of the card.</p>


feed_id: https://krebsonsecurity.com/?p=39034
title: InterContinental Hotel Chain Breach Expands
uri: InterContinental-Hotel-Chain-Breach-Expands
url: https://krebsonsecurity.com/2017/04/intercontinental-hotel-chain-breach-expands/
content:
<p>In December 2016, KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/12/holiday-inn-parent-ihg-probes-breach-claims/" target="_blank">broke the news</a> that fraud experts at various banks were seeing a pattern suggesting a widespread credit card breach across some 5,000 hotels worldwide owned by <strong>InterContinental Hotels Group</strong> (IHG). In February, IHG acknowledged a breach but said it appeared to involve <a href="https://krebsonsecurity.com/2017/02/intercontinental-confirms-breach-at-12-hotels/" target="_blank">only a dozen properties</a>. Now, IHG has released data showing that cash registers at more than 1,000 of its properties were compromised with malicious software designed to siphon customer debit and credit card data.</p>
<div id="attachment_37384" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-37384" src="media/efab030b.ihg-ny-580x356.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny-580x356.png" alt="An Intercontinental hotel in New York City." width="580" height="356" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny-580x356.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny-768x471.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny-940x576.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/12/ihg-ny.png 943w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An Intercontinental hotel in New York City.</p></div>
<p>Headquartered in Denham, U.K., IHG operates more than 5,000 hotels across nearly 100 countries. The company’s <a href="https://www.ihgplc.com/our-brands" target="_blank">dozen brands</a> include <strong>Holiday Inn</strong>, <strong>Holiday Inn Express</strong>, <strong>InterContinental</strong>, <strong>Kimpton Hotels</strong>, and <strong>Crowne Plaza</strong>.</p>
<p>According to <a href="https://www.ihg.com/content/us/en/customer-care/protecting-our-guests/california-residents" target="_blank">a statement</a> released by IHG, the investigation &#8220;identified signs of the operation of malware designed to access payment card data from cards used onsite at front desks at certain IHG-branded franchise hotel locations between September 29, 2016 and December 29, 2016.&#8221;</p>
<p>IHG didn&#8217;t say how many properties total were affected, although it has published a state-by-state lookup tool <a href="https://www.ihg.com/content/us/en/customer-care/protecting-our-guests/property-listing" target="_blank">available here</a>. I counted 28 in my hometown state of Virginia alone, California more than double that; Alabama almost the same number as Virginia. So north of 1,000 locations nationwide seems very likely.</p>
<p>IHG has been offering its franchised properties a free examination by an outside computer forensic team hired to look for signs of the same malware infestation known to have hit other properties. But not all property owners have been anxious to take the company up on that offer. As a consequence, there may be more breached hotel locations yet to be added to the state lookup tool.</p>
<div id="attachment_39035" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39035" src="media/e4cb58ff.ihgurgent1-580x726.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/ihgurgent1-580x726.png" alt="A letter from IHG to franchise customers, offering to pay for the cyber forensics examination." width="580" height="726" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/ihgurgent1-580x726.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/ihgurgent1.png 712w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A letter from IHG to franchise customers, offering to pay for the cyber forensics examination.</p></div>
<p>IHG franchises who accepted the security inspections <a href="media/d78c50c4.ihgurgent1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/ihgurgent1.png" target="_blank">were</a> <a href="media/509b3597.ihgurgent2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/ihgurgent2.png" target="_blank">told</a> they would receive a consolidated report sharing information specific to the property, and that &#8220;your acquiring bank and/or processor may contact you regarding this investigation.&#8221;</p>
<p>IHG also has been trying to steer franchised properties toward adopting its &#8220;secure payment solution&#8221; (SPS) that ensures cardholder data remains encrypted at all times and at every &#8220;hop&#8221; across the electronic transaction. According to IHG, properties that used its solution prior to the initial intrusion on Sept. 29, 2016 were not affected.</p>
<p>&#8220;Many more properties implemented SPS after September 29, 2016, and the implementation of SPS ended the ability of the malware to find payment card data,&#8221; IHG wrote.<span id="more-39034"></span></p>
<p>Card-stealing cyber thieves have broken into some of the largest hotel chains over the past few years. Hotel brands that have acknowledged card breaches over the last year after prompting by KrebsOnSecurity include <a href="https://krebsonsecurity.com/2016/09/kimpton-hotels-acknowledges-data-breach/" target="_blank">Kimpton Hotels</a>, <a href="http://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/" target="_blank">Trump Hotels</a> (<a href="http://krebsonsecurity.com/2016/04/sources-trump-hotels-breached-again/" target="_blank">twice</a>), <a href="http://krebsonsecurity.com/2015/09/banks-card-breach-at-hilton-hotel-properties/" target="_blank">Hilton</a>, <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">Mandarin Oriental</a>, and <a href="http://krebsonsecurity.com/2014/01/hotel-franchise-firm-white-lodging-investigates-breach/" target="_blank">White Lodging</a> (<a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">twice</a>). Card breaches also have hit hospitality chains <a href="http://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/" target="_blank">Starwood Hotels</a> and <a href="http://krebsonsecurity.com/2016/01/hyatt-card-breach-hit-250-hotels-in-50-nations/" target="_blank">Hyatt</a>. <span id="more-36174"></span></p>
<p>In many of those incidents, thieves planted malicious software on the point-of-sale devices at restaurants and bars inside of the hotel chains. Point-of-sale based malware has driven most of the credit card breaches over the past two years, including intrusions at <a href="https://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a href="https://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a>, as well as breaches at <a href="https://krebsonsecurity.com/?s=point-of-sale+vendor&amp;x=0&amp;y=0" target="_blank">a slew of point-of-sale vendors</a>. The malicious code usually is installed via hacked remote administration tools. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.</p>
<p>Thieves can then <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">sell that data to crooks</a> who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to purchase high-priced electronics and gift cards from big-box stores like Target and Best Buy.</p>
<p>It&#8217;s a good bet that none of the above-mentioned companies were running <a href="https://www.pcisecuritystandards.org/assessors_and_solutions/point_to_point_encryption_solutions" target="_blank">point-to-point encryption</a> (P2PE) solutions <em>before</em> they started hemorrhaging customer credit cards. P2PE is an added cost for sure, but it can protect customer card data even on point-of-sale systems that are already compromised because the malware can no longer read the data going across the wire.</p>
<p>Readers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the unauthorized transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).</p>


feed_id: https://krebsonsecurity.com/?p=39028
title: Tracing Spam: Diet Pills from Beltway Bandits
uri: Tracing-Spam-Diet-Pills-from-Beltway-Bandits
url: https://krebsonsecurity.com/2017/04/tracing-spam-diet-pills-from-beltway-bandits/
content:
<p>Reading junk spam messages isn&#8217;t exactly my idea of a good time, but sometimes fun can be had when you take a moment to check who really sent the email. Here&#8217;s the simple story of how a recent spam email advertising celebrity &#8220;diet pills&#8221; was traced back to a Washington, D.C.-area defense contractor that builds tactical communications systems for the U.S. military and intelligence communities.</p>
<p><img class="alignright wp-image-8495" src="media/f3c33868.atball-300x300.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/03/atball-300x300.jpg" alt="atball" width="262" height="262" srcset="http://krebsonsecurity.com/wp-content/uploads/2011/03/atball-150x150.jpg 150w, http://krebsonsecurity.com/wp-content/uploads/2011/03/atball-300x300.jpg 300w" sizes="(max-width: 262px) 100vw, 262px" />Your average spam email can contain a great deal of information about the systems used to blast junk email. If you&#8217;re lucky, it may even offer insight into the organization that owns the networked resources (computers, mobile devices) which have been hacked for use in sending or relaying junk messages.</p>
<p>Earlier this month, anti-spam activist and expert <a href="https://krebsonsecurity.com/?s=Ron+Guilmette&amp;x=0&amp;y=0" target="_blank">Ron Guilmette</a> found himself poring over the &#8220;headers&#8221; for a spam message that set off a curious alert. &#8220;Headers&#8221; are the usually unseen addressing and routing details that accompany each message. They&#8217;re generally unseen because they&#8217;re hidden unless you know <a href="https://mxtoolbox.com/Public/Content/EmailHeaders/" target="_blank">how and where to look for them</a>.</p>
<p>Let&#8217;s take the headers from this particular email &#8212; from April 12, 2017 &#8212; as an example. To the uninitiated, email headers may seem like an overwhelming dump of information. But there really are only a few things we&#8217;re interested in here (Guilmette&#8217;s actual email address has been modified to &#8220;ronsdomain.example.com&#8221; in the otherwise unaltered spam message headers below):<span id="more-39028"></span></p>
<blockquote><p>Return-Path: &lt;dan@gtacs.com&gt;<br />
X-Original-To: rfg-myspace@ronsdomain.example.com<br />
Delivered-To: rfg-myspace@ronsdomain.example.com<br />
Received: from host.psttsxserver.com (host.tracesystems.com [72.52.186.80])<br />
by subdomain.ronsdomain.example.com (Postfix) with ESMTP id 5FE083AE87<br />
for &lt;rfg-myspace@ronsdomain.example.com&gt;; Wed, 12 Apr 2017 13:37:44 -0700 (PDT)<br />
DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/relaxed; d=gtacs.com;<br />
s=default; h=MIME-Version:Content-Type:Date:Message-ID:Subject:To:From:<br />
Sender:Reply-To:Cc:Content-Transfer-Encoding:Content-ID:Content-Description:<br />
Resent-Date:Resent-From:Resent-Sender:Resent-To:Resent-Cc:Resent-Message-ID:<br />
In-Reply-To:References:List-Id:List-Help:List-Unsubscribe:List-Subscribe:<br />
List-Post:List-Owner:List-Archive;<br />
Received: from [186.226.237.238] (port=41986 helo=[127.0.0.1])<br />
by host.psttsxserver.com with esmtpsa (TLSv1:DHE-RSA-AES256-SHA:256)<br />
(Exim 4.87)<br />
(envelope-from &lt;dan@gtacs.com&gt;)<br />
id 1cyP1J-0004K8-OR<br />
for rfg-myspace@ronsdomain.example.com; Wed, 12 Apr 2017 16:37:42 -0400<br />
From: dan@gtacs.com<br />
To: rfg-myspace@ronsdomain.example.com<br />
Subject: Discover The Secret How Movies &amp; Pop Stars Are Still In Shape<br />
Message-ID: &lt;F5E99999.A1F67C94585E5E2F@gtacs.com&gt;<br />
X-Priority: 3<br />
Importance: Normal<br />
Date: Wed, 12 Apr 2017 22:37:39 +0200<br />
X-Original-Content-Type: multipart/alternative;<br />
boundary=&#8221;&#8211;InfrawareEmailBoundaryDepth1_FD5E8CC5&#8211;&#8221;<br />
MIME-Version: 1.0<br />
X-Mailer: Infraware POLARIS Mobile Mailer v2.5<br />
X-AntiAbuse: This header was added to track abuse, please include it with any abuse report<br />
X-AntiAbuse: Primary Hostname &#8211; host.psttsxserver.com<br />
X-AntiAbuse: Original Domain &#8211; ronsdomain.example.com<br />
X-AntiAbuse: Originator/Caller UID/GID &#8211; [47 12] / [47 12]<br />
X-AntiAbuse: Sender Address Domain &#8211; gtacs.com<br />
X-Get-Message-Sender-Via: host.psttsxserver.com: authenticated_id: dan@gtacs.com<br />
X-Authenticated-Sender: host.psttsxserver.com: dan@gtacs.com</p>
<p>Celebrities always have to look good and that&#8217;s as hard as you might<br />
{&#8230; snipped&#8230;}</p></blockquote>
<p>In this case, the return address is <strong>dan@gtacs.com. </strong>The other bit to notice is the Internet address and domain referenced in the fourth line, after &#8220;Received,&#8221; which reads: &#8220;from host.psttsxserver.com (host.tracesystems.com [72.52.186.80])&#8221;</p>
<p>Gtacs.com belongs to the <a href="https://gtacs.com/user" target="_blank">Trace Systems GTACS Team Portal</a>, a Web site explaining that GTACS is part of the <a href="https://web-beta.archive.org/web/20160620181833/http://www.tracesystems.com:80/management-team" target="_blank">Trace Systems Team</a>, which <a href="https://web-beta.archive.org/web/20160705004608/http://www.tracesystems.com:80/gtacs" target="_blank">contracts</a> to provide &#8220;a full range of tactical communications systems, systems engineering, integration, installation and technical support services to the Department of Defense (DoD), Department of Homeland Security (DHS), and Intelligence Community customers.&#8221; The company lists some of its customers <a href="https://gtacs.com/about-trace-team" target="_blank">here</a>.</p>
<div id="attachment_39059" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/2c127ac3.tracenavy.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/tracenavy.png"><img class="wp-image-39059 size-medium" src="media/d4582525.tracenavy-580x323.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/tracenavy-580x323.png" alt="The home page of Trace Systems." width="580" height="323" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/tracenavy-580x323.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/tracenavy-768x427.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/04/tracenavy-940x523.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The home page of Trace Systems.</p></div>
<p>Both Gtacs.com and tracesystems.com say the companies &#8220;provide Cybersecurity and Intelligence expertise in support of national security interests: &#8220;GTACS is a contract vehicle that will be used by a variety of customers within the scope of C3T systems, equipment, services and data,&#8221; the company&#8217;s site says. The &#8220;C3T&#8221; part is military speak for &#8220;Command, Control, Communications, and Tactical.&#8221;</p>
<p>Passive domain name system (DNS) records maintained by <a href="https://www.dnsdb.info/" target="_blank">Farsight Security</a> for the Internet address listed in the spam headers &#8212; 72.52.186.80 &#8212; show that gtacs.com was at one time on that same Internet address along with many domains and subdomains associated with Trace Systems.</p>
<p>It is true that some of an email&#8217;s header information can be forged. For example, spammers and their tools can falsify the email address in the &#8220;from:&#8221; line of the message, as well as in the &#8220;reply-to:&#8221; portion of the missive. But neither appears to have been forged in this particular piece of pharmacy spam.</p>
<div id="attachment_39060" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/facd10c9.gtacs.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/gtacs.png"><img class="wp-image-39060 size-medium" src="media/d4fcf3ed.gtacs-580x411.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/gtacs-580x411.png" alt="The Gtacs.com home page." width="580" height="411" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/gtacs-580x411.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/gtacs-768x544.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/04/gtacs-940x666.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/04/gtacs.png 1030w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The Gtacs.com home page.</p></div>
<p>I forwarded this spam message back to Dan@gtacs.com, the apparent sender. Receiving no response from Dan after several days, I grew concerned that cybercriminals might be rooting around inside the networks of this defense contractor that does communications for the U.S. military. Clumsy and not terribly bright spammers, but intruders to be sure. So I forwarded the spam message to a Linkedin contact at Trace Systems who does incident response contracting work for the company.</p>
<p>My Linkedin source forwarded the inquiry to a &#8220;task lead&#8221; at Trace who said he&#8217;d been informed gtacs.com wasn&#8217;t a Trace Systems domain. Seeking more information in the face of many different facts that support a different conclusion, I escalated the inquiry to <strong>Matthew Sodano</strong>, a vice president and chief information officer at Trace Systems Inc.</p>
<p>&#8220;The domain and site in question is hosted and maintained for us by an outside provider,&#8221; Sodano said. &#8220;We have alerted them to this issue and they are investigating. The account has been disabled.&#8221;</p>
<p>Presumably, the company&#8217;s &#8220;outside provider&#8221; was <strong>Power Storm Technologies</strong>, the company that apparently owns the servers which sent the unauthorized spam from Dan@gtacs.com. Power Storm did not return messages seeking comment.</p>
<p>According to Guilmette, <span class="pullquote pqright">whoever Dan is or was at Gtacs.com, he got his account compromised by some fairly inept spammers who evidently did not know or didn&#8217;t care that they were inside of a U.S. defense contractor which specializes in custom military-grade communications.</span> Instead, the intruders chose to use those systems in a way almost guaranteed to call attention to the compromised account and hacked servers used to forward the junk email.</p>
<p>&#8220;Some&#8230;contractor who works for a Vienna, Va. based government/military &#8216;cybersecurity&#8217; contractor company has apparently lost his outbound email credentials (which are probably useful also for remote login) to a spammer who, I believe, based on the available evidence, is most likely located in Romania,&#8221; Guilmette wrote in an email to this author.</p>
<p>Guilmette told KrebsOnSecurity that he&#8217;s been tracking this particular pill spammer since Sept. 2015. Asked why he&#8217;s so certain the same guy is responsible for this and other specific spams, Guilmette shared that the spammer composes his spam messages with the same telltale HTML &#8220;signature&#8221; in the hyperlink that forms the bulk of the message: An extremely old version of Microsoft Office.</p>
<p>This spammer apparently didn&#8217;t mind spamming Web-based discussion lists. For example, he even<a href="http://lists.arin.net/pipermail/arin-ppml/2017-April/031369.html" target="_blank"> sent one of his celebrity diet pill scams to a list</a> maintained by the <a href="https://en.wikipedia.org/wiki/American_Registry_for_Internet_Numbers" target="_blank">American Registry for Internet Numbers</a> (ARIN), the regional Internet registry for Canada and the United States. ARIN&#8217;s list scrubbed the HTML file that the spammer attached to the message. Clicking the <a href="http://lists.arin.net/pipermail/arin-ppml/attachments/20170416/8e098320/attachment.html" target="_blank">included link</a> to view the scrubbed attachment sent to the ARIN list turns up this page. And if you look near the top of that page, you&#8217;ll see something that says:</p>
<p>&#8221;  &#8230; xmlns:m=&#8221;<a href="http://schemas.microsoft.com/office/2004/12/omml" target="_blank" rel="noreferrer" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://schemas.microsoft.com/office/2004/12/omml&amp;source=gmail&amp;ust=1492553948646000&amp;usg=AFQjCNHnjIKfNAb0HU0ngEP6f34O1UXlIQ">http://schemas.<wbr />microsoft.com/office/2004/12/<wbr />omml</a>&#8221; &#8230;&#8221;</p>
<p>&#8220;Of course, there are a fair number of regular people who are also still using this ancient MS Office to compose emails, but as far as I can tell, this is the only big-time spammer who is using this at the moment,&#8221; Guilmette said. &#8220;I&#8217;ve got dozens and dozens of spams, all from this same guy, stretching back about 18 months.  They all have the same style and all were composed with &#8220;/office/2004/12/&#8221;.</p>
<p>Guilmette claims that the same spammers who&#8217;ve been sending that ancient Office spam from defense contractors also have been spamming from compromised &#8220;Internet of Things&#8221; devices, like a hacked video conferencing system based in China. Guilmette says the spammer has been known to send out malicious links in email that use malicious JavaScript exploits to snarf credentials stored on the compromised machine, and he guesses that Dan@gtacs.com probably opened one of the booby-trapped JavaScript links.</p>
<p>&#8220;When and if he finds any, he uses those stolen credentials to send out yet more spam via the mail server of the &#8216;legit&#8217; company,&#8221; Guilmette said. &#8220;And because the spams are now coming out of &#8216;legit&#8217; mail servers belonging to &#8216;legit&#8217; companies, they never get blocked, by Spamhaus or by any other blacklists.&#8221;</p>
<p>We can only hope that the spammer who pulled this off doesn&#8217;t ever realize the probable value of this specific set of login credentials that he has managed to make off with, among many others, Guilmette said.</p>
<p>&#8220;If he <em>did</em> realize what he has in his hands, I feel sure that the Russians and/or the Chinese would be more than happy to buy those credentials from him, probably reimbursing him more for those than any amount he could hope to make in years of spamming.&#8221;</p>
<p>This isn&#8217;t the first time a small email oops may have created a big problem for a Washington-area cybersecurity defense contractor. Last month, <strong>Defense Point Security</strong> &#8212; which provides cyber contracting services to the security operations center for DHS&#8217;s <strong>Immigration and Customs Enforcement</strong> (ICE) division &#8212; <a href="https://krebsonsecurity.com/2017/03/govt-cybersecurity-contractor-hit-in-w-2-phishing-scam/" target="_blank">alerted some 200-300 current and former employees</a> that their W-2 tax information was given away to scammers after an employee fell for a phishing scam that spoofed the boss.</p>
<p>Want to know more about how to find and read email headers? <a href="https://mxtoolbox.com/Public/Content/EmailHeaders/" target="_blank">This site</a> has a handy reference showing you how to reveal headers on more than two-dozen different email programs, including Outlook, Yahoo!, Hotmail and Gmail. <a href="https://www.howtogeek.com/108205/htg-explains-what-can-you-find-in-an-email-header/" target="_blank">This primer</a> from <strong>HowToGeek.com</strong> explains what kinds of information you can find in email headers and what they all mean.</p>


feed_id: https://krebsonsecurity.com/?p=39030
title: How Cybercrooks Put the Beatdown on My Beats
uri: How-Cybercrooks-Put-the-Beatdown-on-My-Beats
url: https://krebsonsecurity.com/2017/04/how-cybercrooks-put-the-beatdown-on-my-beats/
content:
<p>Last month Yours Truly got snookered by a too-good-to-be-true online scam in which some dirtball hijacked an Amazon merchant&#8217;s account and used it to pimp steeply discounted electronics that he never intended to sell. Amazon refunded my money, and the legitimate seller never did figure out how his account was hacked. But such attacks are becoming more prevalent of late as crooks increasingly turn to online crimeware services that make it a cakewalk to cash out stolen passwords.</p>
<div id="attachment_39097" style="width: 209px" class="wp-caption alignright"><img class=" wp-image-39097" src="media/a7e7d00c.sonononos.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/sonononos.png" alt="The elusive Sonos Play:5" width="199" height="194" /><p class="wp-caption-text">The elusive Sonos Play:5</p></div>
<p>The item at Amazon that drew me to this should-have-known-better bargain was a <strong>Sonos</strong> <a href="http://www.sonos.com/en-us/shop/play5.html" target="_blank">wireless speaker</a> that is very pricey and as a consequence has hung on my wish list for quite some time. Then I noticed an established seller with great feedback on Amazon was advertising a &#8220;new&#8221; model of the same speaker for 32 percent off. So on March 4, I purchased it straight away &#8212; paying for it with my credit card via Amazon&#8217;s one-click checkout.</p>
<p>A day later I received a nice notice from the seller stating that the item had shipped. Even Amazon&#8217;s site seemed to be fooled because for several days Amazon&#8217;s package tracking system updated its progress slider bar steadily from left to right.</p>
<p>Suddenly the package seemed to stall, as did any updates about where it was or when it might arrive. This went on for almost a week. On March 10, I received an email from the legitimate owner of the seller&#8217;s account stating that his account had been hacked.</p>
<p>Identifying myself as a reporter, I asked the seller to tell me what he knew about how it all went down. He agreed to talk if I left his name out of it.</p>
<p>&#8220;Our seller&#8217;s account email address was changed,&#8221; he wrote. &#8220;One night everything was fine and the next morning our seller account had a email address not associated with us. We could not access our account for a week. Fake electronic products were added to our storefront.&#8221;</p>
<p>He couldn&#8217;t quite explain the fake tracking number claim, but nevertheless the tactic does seem to be part of an overall effort to delay suspicion on the part of the buyer while the crook seeks to maximize the number of scam sales in a short period of time.</p>
<p>&#8220;The hacker then indicated they were shipped with fake tracking numbers on both the fake products they added and the products we actually sell,&#8221; the seller wrote. &#8220;They were only looking to get funds through <span class="il">Amazon</span>. We are working with <span class="il">Amazon</span> to refund all money that were spent buying these false products.&#8221;</p>
<p>As these things go, the entire ordeal wasn&#8217;t awful &#8212; aside maybe from the six days spent in great anticipation of audiophilic nirvana (alas, after my refund I thought better of the purchase and put the item back on my wish list.) But apparently I was in plenty of good (or bad?) company.</p>
<p><em>The Wall Street Journal</em> <a href="https://www.wsj.com/articles/amazon-coms-third-party-sellers-hit-by-hackers-1491816600" target="_blank">notes</a> that in recent weeks &#8220;attackers have changed the bank-deposit information on Amazon accounts of active sellers to steal tens of thousands of dollars from each, according to several sellers and advisers. Attackers also have hacked into the Amazon accounts of sellers who haven’t used them recently to post nonexistent merchandise for sale at steep discounts in an attempt to pocket the cash.&#8221;</p>
<p>Perhaps fraudsters are becoming more brazen of late with hacked Amazon accounts, but the same scams mentioned above <a href="https://krebsonsecurity.com/2015/11/how-carders-can-use-ebay-as-a-virtual-atm/" target="_blank">happen every day on plenty of other large merchandising sites</a>. <span class="pullquote pqright">The sad reality is that hacked Amazon seller accounts have been available for years at underground shops for about half the price of a coffee at Starbucks.</span></p>
<p>The majority of this commerce is made possible by one or two large account credential vendors in the cybercrime underground, and these vendors have been collecting, vetting and reselling hacked account credentials at major e-commerce sites for years.</p>
<p>I have no idea where the thieves got the credentials for the guy whose account was used to fake sell the Sonos speaker. But it&#8217;s likely to have been from a site like SLILPP, a crime shop which specializes in selling hacked Amazon accounts. Currently, the site advertises more than 340,000 Amazon account usernames and passwords for sale.</p>
<p>The price is about USD $2.50 per credential pair. Buyer scan select accounts by balance, country, associated credit/debit card type, card expiration date and last order date. Account credentials that also include the password to the victim&#8217;s associated email inbox can double the price.</p>
<div id="attachment_39093" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/cd12b53f.amazon-slilpp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/amazon-slilpp.png"><img class="wp-image-39093 size-medium" src="media/543be13e.amazon-slilpp-580x289.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/amazon-slilpp-580x289.png" alt="The Amazon portion of SLILPP, a long-running fraud shop that at any given time has hundreds of thousands of Amazon account credentials for sale. " width="580" height="289" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/amazon-slilpp-580x289.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/amazon-slilpp-768x382.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/04/amazon-slilpp-940x468.png 940w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">The Amazon portion of SLILPP, a long-running fraud shop that at any given time has hundreds of thousands of Amazon account credentials for sale.</p></div>
<p><span id="more-39030"></span></p>
<p>If memory serves correctly, SLILPP started off years ago mainly as a <strong>PayPal</strong> and <strong>eBay</strong> accounts seller (hence the &#8220;PP&#8221;). &#8220;Slil&#8221; is transliterated Russian for &#8220;слил,&#8221; which in this context may mean &#8220;leaked,&#8221; &#8220;download&#8221; or &#8220;to steal,&#8221; as in password data that has leaked or been stolen in other breaches. SLILPP has vastly expanded his store in the years since: It currently advertises more than 7.1 million credentials for sale from hundreds of popular bank and e-commerce sites.</p>
<p>The site&#8217;s proprietor has been at this game so long he probably deserves a story of his own soon, but for now I&#8217;ll say only that he seems to do a brisk business buying up credentials being gathered by credential-testing crime crews &#8212; cyber thieves who spend a great deal of time harvesting and enriching credentials stolen and/or leaked from major data breaches at social networking and e-commerce providers in recent years.</p>
<div id="attachment_39102" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/7ff3bcc3.aacountinstock-slilpp.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/aacountinstock-slilpp.png"><img class="wp-image-39102 size-medium" src="media/241579e2.aacountinstock-slilpp-580x413.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/aacountinstock-slilpp-580x413.png" alt="SLILPP's main inventory page." width="580" height="413" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/aacountinstock-slilpp-580x413.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/aacountinstock-slilpp-768x547.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/04/aacountinstock-slilpp-940x669.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/04/aacountinstock-slilpp.png 1512w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">SLILPP&#8217;s main inventory page.</p></div>
<p>Fraudsters can take a list of credentials stolen from, say, the Myspace.com breach (in which some <a href="https://motherboard.vice.com/en_us/article/myspace-data-breach-427-million-passwords-available-online" target="_blank">427 million credentials were posted online</a>) and see how many of those email address and password pairs from the MySpace accounts also work at hundreds of other bank and e-commerce sites.</p>
<p>Password thieves often then turn to crimeware-as-a-service tools like <a href="http://engineering.shapesecurity.com/2016/03/a-look-at-sentry-mba.html" target="_blank">Sentry MBA</a>, which can vastly simplify the process of checking a list of account credentials at multiple sites. To make blocking their password-checking activities more challenging for retailers and banks to identify and block, these thieves often try to route the Internet traffic from their password-guessing tools through legions of open Web proxies, hacked PCs or even stolen/carded cloud computing instances.</p>
<p>PASSWORD RE-USE: THE ENGINE OF ALL ONLINE FRAUD</p>
<p>In response, many major retailers are being forced to alert customers when they see known account credential testing activity that results in a successful login (thus suggesting the user&#8217;s account credentials were replicated and compromised elsewhere). However, from the customer&#8217;s perspective, this is tantamount to the e-commerce provider experiencing a breach even though the user&#8217;s penchant for recycling their password across multiple sites is invariably the culprit.</p>
<p>There are a multitude of useful security lessons here, some of which bear repeating because their lack of general observance is the cause of most password woes today (aside from the fact that so many places <em>still rely on passwords and stupid things like &#8220;<a href="https://krebsonsecurity.com/2016/08/united-airlines-sets-minimum-bar-on-security/" target="_blank">secret questions</a>&#8221; in the first place</em>). First and foremost: Do not re-use the same password across multiple sites. Secondly, but equally important: Never re-use your email password anywhere else.</p>
<p>Also, with a few exceptions, password length is generally more important than password complexity, and complex passwords are difficult to remember anyway. I prefer to think in terms of &#8220;pass phrases,&#8221; which are more like sentences or verses that are easy to remember.</p>
<p>If you have difficult recalling even unique passphrases, a <a href="https://www.howtogeek.com/141500/why-you-should-use-a-password-manager-and-how-to-get-started/" target="_blank">password manager</a> can help you pick and remember strong, unique passwords for each site you interact with, requiring only one strong master password to unlock any of them. Oh, and if the online account in question allows <a href="https://twofactorauth.org/" target="_blank">2-factor authentication</a>, be sure to take advantage of that.</p>
<p>I hope it&#8217;s clear that Amazon is just one of the many platforms where fraudsters lurk. SLILPP currently is selling stolen credentials for nearly 500 other banks and e-commerce sites. The full list of merchants targeted by this particularly bustling fraud shop is <a href="https://krebsonsecurity.com/wp-content/uploads/2017/04/slilpp-domainchecklist.txt" target="_blank">here</a> (.txt file).</p>
<p>As for the &#8220;buyer beware&#8221; aspect of this tale, in retrospect there were several warning signs that I either ignored or neglected to assign much weight. For starters, the deal that snookered me was for a luxury product on sale for 32 percent off without much explanation as to why the apparently otherwise pristine item was so steeply discounted.</p>
<p>Also, while the seller had a stellar history of selling products on Amazon for many years (with overwhelmingly positive feedback on virtually all of his transactions) he did not have a history of selling the type of product that thieves tried to sell through his account. The old adage &#8220;If something seems too good to be true, it probably is,&#8221; ages really well in cyberspace.</p>


feed_id: https://krebsonsecurity.com/?p=39163
title: The Backstory Behind Carder Kingpin Roman Seleznev’s Record 27 Year Prison Sentence
uri: The-Backstory-Behind-Carder-Kingpin-Roman-Seleznev-s-Record-27-Year
url:
https://krebsonsecurity.com/2017/04/the-backstory-behind-carder-kingpin-roman-seleznevs-record-27-year-prison-sentence/

content:
<p><strong>Roman Seleznev</strong>, a 32-year-old Russian cybercriminal and prolific credit card thief, was sentenced Friday to 27 years in federal prison. That is a record punishment for hacking violations in the United States and by all accounts one designed to send a message to criminal hackers everywhere. But a close review of the case suggests that Seleznev&#8217;s record sentence was severe in large part because the evidence against him was substantial and yet he declined to cooperate with prosecutors prior to his trial.</p>
<div id="attachment_39175" style="width: 250px" class="wp-caption alignright"><img class="wp-image-39175" title="Wikipedia" src="media/4e81a8fe.Maldives_orthographic_projection.svg_.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/Maldives_orthographic_projection.svg_.png" alt="Maldives_(orthographic_projection).svg" width="240" height="240" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/Maldives_orthographic_projection.svg_-150x150.png 150w, http://krebsonsecurity.com/wp-content/uploads/2017/04/Maldives_orthographic_projection.svg_.png 553w" sizes="(max-width: 240px) 100vw, 240px" /><p class="wp-caption-text">The Maldives is a South Asian island country, located in the Indian Ocean, situated in the Arabian Sea. Source: Wikipedia.</p></div>
<p>The son of an influential Russian politician, Seleznev made international headlines in 2014 after he was <a href="http://www.reuters.com/article/2014/07/08/us-usa-cybersecurity-arrest-idUSKBN0FD0Z020140708" target="_blank">captured</a> while vacationing in <a href="https://en.wikipedia.org/wiki/Maldives" target="_blank">The Maldives</a>, a popular vacation spot for Russians and one that <a href="https://krebsonsecurity.com/2011/06/chronopay-co-founder-arrested/" target="_blank">many Russian cybercriminals</a> previously <a href="media/a4458658.GusevViagra.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2011/09/GusevViagra.jpg" target="_blank">considered</a> to be out of reach for western law enforcement agencies.</p>
<p>However, U.S. authorities were able to negotiate a secret deal with the Maldivian government to apprehend Seleznev. Following his capture, Seleznev was whisked away to Guam briefly before being transported to Washington state to stand trial for computer hacking charges.</p>
<p>The U.S. Justice Department says the laptop found with him when he was arrested contained more than 1.7 million stolen credit card numbers, and that evidence presented at trial showed that Seleznev earned tens of millions of dollars defrauding more than 3,400 financial institutions.</p>
<p>Investigators also reportedly <a href="http://www.seattletimes.com/seattle-news/crime/seattle-jury-convicts-russian-man-of-massive-business-hacking-id-theft-scheme/" target="_blank">found a smoking gun: a password cheat sheet</a> that linked Seleznev to a decade&#8217;s worth of criminal hacking.</p>
<p>Seleznev was initially identified as a major cybercriminal by U.S. government investigators in 2011, when prosecutors in Nevada named him as part of a conspiracy involving more than three dozen popular merchants on <strong>carder[dot]su</strong>, a bustling fraud forum where he and other members openly marketed various cybercrime-oriented services.</p>
<p>Known by the hacker handle &#8220;nCux,&#8221; Seleznev operated multiple online shops that sold stolen credit and debit card data. According to <a href="media/9aa4fd55.Seleznev-Indictment-CR11-0070RAJ-1.pdf" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/Seleznev-Indictment-CR11-0070RAJ-1.pdf" target="_blank">Seleznev’s indictment in the Nevada case</a>, he was part of a group that hacked into restaurants between 2009 and 2011 and planted malicious software to steal card data from store point-of-sale devices.</p>
<p><a href="http://www.seattletimes.com/seattle-news/crime/seattle-jury-convicts-russian-man-of-massive-business-hacking-id-theft-scheme/" target="_blank">In Seattle on Aug. 25, 2016</a>, Seleznev was convicted of 10 counts of wire fraud, eight counts of intentional damage to a protected computer, nine counts of obtaining information from a protected computer, nine counts of possession of 15 or more unauthorized access devices and two counts of aggravated identity theft.</p>
<p><span class="pullquote pqleft">“Simply put, Roman Seleznev has harmed more victims and caused more financial loss than perhaps any other defendant that has appeared before the court,” federal prosecutors charged in their sentencing memorandum.</span> “This prosecution is unprecedented.”</p>
<p>Seleznev&#8217;s lawyer <strong>Igor Litvak</strong> called his client&#8217;s sentence &#8220;draconian,&#8221; saying that Seleznev was gravely injured in a 2011 terrorist attack in Morocco, has Hepatitis B and is not well physically.</p>
<p>Litvak noted that his client also faces two more prosecutions &#8212; in Georgia and Nevada, and that his client is likely to be shipped off to Nevada soon.</p>
<p>&#8220;It&#8217;s unprecedented, yes, but it&#8217;s also a draconian sentence for a person who is very gravely ill,&#8221; Litvak said in an interview with KrebsOnSecurity. &#8220;He&#8217;s not going to live that long. He&#8217;s going to die in jail. I&#8217;m certain of that.&#8221;<br />
<span id="more-39163"></span></p>
<h4>ANALYSIS</h4>
<p>As for the severity of his sentence, Seleznev did himself no favors by rededicating himself to his carding empire after having been clearly marked by U.S. investigators in the 2011 indictment as a key figure in an online organized crime ring.</p>
<p>Many of the documents related to Seleznev&#8217;s prosecution and conviction in Washington state last week remain sealed, as he still faces federal criminal hacking charges in Nevada and Georgia. But former <a href="https://books.google.com/books?id=njLIn0uv5KgC&amp;pg=PA178&amp;lpg=PA178&amp;dq=sporaw+exploit+s600&amp;source=bl&amp;ots=0zY3GWbOOw&amp;sig=r77oJFz9EYCqEG8wYfVSJFLSOi8&amp;hl=en&amp;sa=X&amp;ved=0ahUKEwij-JnLo73TAhWHL48KHccGBxgQ6AEIKTAB#v=onepage&amp;q=sporaw%20exploit%20s600&amp;f=false" target="_blank">black hat Russian hacker</a> turned political and cybersecurity blogger <strong>Andrey &#8220;Sporaw&#8221; Sporov</strong> <a href="http://sporaw.livejournal.com/466632.html" target="_blank">published snippets</a> from documents apparently related to Seleznev&#8217;s prosecution indicating that investigators with the <strong>U.S. Secret Service and FBI</strong> met with the <strong>Russian Federal Security Service</strong> (FSB) in 2009 to discuss Seleznev&#8217;s activities, presenting &#8220;substantial&#8221; evidence that Seleznev was a bigtime cybercrook.</p>
<p><div id="attachment_28295" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/a87d7d80.2packcc.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/2packcc.png"><img class="wp-image-28295 size-large" src="media/c5452f55.2packcc-600x365.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/10/2packcc-600x365.png" alt="The 2pac[dot]cc credit card shop that Seleznov operated." width="600" height="365" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/10/2packcc-285x173.png 285w, http://krebsonsecurity.com/wp-content/uploads/2014/10/2packcc-600x365.png 600w, http://krebsonsecurity.com/wp-content/uploads/2014/10/2packcc.png 1246w" sizes="(max-width: 600px) 100vw, 600px" /></a><p class="wp-caption-text">2pac[dot]cc credit card shop that Seleznov operated, among others.</p></div>Seleznev&#8217;s online alter ego nCux reportedly got word of the meeting, and was soon after seen deleting his identities on hacker forums and saying he was closing up shop:</p>
<blockquote><p>&#8220;As U.S. Probation noted, the information that U.S. law enforcement was investigating Seleznev &#8216;clearly got back to Mr. Seleznev,'&#8221; reads the document. &#8220;Indeed, Seleznev had his own contacts inside the FSB. In chat messages between Seleznev and an associate from 2008, Seleznev stated that he had obtained protection through the law enforcement contacts in the computer crime squad of the FSB. Later, in 2010, Seleznev told another associate that the FSB knew his identity and was working with the FBI.&#8221;.</p></blockquote>
<p>But nCux didn&#8217;t go away, he merely <a href="https://krebsonsecurity.com/2014/10/seleznev-arrest-explains-2pac-downtime/" target="_blank">reinvented himself as &#8220;Bulba,&#8221;</a> operating a number of carding sites including track2[dot]name, bulba[dot]cc, and 2Pac[dot]cc. These sites sold tens of thousands of &#8220;dumps,&#8221; data that thieves encode onto new plastic cards and use to buy high-priced electronics and gift cards from big box retailers. Seleznev&#8217;s sites specialized in selling tens of thousands of dumps at a time to criminal groups and street gangs operating throughout the United States</p>
<p><div id="attachment_26786" style="width: 610px" class="wp-caption aligncenter"><a class="lightbox" href="media/83853cca.bulbaoncarder.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/bulbaoncarder.png"><img class="wp-image-26786 size-large" src="media/3d17db45.bulbaoncarder-600x401.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/bulbaoncarder-600x401.png" alt="A private mesasge between card merchant &quot;Bulba&quot; and an interested buyer on the fraud bazaar carder[dot]pro." width="600" height="401" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/07/bulbaoncarder-285x190.png 285w, http://krebsonsecurity.com/wp-content/uploads/2014/07/bulbaoncarder-600x401.png 600w, http://krebsonsecurity.com/wp-content/uploads/2014/07/bulbaoncarder.png 1016w" sizes="(max-width: 600px) 100vw, 600px" /></a><p class="wp-caption-text">A private mesasge between card merchant &#8220;Bulba&#8221; and an interested buyer on the fraud bazaar carder[dot]pro.</p></div>Seleznev reportedly used this money to live an extravagant lifestyle, buying up properties in Bali, Indonesia. Photographs seized from Seleznev show his associates with large bundles of cash, at luxurious resorts, and posing for photographs next to flashy sports cars. Just before his capture, Seleznev reportedly spent over $20,000 to stay in a resort in the Maldives and boasting of having rented the most expensive accommodations there.</p>
<p>Sporov&#8217;s documents describe Seleznev&#8217;s years to evade law enforcement officials following his then-sealed indictment in Nevada:</p>
<blockquote><p>&#8220;Seleznev remained at large for over three years. During this period, Seleznev carefully evaded apprehension, employing practices like buying last-minute plane tickets to avoid giving authorities advance notice of his travel plans. Seleznev obtained an account with the U.S. Court’s PACER system, which he monitored for criminal indictments naming him or his nicknames. He avoided travel to countries that had entered into extradition treaties with the United States. Indeed, when Seleznev was finally confronted by U.S. agents in the Maldives, his first words were to question whether the United States had an extradition treaty with the Maldives.&#8221;</p></blockquote>
<p>The defendant also apparently burned through multiple lawyers, almost all of whom appear to have advised him to seek a plea deal with the U.S. government:</p>
<blockquote><p>&#8220;Seleznev repeatedly attempted to manipulate and protract these proceedings, resulting in a cumulative delay of 26 months, and six sets of counsel, between his capture and trial&#8230;.Transcripts of jail calls previously submitted to the Court reveal that, in the days leading up to the hearing, Seleznev and his father resolved to delay the hearing so that they could work on a secret strategy they elliptically referred to as &#8216;Uncle Andrey’s option.&#8217; To manufacture the delay, Seleznev’s father suggested that Seleznev either &#8216;get sick&#8217; or &#8216;completely stop the communication with the lawyers.'&#8221;</p></blockquote>
<p>Seleznev is the son of <strong>Valery Seleznev</strong>, a prominent member of the Russian Duma (Russia&#8217;s parliament) and is considered an ally of <strong>President Vladimir Putin</strong>. As the Seattle Times <a href="http://www.seattletimes.com/seattle-news/crime/seattle-jury-convicts-russian-man-of-massive-business-hacking-id-theft-scheme/" target="_blank">wrote</a> at Seleznev&#8217;s conviction in 2016, &#8220;federal prosecutors accused Seleznev and his father of plotting to tamper with witnesses and <a class="content-link" href="http://www.seattletimes.com/seattle-news/crime/feds-say-accused-russian-hacker-at-seatac-detention-center-may-be-plotting-escape/">possibly discussing an escape</a> from the Federal Detention Center in SeaTac. The assertions were based on recorded conversations, according to the government.&#8221;</p>
<div id="attachment_39198" style="width: 337px" class="wp-caption alignright"><img class="size-full wp-image-39198" src="media/7ebe6e55.seleznevdoj.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/seleznevdoj.png" alt="Seleznev posing with a sports car in Red Square. Image: DOJ." width="327" height="448" /><p class="wp-caption-text">Seleznev posing with a sports car in Red Square. Image: DOJ.</p></div>
<p>Perhaps Mr. Seleznev thought his father&#8217;s influence and/or his own apparent connections with Russian law enforcement officials would rescue him. Maybe Seleznev believed he could prevail against the U.S. government in court.</p>
<p>But it seems clear that Seleznev&#8217;s record 27-year sentence had at least as much to do with the impact of his crimes as it did the enormity of the charges and evidence against him combined with his refusal to cooperate with investigators.</p>
<p>Seleznev&#8217;s lawyer <strong>Igor Litvak</strong> said his client declined a plea deal prior to his trial, and by the time Seleznev had changed his mind the trial was over and the government no longer needed the information he could offer. Prosecutors sought to put him away for 35 years: They got seven years shy of that request.</p>
<p>&#8220;The prosecution said if he would have cooperated this case would have turned out very differently,&#8221; Litvak said.</p>
<p>The docket for Seleznev&#8217;s case is <a href="http://ia902504.us.archive.org/22/items/gov.uscourts.wawd.174096/gov.uscourts.wawd.174096.docket.html" target="_blank">available here</a> and includes a number of unsealed documents related to this case.</p>


feed_id: https://krebsonsecurity.com/?p=38273
title: UK Man Gets Two Years in Jail for Running ‘Titanium Stresser’ Attack-for-Hire Service
uri: UK-Man-Gets-Two-Years-in-Jail-for-Running-Titanium-Stresser-Atta
url:
https://krebsonsecurity.com/2017/04/uk-man-gets-two-years-in-jail-for-running-titanium-stresser-attack-for-hire-service/

content:
<p>A 20-year-old man from the United Kingdom was sentenced to two years in prison today after admitting to operating and selling access to &#8220;<strong>Titanium Stresser</strong>,&#8221; a simple-to-use service that let paying customers launch crippling online attacks against Web sites and individual Internet users.</p>
<p><strong>Adam Mudd</strong> of Herfordshire, U.K. admitted to three counts of computer misuse connected with his creating and operating the attack service, also known as a <a href="https://krebsonsecurity.com/?s=booter&amp;x=0&amp;y=0" target="_blank">&#8220;stresser&#8221; or &#8220;booter&#8221;</a> tool. Services like Titanium Stresser coordinate so-called &#8220;distributed denial-of-service&#8221; or <strong>DDoS</strong> attacks that hurl huge barrages of junk data at a site in a bid to make it crash or become otherwise unreachable to legitimate visitors.</p>
<div id="attachment_39205" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/df804783.titaniumstressor.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/titaniumstressor.png"><img class="wp-image-39205 size-medium" src="media/fa631101.titaniumstressor-580x447.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/titaniumstressor-580x447.png" alt="Mudd's TitaniumStresser service." width="580" height="447" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/04/titaniumstressor-580x447.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/04/titaniumstressor-768x591.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/04/titaniumstressor.png 800w" sizes="(max-width: 580px) 100vw, 580px" /></a><p class="wp-caption-text">Mudd&#8217;s TitaniumStresser service.</p></div>
<p>According to U.K. prosecutors, Mudd&#8217;s Titanium Stresser service was used by others in more than 1.7 million denial-of-service attacks against victims worldwide, with most countries in the world affected at some point. He originally built the booter service at the age of 15, earning more than $300,000 in ill-gotten gains from it. Also during his interviews, he admitted security breaches against his own college while he was there studying computer science.</p>
<p>Mudd pleaded guilty to three offences under the <strong>U.K. Computer Misuse Act</strong> and a further offense of money laundering under the <strong>Proceeds of Crime Act</strong> in October 2016.</p>
<p>&#8220;Today, he was sentenced to 24 months imprisonment for his own DDoS attacks, nine months for running a titanium stressor service and 24 months for money laundering the proceeds made from the stressor service, all to run concurrently,&#8221; reads a press release issued by the <strong>Eastern Region Special Operations Unit</strong> (ERSOU), an anti-cybercrime unit that worked with the U.K.&#8217;s National Crime Agency to investigate Mudd.</p>
<p>Detective Chief Inspector <strong>Martin Peters</strong> of the ERSOU&#8217;s Regional Crime Unit recalled that at sentencing the judge said the defendant likely would have received six years if he&#8217;d been tried as an adult and if he had no medical issues. Mudd had been slated to be sentenced last week, but that hearing was delayed until today after the court heard medical testimony on Mudd&#8217;s apparent struggles with autism.</p>
<p>The Mudd case is the latest in a string of law enforcement actions in the U.K., U.S. and elsewhere targeting booter service operators and their customers. In December 2016, federal investigators in the United States and Europe <a href="https://krebsonsecurity.com/2016/12/operation-tarpit-targets-customers-of-online-attack-for-hire-services/" target="_blank">arrested nearly three-dozen people</a> suspected of patronizing booter services. That crackdown was part of an effort by authorities to weaken demand for booter and stresser services and to impress upon customers that hiring someone to launch cyberattacks on your behalf can land you in jail.</p>
<p>In October 2016, the <strong>U.S. Justice Department</strong> <a href="https://krebsonsecurity.com/2016/10/feds-charge-two-in-lizard-squad-investigation/" target="_blank">charged</a> two 19-year-old men alleged to have run booter services tied to the <strong>&#8220;Lizard Squad&#8221; </strong>hacking group. That same month the sprawling discussion forum <a href="https://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank">Hackforums</a> &#8212; once the most bustling marketplace on the Internet where people could compare and purchase booter and stresser service subscriptions &#8212; announced that it was <a href="https://krebsonsecurity.com/2016/10/hackforums-shutters-booter-service-bazaar/" target="_blank">permanently banning the sale and advertising of booters</a>. <span id="more-38273"></span></p>
<p>Last month, authorities in Israel said they were <a href="https://krebsonsecurity.com/2017/03/alleged-vdos-owners-poised-to-stand-trial/" target="_blank">preparing a case </a>against two 18-year-old Israeli men who investigators there say operated the wildly popular &#8220;vDOS&#8221; booter service. The proprietors of vDOS were in business for four years prior to being exposed by KrebsOnSecurity. During just two of those four years in operation vDOS made more than $600,000 helping paying customer coordinate hundreds of thousands (if not millions) of DDoS attacks.</p>
<p>The detail about Mudd having attacked the very same school he was attending as a computer science student seemed both interesting and familiar. Then I remembered: This same dynamic was at work with a young man approximately Mudd&#8217;s age who lives in New Jersey and recently was implicated by many of his close associates and a great deal of circumstantial evidence as a co-author of the <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank">Mirai botnet</a> computer code.</p>
<p>Mirai is a network worm that enslaves poorly secured &#8220;Internet of Things&#8221; devices like security cameras and digital video recorders for use in extremely powerful DDoS attacks capable of knocking almost any target offline.</p>
<p>After Mirai <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">took my site offline</a> for several days last year, I spent many hours trying to figure out who was responsible for writing and unleashing the malware. All signs pointed to a <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank">computer science student at Rutgers University</a> who used a large Mirai botnet to attack the university repeatedly &#8212; all the while using his hacker alter ego to taunt the university in online interviews.</p>
<p>The authorities in the U.K. say they are hoping to make an example of Mudd as part of a broader education effort to divert talented, smart kids away from malicious hacking and toward more productive endeavors.</p>
<p>“Adam Mudd’s case is a regrettable one, because this young man clearly has a lot of skill, but he has been utilising that talent for personal gain at the expense of others,&#8221; the ERSOU press release observes. &#8220;We want to make clear it is not our wish to unnecessarily criminalise young people, but want to harness those skills before they accelerate into crime. It is important that this case sends out a clear message to others who may be tempted by committing cybercrime or who are already engaging in cyber scams from the comfort of their own bedrooms, to consider what they are doing and it is for parents to know and understand what your children are doing online.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=38412
title: Blind Trust in Email Could Cost You Your Home
uri: Blind-Trust-in-Email-Could-Cost-You-Your-Home
url: https://krebsonsecurity.com/2017/04/blind-trust-in-email-could-cost-you-your-home/
content:
<p>The process of buying or selling a home can be extremely stressful and complex, but imagine the stress that would boil up if &#8212; at settlement &#8212; your money was wired to scammers in another country instead of to the settlement firm or escrow company. Here&#8217;s the story about a phishing email that cost a couple their home and left them scrambling for months to recover hundreds of thousands in cash that went missing.</p>
<p>It was late November 2016, and <strong>Jon and Dorothy Little</strong> were all set to close on a $200,000 home in Hendersonville, North Carolina. Just prior to the closing date on Dec. 2 their realtor sent an email to the Little&#8217;s and to the law firm handling the closing, asking the settlement firm for instructions on wiring the money to an escrow account.</p>
<div id="attachment_39229" style="width: 430px" class="wp-caption aligncenter"><img class="size-full wp-image-39229" src="media/bd0c68b7.littlebnak.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/04/littlebnak.png" alt="The fraudulent wire instructions apparently sent by the hackers via the settlement law firm." width="420" height="424" /><p class="wp-caption-text">The fraudulent wire instructions apparently sent by the hackers via the settlement law firm.</p></div>
<p>An attorney with the closing firm responded with wiring instructions as requested, attaching a document that had the law firm&#8217;s logo and some bank account information that was represented as the seller&#8217;s account number. The Little&#8217;s realtor sent the wire on Thursday morning, the day before settlement.</p>
<p>&#8220;We went to closing at 1 p.m. on Friday, and after we signed all the papers, we asked the lawyers if we were going to get back the extra money we had sent them, because they hadn&#8217;t be able to give us an exact amount in the wiring instructions. At that point they told us they had never gotten the money.&#8221;</p>
<p>After some disagreement, both legitimate parties to the transaction agreed that someone&#8217;s email had been hacked by the fraudsters, and was used to divert the wired funds to an account the criminals controlled. The hackers had forged a copy of the law firm&#8217;s letterhead, and beneath it placed their own Bank of America account information (see screen shot above).</p>
<p>The owner of the Bank of America account appears to have been a willing or unwitting accomplice &#8212; also know as a &#8220;<a href="https://krebsonsecurity.com/?s=money+mule&amp;x=0&amp;y=0" target="_blank">money mule</a>&#8221; &#8212; recruited through work-at-home job schemes to receive and forward funds stolen from hacked business accounts. In this case, the money mule wired all but 10 percent of the money (a typical money mule commission) to an account at TD Bank.</p>
<p>Fortunately for the Littles, the FBI succeeded in having the resulting $180,000 wire transfer frozen once it hit the TD Bank account. However, efforts to recover the stolen funds were stymied immediately when the Littles&#8217; credit union refused to give Bank of America a so-called &#8220;hold harmless&#8221; agreement that the bigger bank wanted as a legal guarantee before agreeing to help.</p>
<p><strong>Charisse Castagnoli</strong>, an adjunct professor of law at the <strong>John Marshall Law School</strong>, said banks have a fiduciary duty to their customers to honor their requests in good faith, and as such they tend to be very nervous legally about colluding with another bank to reverse payment instructions by one of their own customers. The &#8220;hold harmless&#8221; agreement is usually sought by the bank which received a fraudulent wire transfer, Castagnoli said, and it requires the responding bank to assume any and all liability for costs that the requesting bank may later incur should the owner of account which received the fraudulent wire decide to dispute the payment reversal.</p>
<p>&#8220;When it comes to wire fraud cases the banks have to move very quickly because once the wires make it outside the U.S. to foreign banks, the money is usually as good as gone,&#8221; Castagnoli said. &#8220;The receiver or transferee usually insists on a hold harmless agreement because they’re moving the money on behalf of their own account holder, kind of going against their own client which is a big &#8216;no-no&#8217; when you’re a fiduciary.&#8221;</p>
<p>But in this case, the credit union in which the Littles had invested virtually all of their money for more than 40 years decided it could not in good faith provide that hold harmless agreement, because doing so would stipulate that the credit union affirms the victim (the Littles) hadn&#8217;t willingly and knowing initiated the wire, when in fact they had.</p>
<p>&#8220;I talked to the wire dept multiple times,&#8221; Mr. Little said of the folks at his financial institution, Atlanta, Ga.-based <strong>Delta Community Credit Union</strong> (DCCU). &#8220;They finally put me through to the vice president of loss prevention at the credit union. I’m not sure they even believed all that was going on. They finally came back and told me they couldn’t do it. Their rules would not allow them to send a hold harmless letter because I had asked them to do something and they had done it. They had a big meeting last week with apparently the CEO of the credit union and several other people. Then they called me on Monday again and told me they would not could not do it.&#8221;<span id="more-38412"></span></p>
<p>The Littles had to cancel the contract on the house they were prepared to occupy in December. Most of their cash was tied up in this account that the banks were haggling over, and so they opted to get a heavily mortgaged small townhome instead, with the intention of paying off the mortgage when their stolen funds are returned.</p>
<p>&#8220;We canceled the contract on the house because the sellers really needed to sell it,&#8221; Jon Little said.</p>
<p>The DCCU has yet to respond to my requests for comment. But less than a day after KrebsOnSecurity reached out to the credit union for comment about the Littles&#8217; story, the bank informed the Littles that the other bank would soon have its hold harmless letter &#8212; freeing up their $180,000 after more than four months in legal limbo.</p>
<p>The Littles&#8217; story has a fairly happy ending, however most of the other few dozens stories previously featured on this blog about wayward mortgage, escrow and payroll payments wound up with the victim losing six figures at least.</p>
<p>One of the more recent advertisers on this blog &#8212; <a href="https://www.ninjio.com" target="_blank">Ninjio</a> &#8212; specializes in developing custom, &#8220;gamified&#8221; security awareness training videos for clients. &#8220;The Homeless Homebuyer,&#8221; one of the videos Ninjio produced for a government client seems appropriate here: It features an animated FBI agent breaking the bad news to some would-be homeowners that their money is gone and so are their dreams of a new home &#8212; all because everyone blindly trusted unsecured email for what is essentially a high-risk cash transaction.</p>
<p>I like the video because its message is fairly stark and real: You could get screwed if you don&#8217;t take this seriously and proceed carefully, because once the money&#8217;s gone it <a href="https://krebsonsecurity.com/category/smallbizvictims/" target="_blank">usually stays gone</a>. Check it out here:</p>
<div align="center"><iframe src="http://www.youtube.com/embed/ToUEr4X1WgU" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>So here&#8217;s what you need to know if you or anyone you know, love or even like are about to buy or sell a home: Never wire money based on the say-so of one party to the transaction made via email. You simply don&#8217;t know if their account is hacked, so from a self-preservation standpoint it&#8217;s best to assume it is.</p>
<p>Agree in advance who will contact whom &#8212; preferably by phone &#8212; on settlement day to receive the wiring details, and who will manage the wiring process. Never trust bank account details and payment instructions sent via email. Always double or even triple check any instructions for wiring money at settlement. <em>Confirm all wiring instructions in person if possible, or else over the phone.</em></p>
<p>By the way, these same precautions can help make organizations less susceptible to <a href="https://krebsonsecurity.com/?s=ceo+fraud&amp;x=0&amp;y=0" target="_blank">CEO fraud schemes</a>, email scams in which the attacker spoofs the boss and tricks an employee at the organization into wiring funds to the fraudster.</p>
<p>The <strong>Federal Bureau of Investigation</strong> (FBI) has been keeping a running tally of the financial devastation visited on companies via CEO fraud scams. In June 2016, the FBI <a href="https://www.ic3.gov/media/2016/160614.aspx" target="_blank">estimated</a> that crooks had stolen nearly $3.1 billion from more than 22,000 victims of these wire fraud schemes.</p>
<p>Castagnoli said many credit unions and small banks don&#8217;t have the legal staff with the clearance to make calls on whether to issue a hold harmless agreement, and so they usually try to punt on that when requested. Were she in The Littles&#8217; position, Castagnoli said she would have called the head of the credit union and demanded assistance.</p>
<p>&#8220;If the head of the bank wouldn&#8217;t do it, I&#8217;d call my congressperson or a state banking regulator,&#8221; she said.</p>
<p>If you&#8217;re selling or buying the home yourself and somehow also in charge of wiring money, consider using a <a href="https://krebsonsecurity.com/2012/07/banking-on-a-live-cd/" target="_blank">Live CD approach</a> (all of these &#8220;live&#8221; Linux distributions will just as happily run on USB-based flash drives). I have long recommend Live Linux usage as a smart option for small businesses to <a href="http://Charisse Castagnoli, an adjunct professor of law at the John Marshall Law School, said banks have a fiduciary duty to their customers to honor their requests in good faith, and as such they tend to be very nervous legally about colluding with another bank to reverse payment instructions by one of their own customers. The &quot;hold harmless&quot; agreement is usually sought by the bank which received a fraudulent wire transfer, Castagnoli said, and it requires the responding bank to assume any and all liability for costs that the requesting bank may later incur should the owner of account which received the fraudulent wire decide to dispute the payment reversal. &quot;When it comes to wire fraud cases the banks have to move very quickly because once the wires make outside the U.S. to foreign banks, the money is usually as good as gone,&quot; said Castagnoli, who said she's currently representing three clients who are similarly disputing fraudulent wires. &quot;The receiver or transferee usually insists on a hold harmless agreement because they’re moving the money on behalf of their own account holder, kind of going against their own client which is a big 'no-no' when you’re a fiduciary.&quot;" target="_blank">avoid paying dearly when a Windows banking trojan snarfs their business banking credentials</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39249
title: Breach at Sabre Corp.’s Hospitality Unit
uri: Breach-at-Sabre-Corp-s-Hospitality-Unit
url: https://krebsonsecurity.com/2017/05/breach-at-sabre-corp-s-hospitality-unit/
content:
<p>Breaches involving major players in the hospitality industry continue to pile up. Today, travel industry giant <strong>Sabre Corp.</strong> disclosed what could be a significant breach of payment and customer data tied to bookings processed through a reservations system that serves more than 32,000 hotels and other lodging establishments.</p>
<p><img class="alignright size-full wp-image-39253" src="media/70ac3c5c.sabre.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/sabre.png" alt="sabre" width="312" height="95" />In <a href="http://investors.sabre.com/secfiling.cfm?filingID=1597033-17-104&amp;CIK=1597033" target="_blank">a quarterly filing</a> with the <strong>U.S. Securities and Exchange Commission</strong> (SEC) today, Southlake, Texas-based Sabre said it was &#8220;investigating an incident of unauthorized access to payment information contained in a subset of hotel reservations processed through our Hospitality Solutions <strong>SynXis Central Reservations system</strong>.&#8221;</p>
<p>According to Sabre&#8217;s <a href="http://www.sabrehospitality.com/services" target="_blank">marketing literature</a>, more than 32,000 properties use Sabre&#8217;s SynXis reservations system, described as an inventory management Software-as-a-Service (SaaS) application that &#8220;enables hoteliers to support a multitude of rate, inventory and distribution strategies to achieve their business goals.&#8221;</p>
<p>Sabre said it has engaged security forensics firm <strong>Mandiant</strong> to support its investigation, and that it has notified law enforcement.</p>
<p>&#8220;The unauthorized access has been shut off and there is no evidence of continued unauthorized activity,&#8221; reads a brief statement that Sabre sent to affected properties today. &#8220;There is no reason to believe that any other Sabre systems beyond SynXis Central Reservations have been affected.&#8221;</p>
<p>Sabre&#8217;s software, data, mobile and distribution solutions are used by hundreds of airlines and thousands of hotel properties to manage critical operations, including passenger and guest reservations, revenue management, flight, network and crew management. Sabre also operates a leading global travel marketplace, which processes more than <span class="xn-money">$110 billion</span> of estimated travel spend annually by connecting travel buyers and suppliers.</p>
<p>Sabre told customers that it didn&#8217;t have any additional details about the breach to share at this time, so it remains unclear what the exact cause of the breach may be or for how long it may have persisted.</p>
<p>A card involving traveler transactions for even a small percentage of the 32,000 properties that are using Sabre&#8217;s impacted technology could jeopardize a significant number of customer credit cards in a short amount of time.</p>
<p>The news comes amid revelations about a blossoming breach at <strong>Intercontinental Hotel Group</strong> (IHG), the parent company that manages some 5,000 hotels worldwide, including <strong>Holiday Inn</strong> and <strong>Holiday Inn Express</strong>.<span id="more-39249"></span></p>
<p>KrebsOnSecurity <a href="https://krebsonsecurity.com/2016/12/holiday-inn-parent-ihg-probes-breach-claims/" target="_blank">first reported in December 2016</a> that cards used at IHG properties were being sold to fraudsters, but it took until February 2017 for IHG <a href="https://krebsonsecurity.com/2017/02/intercontinental-confirms-breach-at-12-hotels/" target="_blank">to announce</a> it had found malicious software installed at front-desk systems at just a dozen of its properties. On April 18, IHG <a href="https://krebsonsecurity.com/2017/04/intercontinental-hotel-chain-breach-expands/" target="_blank">disclosed in an update</a> on the investigation that more than 1,200 properties were affected, and that there could well be more added in the coming days.</p>
<p>According to <strong>Verizon</strong>&#8216;s latest annual <a href="http://www.verizonenterprise.com/verizon-insights-lab/dbir/" target="_blank">Data Breach Investigations Report</a> (DBIR), malware attacks on point-of-sale systems used at front desk and hotel restaurant systems &#8220;are absolutely rampant&#8221; in the hospitality sector. Accommodation was the top industry for point-of-sale intrusions in this year’s data, with 87% of breaches within that pattern.</p>
<p>&#8220;Apparently, it is not only The Eagles that are destined for a long stay at the hotel,&#8221; Verizon mused in its report. &#8220;The hackers continue to be checked in indefinitely as well. Breach timelines continue to paint a rather dismal picture—with time-to-compromise being only seconds, time-to-exfiltration taking days, and times to discovery and containment staying firmly in the months camp.&#8221;</p>
<p>Card-stealing cyber thieves have broken into some of the largest hotel chains over the past few years. Hotel brands that have acknowledged card breaches over the last year after prompting by KrebsOnSecurity include <a href="https://krebsonsecurity.com/2016/09/kimpton-hotels-acknowledges-data-breach/" target="_blank">Kimpton Hotels</a>, <a href="http://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/" target="_blank">Trump Hotels</a> (<a href="http://krebsonsecurity.com/2016/04/sources-trump-hotels-breached-again/" target="_blank">twice</a>), <a href="http://krebsonsecurity.com/2015/09/banks-card-breach-at-hilton-hotel-properties/" target="_blank">Hilton</a>, <a href="http://krebsonsecurity.com/2015/03/credit-card-breach-at-mandarian-oriental/" target="_blank">Mandarin Oriental</a>, and <a href="http://krebsonsecurity.com/2014/01/hotel-franchise-firm-white-lodging-investigates-breach/" target="_blank">White Lodging</a> (<a href="http://krebsonsecurity.com/2015/04/white-lodging-confirms-second-breach/" target="_blank">twice</a>). Card breaches also have hit hospitality chains <a href="http://krebsonsecurity.com/2015/11/starwood-hotels-warns-of-credit-card-breach/" target="_blank">Starwood Hotels</a> and <a href="http://krebsonsecurity.com/2016/01/hyatt-card-breach-hit-250-hotels-in-50-nations/" target="_blank">Hyatt</a>. <span id="more-36174"></span></p>
<p>In many of those incidents, thieves planted malicious software on the point-of-sale devices at restaurants and bars inside of the hotel chains. Point-of-sale based malware has driven most of the credit card breaches over the past two years, including intrusions at <a href="https://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a> and <a href="https://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a>, as well as breaches at <a href="https://krebsonsecurity.com/?s=point-of-sale+vendor&amp;x=0&amp;y=0" target="_blank">a slew of point-of-sale vendors</a>. The malicious code usually is installed via hacked remote administration tools. Once the attackers have their malware loaded onto the point-of-sale devices, they can remotely capture data from each card swiped at that cash register.</p>
<p>Thieves can then <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">sell that data to crooks</a> who specialize in encoding the stolen data onto any card with a magnetic stripe, and using the cards to purchase high-priced electronics and gift cards from big-box stores like Target and Best Buy.</p>
<p>Readers should remember that they’re not liable for fraudulent charges on their credit or debit cards, but they still have to report the unauthorized transactions. There is no substitute for keeping a close eye on your card statements. Also, consider using credit cards instead of debit cards; having your checking account emptied of cash while your bank sorts out the situation can be a hassle and lead to secondary problems (bounced checks, for instance).</p>


feed_id: https://krebsonsecurity.com/?p=39266
title: Website Flaw Let True Health Diagnostics Users View All Medical Records
uri: Website-Flaw-Let-True-Health-Diagnostics-Users-View-All-Medical-Record
url:
https://krebsonsecurity.com/2017/05/website-flaw-let-true-health-diagnostics-users-view-all-medical-records/

content:
<p>Over the past two weeks readers have pointed KrebsOnSecurity to no fewer than three different healthcare providers that failed to provide the most basic care to protect their patients&#8217; records online. Only one of the three companies &#8212; the subject of today&#8217;s story &#8212; required users to be logged in order to view all patient records.</p>
<p><img class="alignright size-full wp-image-39274" src="media/26293cbf.thg.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/thg.png" alt="thg" width="300" height="87" />A week ago I heard from <strong>Troy Mursch, </strong>an IT consultant based in Las Vegas. A big fan of proactive medical testing, Mursch said he&#8217;s been getting his various lab results reviewed annually for the past two years with the help of a company based in Frisco, Texas called <strong>True Health Diagnostics</strong>.</p>
<p>True Health is a privately held health services company specializing in &#8220;comprehensive testing for early detection of chronic diseases,&#8221; according to the company&#8217;s <a href="https://truehealthdiag.com/" target="_blank">Web site</a>.</p>
<p>The medical reports that True Health produces contain vast amounts of extremely personal information on patients, including indicators of genetic abnormalities as well as markers of potentially current and future diseases.</p>
<p>To demonstrate the flaw, Mursch logged into his account at True Health and right clicked on the PDF file for his latest health report. He showed how the site would readily cough up someone else&#8217;s detailed health records and blood tests if he modified a single digit in the link attached to that PDF record and then refreshed the page.</p>
<p>I alerted True Health Diagnostics immediately after verifying the flaw, and they responded by disabling the healthcare records data portal within minutes of our call. Over the weekend, True Health said it discovered and fixed the source of the problem.</p>
<p>“Upon discovering the potential for registered users of our patient portal to access data for individuals other than themselves, we immediately shut down the system in order to resolve any vulnerabilities,&#8221; the company said in a statement emailed to this author.  &#8220;True Health has total confidence that all patient records are fully secure at this time. We regret this situation and any harm it may have caused.&#8221;</p>
<p>The statement said True Health <strong>CEO Chris Grottenthaler</strong> has ordered an immediate investigation to determine which files, if any, were improperly accessed.</p>
<p>&#8220;It will be thorough, speedy and transparent,&#8221; the statement concludes. &#8220;Nothing is more important to us than the trust that doctors and patients put in our company.”</p>
<p>The company says it is still investigating how long this vulnerability may have existed. But Mursch said it appears his healthcare record was assigned by True Health a record number that was issued as part of a numerical sequence, and that the difference between the record numbers attached to a result he received recently and another set of test results produced two years ago indicate at least two million records may have been exposed in between.</p>
<p><span class="pullquote pqleft">&#8220;I would assume all patient records were exposed,&#8221; Mursch wrote in an email.</span></p>
<p><strong>Alex Holden</strong>, founder of cybersecurity consultancy <a href="https://holdsecurity.com/" target="_blank">Hold Security</a>, said he&#8217;s responded to a number of inquiries of late regarding clients who inadvertently published patient data online with little or no authentication needed to view sensitive health records.</p>
<p>Holden said he advises clients to add security components to their links to encrypt any portion of the link that contains data so that it can&#8217;t be easily reversed or manipulated. He also tells clients not to use sequential account numbers that can be discovered by simply increasing or decreasing an existing account number by a single digit.</p>
<p>&#8220;A lot of times the medical records are stored sequentially as PDF files and they all just sit in the same folder that patients can access with a Web browser,&#8221; Holden said. &#8220;And in many cases they are not even protected by a username and password.&#8221; <span id="more-39266"></span></p>
<p>Finally, Holden said, companies should ensure their servers are always checking to see if the user is logged in before displaying records, and also checking to ensure the user has the right to view the requested record.</p>
<p>According to <strong>Verizon</strong>&#8216;s newly released <a href="http://www.verizonenterprise.com/verizon-insights-lab/dbir/2017/" target="_blank">Data Breach Investigations Report</a> (DBIR), 15 percent of healthcare breaches now involve healthcare organizations. The 2017 DBIR found that healthcare organizations were tied with the retail and accommodations sector as the second-largest source of data breach victims last year.</p>
<p><em>Author&#8217;s note: </em> After a year in which <a href="https://krebsonsecurity.com/?s=hotel+breach&amp;x=0&amp;y=0" target="_blank">virtually every major hotel chain</a> suffered at least one major breach, Verizon&#8217;s finding should be a sobering one for everyone concerned about the security of their healthcare records.</p>
<p>As I said at the outset of this story, I&#8217;m amazed that companies with so much on the line routinely fail to do basic checks to ensure customers or users can&#8217;t see beyond their own data.</p>
<p>Not long after I started this blog in 2010 I encountered a similar vulnerability after being approached by a security company that helps Web sites defend against online attacks. The vendor in this case offered to protect my site for free, but I was ultimately unwilling to give them any kind of control over my site.</p>
<p>However, the vendor did give me an account on their protection portal that was reserved for my site, and after logging in I could see my site&#8217;s sample &#8220;dashboard&#8221; even thought it hadn&#8217;t been officially set up yet. Then I had a look at the URL in my browser&#8217;s address field and noticed that it ended with a long string of numbers. On a whim, I changed the last digit in that long number to something else, refreshed the page and in an instant I was captain of some other site&#8217;s dashboard.</p>
<p>Needless to say, I notified them about that flaw and they fixed it quickly at the time, but that was the end of our trial for me.</p>
<p>Stay tuned for another installment in this series on how not to store medical records online.</p>


feed_id: https://krebsonsecurity.com/?p=39305
title: Emergency Fix for Windows Anti-Malware Flaw Leads May’s Patch Tuesday
uri: Emergency-Fix-for-Windows-Anti-Malware-Flaw-Leads-May-s-Patch-Tuesda
url:
https://krebsonsecurity.com/2017/05/emergency-fix-for-windows-anti-malware-flaw-leads-mays-patch-tuesday/

content:
<p><strong>Adobe</strong> and <strong>Microsoft</strong> both issued updates today to fix critical security vulnerabilities in their software. Microsoft actually released an emergency update on Monday just hours ahead of today&#8217;s regularly scheduled &#8220;Patch Tuesday&#8221; (the 2nd Tuesday of each month) to fix a dangerous flaw present in most of Microsoft&#8217;s anti-malware technology that&#8217;s being called the worst Windows bug in recent memory. Separately, Adobe has a new version of its <strong>Flash Player</strong> software available that squashes at least seven nasty bugs.</p>
<p><img class="alignright size-full wp-image-19861" src="media/086898d8.crackedwin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/04/crackedwin.png" alt="crackedwin" width="212" height="251" />Last week, Google security researcher <strong>Tavis Ormandy</strong> <a href="https://twitter.com/taviso/status/860679110728622080" target="_blank">reported</a> to Microsoft a flaw in its Malware Protection Engine, a technology that exists in most of Redmond&#8217;s malware protection offerings &#8212; including <strong>Microsoft Forefront</strong>, <strong>Microsoft Security Essentials</strong> and <strong>Windows Defender</strong>.<strong> </strong>Rather than worry about their malicious software making it past Microsoft&#8217;s anti-malware technology, attackers could simply exploit this flaw to run their malware automatically once their suspicious file is scanned.</p>
<p>&#8220;To exploit this vulnerability, a specially crafted file must be scanned by an affected version of the Microsoft Malware Protection Engine,&#8221; Microsoft warned. &#8220;If the affected antimalware software has real-time protection turned on, the Microsoft Malware Protection Engine will scan files automatically, leading to exploitation of the vulnerability when the specially crafted file scanned.&#8221;</p>
<p>On May 8, Microsoft released <a href="https://technet.microsoft.com/en-us/library/security/4022344" target="_blank">an out-of-band fix</a> for the problem, demonstrating unusual swiftness in addressing a serious issue with its software.</p>
<p>&#8220;Still blown away at how quickly @msftsecurity responded to protect users, can&#8217;t give enough kudos.&#8221; Google&#8217;s Ormandy <a href="https://twitter.com/taviso/status/861751140437839872" target="_blank">tweeted</a> on Monday. &#8220;Amazing.&#8221;</p>
<p>In addition to the anti-malware product update, Microsoft today <a href="https://portal.msrc.microsoft.com/en-us/security-guidance/releasenotedetail/bc365363-f51e-e711-80da-000d3a32fc99" target="_blank">released fixes</a> for dangerous security flaws in a range of products, from <strong>Internet Explorer</strong> and <strong>Edge</strong> to <strong>Windows</strong>, <strong>Microsoft Office</strong>, <strong>.NET</strong>, and of course Adobe Flash Player.<span id="more-39305"></span></p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />The latest Flash Player, <em>v. 25.0.0.171</em> for Windows, Mac, Linux and Chrome OS, is available from <a href="https://get.adobe.com/flashplayer/" target="_blank">this link</a>. Adobe&#8217;s advisory for this update is <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-15.html" target="_blank">here</a>. If you have Flash installed, you should update, hobble or remove Flash as soon as possible. To see which version of Flash your browser may have installed, check out <a href="http://www.adobe.com/software/flash/about/" target="_blank">this page</a>.</p>
<p>An extremely powerful and buggy program that binds itself to the browser, Flash is a favorite target of attackers and malware, and failing to keep up with its continuous security updates can leave users dangerously exposed. For some ideas about how to hobble or do without Flash (as well as slightly less radical solutions) check out <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to keep Flash, please update it today. Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then.</p>


feed_id: https://krebsonsecurity.com/?p=39309
title: SSA.GOV To Require Stronger Authentication
uri: SSA-GOV-To-Require-Stronger-Authentication
url: https://krebsonsecurity.com/2017/05/ssa-gov-to-require-stronger-authentication/
content:
<p>The <strong>U.S. Social Security Administration</strong> will soon require Americans to use stronger authentication when accessing their accounts at <strong>ssa.gov</strong>. As part of the change, SSA will require all users to enter a username and password in addition to a one-time security code sent their email or phone. In this post, we&#8217;ll parse this a bit more and look at some additional security options for SSA users.</p>
<p>The SSA recently updated its portal with the following message:</p>
<div id="attachment_39329" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39329" src="media/196ad766.myssa-580x498.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/myssa-580x498.png" alt="The Social Security Administration's message to Americans regarding the new login changes coming in July 2017." width="580" height="498" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/myssa-580x498.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/myssa-768x659.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/05/myssa-940x807.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/05/myssa.png 1326w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The Social Security Administration&#8217;s message to Americans regarding the new login<br />changes coming in July 2017.</p></div>
<p>I read that to mean even though an email address is required to sign up at ssa.gov, the SSA also is treating email as a second authentication factor. But the above statement seemed open to interpretation, so I put my questions to the SSA: Here&#8217;s what SSA&#8217;s press office came back with:</p>
<blockquote><p>&#8220;Beginning June 10, 2017, we will require all my Social Security account holders (both new and returning) to use a stronger authentication method to create an account or access their account. In addition to entering the username and password, people must select either of the following options to receive a one-time use security code:</p>
<p>A text message; or<br />
An email.</p>
<p>During registration and each subsequent login, customers will receive a new, one-time use security code by text message or email – depending on their choice.</p>
<p>The combination of the username, password, and one-time use security code will provide access to their personal my Social Security account.&#8221;</p></blockquote>
<h4>ANALYSIS</h4>
<p>The idea that one can reset the password using the same email account that will receive the one-time code seems to lessen the value of this requirement as a security measure.</p>
<p>Notice the SSA isn&#8217;t referring to its new security scheme as &#8220;two-factor authentication,&#8221; which requires user to supply something he knows and something he is or has.<span id="more-39309"></span></p>
<p>The former is usually a password or PIN; &#8220;something he is&#8221; most often refers to biometric components (fingerprint, iris scan); whereas the &#8220;something he has&#8221; factor generally refers to the output of one-time code from a key-fob or mobile app like Google authenticator or Duo [full disclosure: Duo is a longtime advertiser on this blog].</p>
<p>The move comes almost a year after the SSA <a href="http://krebsonsecurity.com/2016/08/social-security-administration-now-requires-two-factor-authentication/" target="_blank">enacted</a> and then rescinded a requirement that all Americans who wish to manage their retirement benefits at ssa.gov provide a mobile phone number.</p>
<p>Less than two weeks after that new requirement went into effect last year, the SSA <a href="https://krebsonsecurity.com/2016/08/ssa-ixnay-on-txt-msg-reqmnt-4-e-acct-sry/" target="_blank">reversed itself</a> and did away with the requirement. The policy was reversed following a rollout marred by technical difficulties and criticism that the new requirement did little to prevent identity thieves from siphoning benefits from Americans who hadn’t yet created accounts at ssa.gov for themselves.</p>
<h4>SIGN UP AT SSA BEFORE SOMEONE DOES IT FOR YOU</h4>
<p>In September 2013, I <a href="http://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank">warned</a> that SSA and financial institutions were tracking a rise in cases wherein identity thieves register an account at the SSA’s portal using a retiree’s personal information and have the victim’s benefits diverted to prepaid debit cards that the crooks control.</p>
<p>Because it’s possible to create just one my Social Security account per Social Security number, registering an account on the portal is one basic way that Americans can avoid becoming victims of this scam.</p>
<p>So what else beyond the basic measures being enacted in June 2017 does the SSA offer Americans concerned about someone hijacking their SSA account online?</p>
<p>The SSA offers a set of options that it calls “<a href="https://secure.ssa.gov/RIL/HpsView.do" target="_blank">extra security</a>.&#8221; These extra options by the way include the sending users a special code via the U.S. Mail that has to be entered on the agency’s site to complete the signup process. If you choose to enable extra security, the SSA will then ask you for:</p>
<ul>
<li>The last eight digits of your Visa, MasterCard, or Discover credit card;</li>
<li>Information from your W2 tax form;</li>
<li>Information from a 1040 Schedule SE (self-employment) tax form; or</li>
<li>Your direct deposit amount, if you receive Social Security benefits.</li>
</ul>
<p>Sadly, crooks won’t go through the more rigorous signup process — they’ll choose the option that requires less information. That means it is still relatively easy for thieves to create an account in the name of Americans who have not already created one for themselves. All one would need is the target’s name, date of birth, Social Security number, residential address, and phone number. This personal data can be bought for roughly $3-$4 from a variety of cybercrime shops online.<span id="more-35933"></span></p>
<p>What else does the SSA require to prove you’re you when creating a new account at my Social Security? Assuming you can buy or supply the above personal data, the agency relays four multiple-guess, so-called “knowledge-based authentication” or KBA questions from credit bureau <strong>Equifax</strong>.</p>
<p>In practice, many of these KBA questions — such as previous address, loan amounts and dates — can be successfully enumerated with random guessing.  What’s more, very often the answers to these questions can be found by consulting free online services, such as <strong>Zillow</strong> and <strong>Facebook</strong>.</p>
<p>In addition to the SSA’s optional security measures, Americans can further block ID thieves by placing a security freeze on their credit files with the major credit bureaus. Readers who have <a href="http://krebsonsecurity.com/?s=security+freeze&amp;x=0&amp;y=0" target="_blank">taken my ceaseless advice to freeze their credit</a> will need to temporarily thaw the freeze in order to complete the process of creating an account at ssa.gov.</p>
<p>Looked at another way, having a freeze in place blocks ID thieves from fraudulently creating an account in your name and potentially diverting your government benefits.</p>
<p>Alternatively, citizens can block online access to their Social Security account. Instructions for doing that are <a href="https://secure.ssa.gov/acu/IPS_INTR/blockaccess" target="_blank">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39343
title: U.K. Hospitals Hit in Widespread Ransomware Attack
uri: U-K-Hospitals-Hit-in-Widespread-Ransomware-Attack
url: https://krebsonsecurity.com/2017/05/u-k-hospitals-hit-in-widespread-ransomware-attack/
content:
<p>At least 16 hospitals in the United Kingdom are being forced to divert emergency patients today after computer systems there were infected with ransomware, a type of malicious software that encrypts a victim&#8217;s documents, images, music and other files unless the victim pays for a key to unlock them.</p>
<p>It remains unclear exactly how this ransomware strain is being disseminated and why it appears to have spread so quickly, but there are indications the malware may be spreading to vulnerable systems through a security hole in <strong>Windows</strong> that was recently patched by <strong>Microsoft</strong>.</p>
<div id="attachment_39350" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39350" src="media/01c3b6df.wanna-580x285.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/wanna-580x285.png" alt="The ransom note left behind on computers infected with the Wanna Decryptor ransomware strain. Image: BleepingComputer." width="580" height="285" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/wanna-580x285.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/wanna.png 663w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The ransom note left behind on computers infected with the Wanna Decryptor ransomware strain. Image: BleepingComputer.</p></div>
<p>In <a href="https://www.digital.nhs.uk/article/1491/Statement-on-reported-NHS-cyber-attack" target="_blank">a statement</a>, the U.K.&#8217;s <strong>National Health Service</strong> (NHS) said a number of NHS organizations had suffered ransomware attacks.</p>
<p>&#8220;This attack was not specifically targeted at the NHS and is affecting organizations from across a range of sectors,&#8221; the NHS said. &#8220;At this stage we do not have any evidence that patient data has been accessed.&#8221;</p>
<p>According to <a href="http://www.reuters.com/article/us-britain-security-hospitals-idUSKBN18820S" target="_blank">Reuters</a>, hospitals across England are diverting patients requiring emergency treatment away from the affected hospitals, and the public is being advised to seek medical care only for acute medical conditions.</p>
<p>NHS said the investigation is at an early stage but the ransomware that hit at least 16 NHS facilities is a variant of <strong>Wanna Decryptor</strong> (a.k.a. &#8220;<strong>WannaCry</strong>&#8220;), a ransomware strain that surfaced roughly two weeks ago.</p>
<p><strong>Lawrence Abrams</strong>, owner of the tech-help forum <a href="http://www.bleepingcomputer.com" target="_blank">BleepingComputer</a>, said Wanna Decryptor wasn&#8217;t a big player in the ransomware space until the past 24 hours, when something caused it to be spread far and wide very quickly.</p>
<p>&#8220;It&#8217;s been out for almost two weeks now, and until very recently it&#8217;s just been sitting there,&#8221; Abrams said. &#8220;Today, it just went nuts.&#8221;</p>
<p>For example, the same ransomware strain apparently today also hit <strong>Telefonica</strong>, one of Spain&#8217;s largest telecommunications companies. According to <a href="https://www.bleepingcomputer.com/news/security/telefonica-tells-employees-to-shut-down-computers-amid-massive-ransomware-outbreak/" target="_blank">an article</a> on BleepingComputer, Telefonica has responded by &#8220;desperately telling employees to shut down computers and VPN connections in order to limit the ransomware&#8217;s reach.&#8221;</p>
<p><a href="https://www.bleepingcomputer.com/news/security/telefonica-tells-employees-to-shut-down-computers-amid-massive-ransomware-outbreak/" target="_blank">An alert</a> published by Spain&#8217;s national computer emergency response team (<strong>CCN-CERT</strong>) suggested that the reason for the rapid spread of Wanna Decryptor is that it is leveraging a software vulnerability in Windows computers that <strong>Microsoft</strong> patched in March.<span id="more-39343"></span></p>
<p>According to CCN-CERT, that flaw is <a href="https://technet.microsoft.com/en-us/library/security/ms17-010.aspx" target="_blank">MS17-010</a>, a vulnerability in the Windows <a href="https://en.wikipedia.org/wiki/Server_Message_Block" target="_blank">Server Message Block</a> (SMB) service, which Windows computers rely upon to share files and printers across a local network. Malware that exploits SMB flaws could be extremely dangerous inside of corporate networks because the file-sharing component may help the ransomware spread rapidly from one infected machine to another.</p>
<p>That SMB flaw has enabled Wanna Decryptor to spread to more than 36,000 Windows computers so far, according to <strong>Jakub Kroustek</strong>, a malware researcher with <strong>Avast</strong>, a security firm based in the Czech Republic.</p>
<p>&#8220;So far, Russia, Ukraine, and Taiwan leading,&#8221; the world in new infections, Kroustek <a href="https://twitter.com/JakubKroustek/status/863045197663490053">wrote</a> in a tweet. &#8220;This is huge.&#8221;</p>
<p>Abrams said Wanna Decryptor &#8212; like many ransomware strains &#8212; encrypts victim computer files with extremely strong encryption, but the malware itself is not hard to remove from infected computers. Unfortunately, removing the infection does nothing to restore one&#8217;s files to their original, unencrypted state.</p>
<p>&#8220;It&#8217;s not difficult to remove, but it also doesn&#8217;t seem to be decryptable,&#8221; Abrams said. &#8220;It also seems to be very persistent. Every time you make a new file [on an infected PC], it encrypts that new file too.&#8221;</p>
<p>Experts may yet find a weakness in Wanna that allows them to way to decode the ransomware strain without paying the ransom. For now, however, victims who don&#8217;t have backups of their files have one option: Pay the $300 Bitcoin ransom being demanded by the program.</p>
<p>Nevertheless, victims who are struggling with ransomware should pay a visit to <a href="https://www.bleepingcomputer.com/forums/f/239/ransomware-help-tech-support/" target="_blank">BleepingComputer&#8217;s ransomware help forum</a>, which often has tutorials on how to remove the malware and in some cases unlock encrypted files without paying the ransom. In addition, the <a href="https://www.nomoreransom.org/" target="_blank">No More Ransom Project</a> also includes an online tool that enables ransomware victims to learn if a free decryptor is available by uploading a single encrypted file.</p>


feed_id: https://krebsonsecurity.com/?p=39359
title: Microsoft Issues WanaCrypt Patch for Windows 8, XP
uri: Microsoft-Issues-WanaCrypt-Patch-for-Windows-8-XP
url: https://krebsonsecurity.com/2017/05/microsoft-issues-wanacrypt-patch-for-windows-8-xp/
content:
<p><strong>Microsoft Corp.</strong> today took the unusual step of issuing security updates to address flaws in older, unsupported versions of Windows &#8212; including <strong>Windows XP</strong> and <strong>Windows 8</strong>. The move is a bid to slow the spread of the <strong>WanaCrypt</strong> ransomware strain that infected tens of thousands of Windows computers virtually overnight this week.</p>
<div id="attachment_39360" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39360" src="media/3a44e43d.wanamap-580x256.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/wanamap-580x256.png" alt="A map tracking the global spread of the Wana ransomware strain. Image: Malwaretech.com. " width="580" height="256" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/wanamap-580x256.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/wanamap-768x339.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/05/wanamap-940x416.png 940w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A map tracking the global spread of the Wana ransomware strain. Image: Malwaretech.com.</p></div>
<p>On Friday, May 12, countless organizations around the world began fending off attacks from a ransomware strain variously known as WannaCrypt, WanaDecrypt and Wanna.Cry. Ransomware encrypts a victim’s documents, images, music and other files unless the victim pays for a key to unlock them.</p>
<p>It quickly became apparent that Wanna was spreading with the help of <a href="https://technet.microsoft.com/en-us/library/security/ms17-010.aspx" target="_blank">a file-sharing vulnerability in Windows</a>. Microsoft issued a patch to fix this flaw back in March 2017, but organizations running older, unsupported versions of Windows (such as Windows XP) were unable to apply the update because Microsoft no longer supplies security patches for those versions of Windows.</p>
<p>The software giant today made an exception to that policy after it became clear that many organizations hit hardest by Wanna were those still running older, unsupported versions of Windows.</p>
<p>&#8220;Seeing businesses and individuals affected by cyberattacks, such as the ones reported today, was painful,&#8221; <a href="https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/" target="_blank">wrote</a> <strong>Phillip Misner</strong>, principal security group manager at the Microsoft Security Response Center. &#8220;Microsoft worked throughout the day to ensure we understood the attack and were taking all possible actions to protect our customers.&#8221;</p>
<p>The update to address the file-sharing bug that Wanna is using to spread is now available for Windows XP, Windows 8, and Windows Server 2003 via the links at the bottom of <a href="https://blogs.technet.microsoft.com/msrc/2017/05/12/customer-guidance-for-wannacrypt-attacks/" target="_blank">this advisory</a>.</p>
<p>On Friday, at least 16 hospitals in the United Kingdom were forced to divert emergency patients after computer systems there were infected with Wanna. According to multiple stories in the <a href="http://www.telegraph.co.uk/news/2017/05/12/nhs-hit-major-cyber-attack-hackers-demanding-ransom/" target="_blank">British media</a>, approximately 90 percent of care facilities in the U.K.’s <strong>National Health Service </strong>are still using Windows XP – a 16-year-old operating system.</p>
<p>According to <a href="https://twitter.com/JakubKroustek/status/863188326039396352" target="_blank">a tweet</a> from <strong>Jakub Kroustek</strong>, a malware researcher with security firm <strong>Avast, </strong>the company&#8217;s software has detected more than 100,000 instances of the Wana ransomware.</p>
<p>For advice on how to harden your systems against ransomware, please see the tips in <a href="https://krebsonsecurity.com/2016/12/before-you-pay-that-ransomware-demand/" target="_blank">this post</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39367
title: Global ‘Wana’ Ransomware Outbreak Earned Perpetrators $26,000 So Far
uri: Global-Wana-Ransomware-Outbreak-Earned-Perpetrators-26-000-So-F
url:
https://krebsonsecurity.com/2017/05/global-wana-ransomware-outbreak-earned-perpetrators-26000-so-far/

content:
<p>As thousands of organizations work to contain and clean up the mess from this week&#8217;s <a href="https://krebsonsecurity.com/2017/05/u-k-hospitals-hit-in-widespread-ransomware-attack/" target="_blank">devastating <strong>Wana</strong> ransomware attack</a>, the fraudsters responsible for releasing the digital contagion are no doubt counting their earnings and congratulating themselves on a job well done. But according to a review of the Bitcoin addresses hard-coded into Wana, it appears the perpetrators of what&#8217;s being called the worst ransomware outbreak ever have made little more than USD $26,000 so far from the scam.</p>
<div id="attachment_39370" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39370" src="media/02529092.wanalock-580x435.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/wanalock-580x435.png" alt="Victims of the Wana ransomware will see this lock screen demanding a $300 ransom to unlock all encrypted files. " width="580" height="435" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/wanalock-580x435.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/wanalock.png 694w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Victims of the Wana ransomware will see this lock screen demanding a $300 ransom to unlock all encrypted files.</p></div>
<p>The Wana ransomware became a global epidemic virtually overnight this week, after criminals started distributing copies of the malware with the help of a security vulnerability in <strong>Windows</strong> computers that <strong>Microsoft</strong> patched in March 2017. Infected computers have all their documents and other important user files scrambled with strong encryption, and victims without access to good backups of that data have two choices: Kiss the data goodbye, or pay the ransom &#8212; the equivalent of approximately USD $300 worth of the virtual currency Bitcoin.</p>
<p>According to <a href="https://www.redsocks.eu/news/ransomware-wannacry/" target="_blank">a detailed writeup</a> on the Wana ransomware published Friday by security firm <strong>Redsocks</strong>, Wana contains three bitcoin payment addresses that are hard-coded into the malware. One of the nice things about Bitcoin is that anyone can view all of the historic transactions tied a given Bitcoin payment address. As a result, it&#8217;s possible to tell how much the criminals at the helm of this crimeware spree have made so far and how many victims have paid the ransom.</p>
<p><em>A review of the three payment addresses hardcoded into the Wana ransomware strain indicates that these accounts to date have received 100 payments totaling slightly more than 15 Bitcoins &#8212; or approximately $26,148 at the current Bitcoin-to-dollars exchange rate.</em><span id="more-39367"></span></p>
<h4>ANALYSIS</h4>
<p>It is possible that the crooks responsible for this attack maintained other Bitcoin addresses that were used to receive payments in connection with this attack, but there is currently no evidence of that. It&#8217;s worth noting that the ransom note Wana popped up on victim screens (see screenshot above) included a &#8220;Contact Us&#8221; feature that may have been used by some victims to communicate directly with the fraudsters. Also, I realize that in many ways USD $26,000 is a great deal of money.</p>
<p>However, I find it depressing to think of the massive financial damage likely wrought by this ransom campaign in exchange for such a comparatively small reward. It&#8217;s particularly galling because this attack potentially endangered the lives of many. At least 16 hospitals in the United Kingdom were <a href="https://krebsonsecurity.com/2017/05/microsoft-issues-wanacrypt-patch-for-windows-8-xp/" target="_blank">diverting patients and rescheduling procedures on Friday</a> thanks to the Wana outbreak, meaning the attack may well have hurt people physically (no deaths have been reported so far, thank goodness).</p>
<p>Unfortunately, this glaring disparity is par for the course with cybercrime in general. As I observed on several occasions in my book <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank"><em>Spam Nation</em></a> &#8212; which tracked the careers of some of the most successful malware writers and pharmacy pill spammers on the planet &#8212; it was often disheartening to see how little money most of those guys made given the sheer amount of digital disease they were pumping out into the Internet on a daily basis.</p>
<p>In fact, very few of these individuals made much money at all, and yet they were responsible for perpetuating a global crime machine that inflicted enormous damage on businesses and consumers. A quote in the book from <strong>Stefan Savage</strong>, a computer science professor at the University of California, San Diego (UCSD) encapsulates the disparity quite nicely and seems to have aged quite well:</p>
<p>&#8220;What&#8217;s fascinating about all this is that at the end of the day, we&#8217;re not talking about all that much money,&#8221; Savage said. &#8220;These guys running the pharma programs are not Donald Trumps, yet their activity is going to have real and substantial financial impact on the day-to-day lives of tens of millions of people. In other words, for these guys to make modest riches, we need a multibillion-dollar industry to deal with them.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=39393
title: Breach at DocuSign Led to Targeted Email Malware Campaign
uri: Breach-at-DocuSign-Led-to-Targeted-Email-Malware-Campaign
url: https://krebsonsecurity.com/2017/05/breach-at-docusign-led-to-targeted-email-malware-campaign/
content:
<p><strong>DocuSign</strong>, a major provider of electronic signature technology, acknowledged today that a series of recent malware phishing attacks targeting its customers and users was the result of a data breach at one of its computer systems. The company stresses that the data stolen was limited to customer and user email addresses, but the incident is especially dangerous because it allows attackers to target users who may already be expecting to click on links in emails from DocuSign.</p>
<p>On San Francisco-based DocuSign warned on May 9 that it was tracking a malicious email campaign where the subject line reads, &#8220;Completed: docusign.com &#8211; Wire Transfer Instructions for recipient-name Document Ready for Signature.&#8221; The missives contained a link to a downloadable <strong>Microsoft Word</strong> document that harbored malware.</p>
<div id="attachment_39395" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39395" src="media/ed18660f.docusign-580x536.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/docusign-580x536.png" alt="A typical DocuSign email. Image: DocuSign." width="580" height="536" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/docusign-580x536.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/docusign.png 686w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A typical DocuSign email. Image: DocuSign.</p></div>
<p>The company said at the time that the messages were not associated with DocuSign, and that they were sent from a malicious third-party using DocuSign branding in the headers and body of the email. But in <a href="https://trust.docusign.com/en-us/personal-safeguards/" target="_blank">an update</a> late Monday, DocuSign confirmed that this malicious third party was able to send the messages to customers and users because it had broken in and stolen DocuSign&#8217;s list of customers and users.</p>
<p>&#8220;As part of our ongoing investigation, today we confirmed that a malicious third party had gained temporary access to a separate, non-core system that allows us to communicate service-related announcements to users via email,&#8221; DocuSign wrote in an alert posted to its site. &#8220;A complete forensic analysis has confirmed that only email addresses were accessed; no names, physical addresses, passwords, social security numbers, credit card data or other information was accessed. No content or any customer documents sent through DocuSign’s eSignature system was accessed; and DocuSign’s core eSignature service, envelopes and customer documents and data remain secure.&#8221;</p>
<p>The company is asking people to forward any suspicious emails related to DocuSign to spam@docusign.com, and then to delete the missives. <span id="more-39393"></span></p>
<p>&#8220;They may appear suspicious because you don’t recognize the sender, weren’t expecting a document to sign, contain misspellings (like “docusgn.com” without an ‘i’ or @docus.com), contain an attachment, or direct you to a link that starts with anything other than https://www.docusign.com or https://www.docusign.net,&#8221; reads the advisory.</p>
<p>If you have reason to expect a DocuSign document via email, don&#8217;t respond to an email that looks like it&#8217;s from DocuSign by clicking a link in the message. When in doubt, access your documents directly by visiting <a href="https://www.docusign.com" target="_blank">docusign.com</a>, and entering the unique security code included at the bottom of every legitimate DocuSign email. DocuSign says it will never ask recipients to open a PDF, Office document or ZIP file in an email.</p>
<p>DocuSign was already a perennial target for phishers and malware writers, but this incident is likely to intensify attacks against its users and customers. DocuSign says it has more than 100 million users, and it seems all but certain that the criminals who stole the company&#8217;s customer email list are going to be putting it to nefarious use for some time to come.</p>


feed_id: https://krebsonsecurity.com/?p=39407
title: Fraudsters Exploited Lax Security at Equifax’s TALX Payroll Division
uri: Fraudsters-Exploited-Lax-Security-at-Equifax-s-TALX-Payroll-Division
url:
https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/

content:
<p>Identity thieves who specialize in tax refund fraud had big help this past tax year from <strong>Equifax</strong>, one of the nation&#8217;s largest consumer data brokers and credit bureaus. The trouble stems from <a href="https://en.wikipedia.org/wiki/Talx" target="_blank">TALX</a>, an Equifax subsidiary that provides online payroll, HR and tax services. Equifax says crooks were able to reset the 4-digit PIN given to customer employees as a password and then steal W-2 tax data after successfully answering personal questions about those employees.</p>
<p>In a boilerplate text sent to several affected customers, Equifax said the unauthorized access to customers&#8217; employee tax records happened between April 17, 2016 and March 29, 2017.</p>
<p>Beyond that, the extent of the fraud perpetrated with the help of hacked TALX accounts is unclear, and Equifax refused requests to say how many consumers or payroll service customers may have been impacted by the authentication weaknesses.</p>
<div id="attachment_39423" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39423" src="media/37cfb7e1.equifaxwfs-580x368.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs-580x368.png" alt="Equifax's TALX -- now called Equifax Workforce Solutions -- aided tax thieves by relying on outdated and insufficient consumer authentication methods." width="580" height="368" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs-580x368.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs-768x487.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs-940x596.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs.png 1418w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Equifax&#8217;s subsidiary TALX &#8212; now called Equifax Workforce Solutions &#8212; aided tax thieves by relying on outdated and insufficient consumer authentication methods.</p></div>
<p>Thanks to data breach notification laws in nearly all U.S. states now, we know that so far at least five organizations have received letters from Equifax about a series of incidents over the past year, including defense contractor giant <a href="https://oag.ca.gov/system/files/Northrop%20Grumman%20Individual%20Notification%20Letter_64772036_1_0.PDF?" target="_blank">Northrop Grumman</a>; staffing firm <a href="media/4566aa18.itu-281065.pdf" data-original-source="http://www.marylandattorneygeneral.gov/ID%20Theft%20Breach%20Notices/2017/itu-281065.pdf" target="_blank">Allegis Group</a>; <a href="media/353f8a77.saint-gobain-20170413.pdf" data-original-source="http://www.doj.nh.gov/consumer/security-breaches/documents/saint-gobain-20170413.pdf" target="_blank">Saint-Gobain Corp</a>.; <a href="media/16933e6d.talx-20170515.pdf" data-original-source="http://www.doj.nh.gov/consumer/security-breaches/documents/talx-20170515.pdf" target="_blank">Erickson Living</a>; and the <a href="http://www.louisvillecardinal.com/2017/04/hackers-steal-university-employee-tax-info/" target="_blank">University of Louisville</a>.</p>
<p>A snippet from TALX&#8217;s <a href="media/16933e6d.talx-20170515.pdf" data-original-source="http://www.doj.nh.gov/consumer/security-breaches/documents/talx-20170515.pdf" target="_blank">letter to the New Hampshire attorney general</a> (PDF) offers some insight into the level of security offered by this wholly-owned subsidiary of Equifax. In it, lawyers for TALX downplay the scope of the breach even as they admit the company wasn&#8217;t able to tell exactly how much unauthorized access to tax records may have occurred.</p>
<p>&#8220;TALX believes that the unauthorized third-party(ies) gained access to the accounts primarily by successfully answering personal questions about the affected employees in order to reset the employees&#8217; pins (the password to the online account portal),&#8221; wrote <strong>Nicholas A. Oldham</strong>, an attorney representing TALX. &#8220;Because the accesses generally appear legitimate (e.g., successful use of login credentials), TALX cannot confirm forensically exactly which accounts were, in fact, accessed without authorization, although TALX believes that only a small percentage of these potentially affected accounts were actually affected.&#8221;</p>
<h4>ANALYSIS</h4>
<p>Generally. Forensically. Exactly. Potentially. Actually. Lots of hand-waiving from the TALX/Equifax suits. But Equifax should have known better than to rely on a simple PIN for a password, says <strong>Avivah Litan</strong>, a fraud analyst with <a href="https://www.gartner.com/analyst/12030/Avivah-Litan" target="_blank">Gartner Inc.</a></p>
<p>&#8220;That&#8217;s so 1990s,&#8221; Litan said. &#8220;It&#8217;s pretty unbelievable that a company like Equifax would only protect such sensitive data with just a PIN.&#8221;</p>
<p>Litan said TALX should have required customers to use stronger two-factor authentication options, such as one-time tokens sent to an email address or mobile device (as Equifax now says TALX is doing &#8212; at least with those we know were notified about possible employee account abuse).</p>
<p>The big consumer credit bureaus like Equifax, <strong>Experian</strong>, <strong>Innovis</strong> and <strong>Trans Union</strong> are all regulated by the <a href="https://en.wikipedia.org/wiki/Fair_Credit_Reporting_Act" target="_blank">Fair Credit Reporting Act</a> (FCRA), which strives to promote accuracy, fairness and privacy for data used by consumer reporting agencies.  But Litan said there are no federal requirements that credit bureaus use stronger authentication for access to consumer data &#8212; such as two-factor authentication.</p>
<p>&#8220;There&#8217;s about 500 percent more protection for credit card data right now than there is for identity data,&#8221; Litan said. &#8220;And yet I don&#8217;t know of one document from the federal government that spells out how these credit bureaus and other companies have to protect PII (personally identifiable information).&#8221;<span id="more-39407"></span></p>
<p>Then there is the small matter of the questions that ID thieves were able to successfully answer about their victims via TALX&#8217;s online portal. Security experts have been warning for years about the waning effectiveness of using so-called &#8220;<a href="https://en.wikipedia.org/wiki/Knowledge-based_authentication" target="_blank">knowledge-based authentication questions</a>&#8221; (KBA) &#8212; such as details about the consumer&#8217;s historic location and financial activity &#8212; for online authentication.</p>
<p>The problem with relying on KBA questions to authenticate consumers online is that so much of the information needed to successfully guess the answers to those multiple-choice questions is now indexed or exposed by search engines, social networks and third-party services online &#8212; both criminal and commercial.</p>
<p>What&#8217;s more, many of the companies that provide and resell these types of KBA challenge/response questions <a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank">have been hacked in the past</a> by criminals that run their own identity theft services.</p>
<p>&#8220;Whenever I’m faced with KBA-type questions I find that database tools like Spokeo, Zillow, etc are my friend because they are more likely to know the answers for me than I am,&#8221; said <strong>Nicholas Weaver</strong>, a senior researcher in networking and security for the <a href="https://www.icsi.berkeley.edu/icsi/people/nweaver" target="_blank">International Computer Science Institute</a> (ICSI).</p>
<p>In short: The crooks broadly have access to the data needed to reliably answer KBA questions on most consumers.</p>
<p>Litan said the key is reducing reliance on static data – much of which is PII data that has been compromised by the crooks – and increasing reliance on dynamic data, like reputation, behavior and relationships between non-PII data elements.</p>
<p>Identity thieves prize the W-2 and payroll data held by companies like TALX because they can use it to file fraudulent tax refund requests with the IRS and the states on behalf of victim consumers. According to the Internal Revenue Service, some 787,000 Americans reported being victimized by tax refund fraud last year.</p>
<p>Extra security and screening precautions by the states and the IRS brought last year&#8217;s victim numbers down 50 percent from 2015. But even the IRS has struggled with its own tax fraud-related security foibles tied to weak consumer authentication. In 2015, it issued <a href="media/e035172e.201620082fr.pdf" data-original-source="https://www.treasury.gov/tigta/auditreports/2016reports/201620082fr.pdf" target="_blank">more than $490 million in fraudulent refunds</a> requested on behalf of hundreds of thousands of Americans who were <a href="https://krebsonsecurity.com/?s=get+transcript&amp;x=0&amp;y=0" target="_blank">victimized by data stolen directly from the &#8220;Get Transcript&#8221; feature of the IRS&#8217;s own Web site</a>.</p>
<p>It&#8217;s worth noting that &#8211; as with the TALX incidents &#8212; the IRS&#8217;s Get Transcript fiasco also failed because it relied primarily on KBA questions <a href="https://krebsonsecurity.com/2016/06/irs-re-enables-get-transcript-feature/" target="_blank">asked by Equifax</a>.</p>
<p>Tax-related identity theft occurs when someone uses a Social Security number (SSN) — either a client’s, a spouse’s, or dependent’s — to file a tax return claiming a fraudulent refund. Thieves may also use a stolen Employer Identification Number (EIN) from a business client to create false Forms W-2 to support refund fraud schemes. Increasingly, fraudsters are simply <a href="https://krebsonsecurity.com/?s=w-2+phishing&amp;x=0&amp;y=0" target="_blank">phishing W-2 data in large quantities</a> from human resource professionals at a variety of organizations.</p>
<p>Victims usually first learn of the crime after having their returns rejected because scammers beat them to it. Even those who are not required to file a return can be victims of refund fraud, as can those who are not actually due a refund from the IRS.</p>
<p>“If the federal government is smart, they will consider suing Equifax for false returns filed using W2 information stolen from TALX customers, since this is exactly the sort of mass scale attack that even the most basic SMS-based 2-factor would block,” the ICSI&#8217;s Weaver said.</p>
<p>It&#8217;s high time for consumers to come face-to-face with the reality that the basic data needed to open new lines of credit on them or file taxes in their name is broadly available for sale in the cybercrime underground. What little consumer data that cannot be found in the bowels of the Dark Web can be coaxed out of countless poorly-secured and automated services like TALX that hold extremely sensitive consumer data and yet safeguard it with antiquated and insufficient authentication measures.</p>
<p>In light of the above, the sobering reality is that we have no business using these static identifiers (SSN, DOB, address, previous address, income, mother&#8217;s maiden name) for authentication, and yet this practice remains rampant across vast sectors of the American economy today, including consumer banking, <a href="https://krebsonsecurity.com/2017/03/student-aid-tool-held-key-for-tax-fraudsters/" target="_blank">higher education</a> and government services.</p>
<p>Predictably, Equifax is offering identity theft detection services (for two years) to employees of TALX customers. Loyal readers here know where I come down on these credit monitoring services, because nobody should confuse these services with a reliable method to block identity theft. The most consumers can hope for out of a credit monitoring service is that it alerts you when ID thieves hijack your data; these services generally don&#8217;t prevent ID theft. Also, they can be useful for helping to clean up after a confirmed ID theft incident.</p>
<p>The consumer&#8217;s best weapon against new account fraud and other forms of identity theft is <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank">the security freeze</a>, also known as a credit freeze. I explain more about the benefits of the freeze as well as other options in <a href="https://krebsonsecurity.com/?s=security+freeze&amp;x=0&amp;y=0" target="_blank">multiple posts on this blog</a>. I should note, however, that a security freeze will do nothing to stop fraudsters from filing phony tax refunds in your name with the IRS. For tips on avoiding tax refund fraud, check out <a href="https://krebsonsecurity.com/2015/12/dont-be-a-victim-of-tax-refund-fraud-in-16/" target="_blank">this post</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39245
title: Should SaaS Companies Publish Customers Lists?
uri: Should-SaaS-Companies-Publish-Customers-Lists
url: https://krebsonsecurity.com/2017/05/should-saas-companies-publish-customers-lists/
content:
<p>A few weeks back, HR and financial management firm <strong>Workday.com</strong> sent a security advisory to customers warning that crooks were sending targeted malware phishing attacks at customers. At the same time, Workday is publishing on its site a list of more than 800 companies that use its services, making it relatively simple for attackers to chose their targets. This post examines whether it makes sense for software-as-a-service (SaaS) companies to publish lists of their customers when those customers are actively under siege from phishers impersonating the SaaS provider.</p>
<p>At its most basic, security always consists of trade-offs. Many organizations find a natural tension between marketing and security. The security folks warn that publishing too much information about how the company does business and with whom makes it way too easy for phishers and other scammers to target your customers.</p>
<div id="attachment_39437" style="width: 544px" class="wp-caption aligncenter"><img class="size-full wp-image-39437" src="media/dd380a04.wdayphish-1.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/wdayphish-1.png" alt="A screenshot of a phishing lure used to target Workday customers." width="534" height="405" /><p class="wp-caption-text">A screenshot of a phishing lure used to target Workday customers.</p></div>
<p>The marketing folks, quite naturally, often have a different perspective: The benefits of publishing partner data far outweigh the nebulous risks that someone may abuse this information.</p>
<p>So the question is, at what point does marketing take a backseat to security at SaaS firms when their customers are being phished? Is it even reasonable to think that determined attackers would be deterred if they had to pore through press releases and other public data to find a target list?</p>
<p>When I first approached Workday in researching this column, I did so in regard to an alert they emailed customers earlier this month. In the alert, Workday warned that customers using single-factor authentication to access Workday were being targeted by email phishing campaigns. The company said there was no evidence to suggest the phishing a result of the Workday service or infrastructure, but rather it was the result of phishing emails where individuals at customer organizations shared login credentials with a malicious third party. In short, they&#8217;d been phished.</p>
<div id="attachment_39467" style="width: 590px" class="wp-caption aligncenter"><img src="media/44266b0a.workdayalert-580x693.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/workdayalert-580x693.png" alt="A portion of the phishing alert that Workday sent to its customers." width="580" height="693" class="size-medium wp-image-39467" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/workdayalert-580x693.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/workdayalert.png 640w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A portion of the phishing alert that Workday sent to its customers.</p></div>
<p>Workday advised customers to take advantage of the company&#8217;s two-factor authentication systems, and to enable secondary approvals for all important transactions.</p>
<p>All good advice, but I also challenged the company that it maybe wasn&#8217;t the best idea to also publish a <a href="https://www.workday.com/en-gb.sitemap.xml" target="_blank">tidy list of more than 800 customers</a> on its Web site. I also noted that Workday&#8217;s site makes it simple to find an HTML template for targeted phishing campaigns. Just take one of the companies listed on its site and enter the name in the <a href="https://www.workday.com/en-us/signin.html#" target="_blank">Workday Sign-in search page</a>. Selecting <strong>Netflix</strong> from the list of Workday customers, for example, we can find <a href="https://accounts.google.com/signin/oauth/identifier?hd=*&amp;client_id=733586745572-han3us7ubu091en0tj95c7ra5msihbap.apps.googleusercontent.com&amp;as=-3d7a7436f1aa15b8&amp;destination=https%3A%2F%2Fmeechum.netflix.com&amp;approval_state=!ChROVExtZWhVRUFQVmIyUWRrT0J5WBIfWXlaNTZCY3V0c01VWUFOYVJfLXV5LTAzSFpjUnd4VQ%E2%88%99ADiIGyEAAAAAWSRqcpj2D8XEGN-Po_3-Vmg2VDupoSd_&amp;passive=1209600&amp;oauth=1&amp;sarp=1&amp;xsrfsig=AHgIfE8JHN7CJCDTq46fSelTnmD8UcaSRA&amp;flowName=GeneralOAuthFlow" target="_blank">Netflix&#8217;s login page</a>:</p>
<div id="attachment_39436" style="width: 484px" class="wp-caption aligncenter"><img class="size-full wp-image-39436" src="media/5ca9fbed.netflix-workday.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/netflix-workday.png" alt="Netflix's sign-in page at Workday.com." width="474" height="551" /><p class="wp-caption-text">Netflix&#8217;s sign-in page at Workday.com.</p></div>
<p>That link opens up a page that allows Netflix customers to login to Workday using Google&#8217;s OAuth system for linking third-party apps to Google accounts. It&#8217;s a good thing we haven&#8217;t recently seen targeted phishing attacks that mimic this precise process to hijack Google accounts.</p>
<p>Oh wait, something very similar just happened earlier this month. In the first week of May, phishers began <a href="http://www.zdnet.com/article/gmail-fake-docs-attack-now-google-tightens-oauth-rules-to-block-phishing/" target="_blank">sending Google Docs phishing campaigns</a> via Gmail disguised as an offer to share a document. Recipients who fell for the ruse ended up authorizing an app from Google&#8217;s OAuth authentication interface &#8212; i.e., handing crooks direct access to their accounts.</p>
<p>Before I go further, let me just say that it is not my intention to single out Workday in this post: There are plenty of other companies in its exact same position. The question I want to explore is at what point does marketing get trumped by security? For me, the juxtaposition between Workday&#8217;s warning and its priming the pump for phishers at the same time seemed off.</p>
<p>Workday wasn&#8217;t swayed by my logic, and they referred me to a marketing industry analyst for the finer points of that perspective. <strong>Michael Krigsman</strong>, a tech industry analyst and host at <a href="https://www.cxotalk.com/" target="_blank">cxotalk.com</a>, said he often advises smaller companies that may be less sophisticated in their marketing strategies to publish a list of customers on their home pages.</p>
<p>&#8220;Even when it comes to larger companies like Workday, they&#8217;re selling so many seats that this information is highly public knowledge and very easy to get,&#8221; Krigsman said. &#8220;If you&#8217;re interested in Workday&#8217;s customer lists, for example, you can easily find that out because Workday puts out press releases, their customers put out press releases, and this gets picked up in the trade press.&#8221;<span id="more-39245"></span></p>
<h4>WHERE I COME FROM</h4>
<p>Fair enough, I said, and then I explained my historical perspective on this topic. Ever since I broke a series of stories about breaches at major retailers like Target, Home Depot, Neiman Marcus and Michaels, I&#8217;ve been inundated with requests from banks and credit unions to help them figure out which merchants were responsible for credit and debit card fraud that was costing them huge financial losses.</p>
<p>They sought my help in figuring this out because Visa and MasterCard have contractual ways to help banks recover a portion of the funds lost to credit card breaches if the financial institutions can show that specific fraud was traced back to cards all used at the same breached merchant.</p>
<p>As a result, I&#8217;ve spent a great deal of my time over the past few years helping these financial institutions find out for themselves which of their cards were breached at which merchants &#8212; pointing them to underground forums where &#8212; if they so choose &#8212; they could buy back a small number of cards and look to see if any of those had a commonality (known in financial industry parlance as a &#8220;common point of of purchase&#8221; or CPP).</p>
<p>I&#8217;ve never sought nor have I received remuneration for any of this assistance. However, one could say that this assistance has paid off in the form of tips about CPPs from various financial industry sources that &#8212; in the aggregate &#8212; strongly point to breaches at major retailers, hotels and other establishments where credit card transactions are plentiful and traditionally not terribly well protected.</p>
<p>But even financial institution fraud analysts who are adept at doing CPP analysis on cards for sale in the underground markets can be blind to the breach whose only commonality is a third-party provider &#8212; such as a credit card processor or a vendor that sells and maintains point-of-sale devices on behalf of other businesses.</p>
<p>Nine times out of ten, when a financial institution can&#8217;t figure out the source of a breach related to a batch of fraudulent credit card transactions, the culprit is one of these third-party POS providers. And in the vast majority of cases, a review of the suspect POS provider shows that they list every one of their customers somewhere on their site.</p>
<p>Unsurprisingly, Russian malware gangs that specialize in deploying POS-based malware to record and transmit card data from any card swiped through the cash register very often target POS providers because it is the easiest way into the cash registers at customer stores. Interview the individual store managers who operate compromised tills &#8212; as I have on more occasions that I care to count &#8212; and what you invariably find is that the malware got on their POS systems because an employee received an email mimicking the POS provider and clicked a booby-trapped link or attachment.</p>
<p>Alas, Workday was unmoved by my analysis of the situation.</p>
<p>“Spotlighting shared success with our customers helps our businesses grow, but security is Workday’s top priority,&#8221; the company said in a statement emailed to KrebsOnSecurity. &#8220;We are vigilant about identifying issues and consulting customers on best practices &#8212; such as deploying multi-factor authentication or conducting security awareness training for their employees– in order to continually help them sharpen security and protect their businesses.”</p>
<p>For his part, CXOTalk&#8217;s Krigsman said he was moved by the story about the POS providers.</p>
<p>&#8220;So the question becomes is this a strong enough threat that this is a trade off we should make,&#8221; Krigsman said. &#8220;You make a compelling argument: One the one hand, for marketing and customer convenience purposes companies want to put this all out there, but on other hand maybe it&#8217;s creating a bigger threat.&#8221;</p>
<p>I should note that regardless of whether a cloud or SaaS service publishes a list of companies they work with, those companies may themselves publish which SaaS providers they frequent. As Mark Stanislav of Rapid7 explained in Feb. 2015, it&#8217;s not uncommon for organizations to expose these relationships by including them in anti-spam records that get published to the entire world. See more of Stanislav&#8217;s research <a href="https://community.rapid7.com/community/infosec/blog/2015/02/23/osint-through-sender-policy-framework-spf-records" target="_blank">here</a>.</p>
<p>What do you think, Dear Readers? Where do you come down on the line between marketing and security? Sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=39440
title: Private Eye Allegedly Used Leaky Goverment Tool in Bid to Find Tax Data on Trump
uri: Private-Eye-Allegedly-Used-Leaky-Goverment-Tool-in-Bid-to-Find-Tax-Dat
url:
https://krebsonsecurity.com/2017/05/private-eye-allegedly-used-leaky-goverment-tool-in-bid-to-find-tax-data-on-trump/

content:
<p>In March 2017, KrebsOnSecurity warned that thieves who perpetrate tax refund fraud with the <strong>U.S. Internal Revenue Service</strong> were <a href="https://krebsonsecurity.com/2017/03/student-aid-tool-held-key-for-tax-fraudsters/" target="_blank">leveraging a widely-used online student loan tool</a> to find critical data on consumers that allows them to claim huge refunds with the IRS in someone else&#8217;s name. This week, it emerged that a Louisiana-based private investigator is being charged with using the same online tool to glean tax data on then-presidential candidate <strong>Donald J. Trump</strong>.</p>
<p>A <a href="http://diverseeducation.com/article/96795/?elqTrackId=b8872d7bafbd489b8f33cbb2f704da3b&amp;elq=0d411b9f358f46c9acf15f4c3e0d7348&amp;elqaid=14007&amp;elqat=1&amp;elqCampaignId=5855" target="_blank">story</a> today at <strong>Diverseeducation.com</strong> points to court filings in the <strong>U.S. District Court for the Middle District of Louisiana</strong>, in which local private eye <strong>Jordan Hamlet</strong>t is accused by federal prosecutors of abusing an automated tool at the U.S. Department of Education website that is designed to make it easier for families to complete the Education Department’s <a href="https://fafsa.ed.gov/" target="_blank">Free Application for Federal Student Aid</a> (FAFSA) — a lengthy form that serves as the starting point for students seeking federal financial assistance to pay for college or career school.</p>
<div id="attachment_39445" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39445" src="media/9354718a.agi-trump-580x753.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/agi-trump-580x753.png" alt="Grand jury findings in a sealed case against Louisiana private investigator Jordan Hamlett. " width="580" height="753" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/agi-trump-580x753.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/agi-trump-768x998.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/05/agi-trump.png 789w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Grand jury findings in a sealed case against Louisiana private investigator Jordan Hamlett.</p></div>
<p>In November 2016, Hamlett &#8212; the owner of Baton Rouge-based <strong>Averlock Investigations</strong> &#8212; was indicted on felony charges of trying to glean then President-Elect Trump&#8217;s &#8220;adjusted gross income,&#8221; or AGI, using the FAFSA online tool. In the United States, the AGI is an individual&#8217;s total gross income minus specific deductions. Diverse Education&#8217;s <strong>Jamaal Abdul-Alim</strong> cites sources saying the accused may have been trying to get Trump&#8217;s tax records.</p>
<p>In any event, he failed, according to prosecutors. Last month, the IRS announced that the Education Department was disabling the FAFSA lookup tool because it was being abused by tax fraudsters.</p>
<p>According to Diverse Education, hints about the case against Hamlett came out earlier this month in an IRS oversight hearing before the U.S. House committee on oversight and government reform. At that hearing, &#8220;<strong>Timothy P. Camus</strong>, deputy inspector general for investigations at the Treasury Inspector General for Tax Administration, or TIGTA, <a href="https://www.c-span.org/person/?timothycamus" target="_blank">alluded</a> to the Hamlett case but did not mention Hamlett by name, nor did he indicate that then-presidential candidate Trump was the target,&#8221; Abdul-Alim writes. &#8220;Instead, Camus only mentioned that TIGTA &#8216;detected an attempted access to the AGI of a prominent individual.'&#8221;</p>
<p>Attempts to reach Hamlett for comment have been unsuccessful so far, and the complaint against him remains sealed. However, KrebsOnSecurity obtained a response on Nov. 10, 2016 from <strong>U.S. Attorney J. Walter Green</strong> that lays out the basic facts in the case. A copy of that document is <a href="media/6f6f3fc0.Hamlett-response.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/05/Hamlett-response.pdf" target="_blank">here</a> (PDF).</p>
<p>It&#8217;s interesting to note that this wasn&#8217;t the only time U.S. government authorities detected someone trying to access Trump&#8217;s AGI information. According to the government&#8217;s response, the alleged unauthorized attempt at Trump&#8217;s AGI data being attributed to Hamlett occurred on Sept. 13, 2016.</p>
<p>In TIGTA Deputy Inspector General Camus&#8217; <a href="media/72d8faac.Camus-TIGTA-Statement-FAFSA-5-3.pdf" data-original-source="https://oversight.house.gov/wp-content/uploads/2017/05/Camus-TIGTA-Statement-FAFSA-5-3.pdf" target="_blank">testimony to the House committee</a> (PDF), he said his office detected a second attempt to access the same &#8220;prominent individual&#8217;s&#8221; AGI data via the FAFSA online lookup in November 2016, although the testimony doesn&#8217;t say whether that attempt was successful.</p>
<p>Amazingly, it wasn&#8217;t until an IRS employee on February 27, 2017 complained that his personal data was stolen via the FAFSA tool that the IRS moved to restrict online access to the service, according to <a href="https://oversight.house.gov/hearing/reviewing-fafsa-data-breach/" target="_blank">response to committee questioning</a> from <strong>IRS Chief Information Officer S. Gina Garza</strong>.<span id="more-39440"></span></p>
<p>The government doesn&#8217;t say in its pleadings why the accused was allegedly unsuccessful in obtaining President Trump&#8217;s AGI data. It could be that the Social Security number he had for Trump wasn&#8217;t correct; or, the account may have been flagged prior to the alleged attempt.</p>
<p>In any event, I want to take this opportunity to remind readers to assume that the static facts about who you are &#8212; including your income, date of birth, Social Security number, and a whole host of other information you may consider private &#8212; are likely at risk thanks to well-intentioned but nonetheless poorly secured third-party services that leak this data if the impersonator has but a few data points with which to work.</p>
<p>And of course these data points are for sale via a myriad places in the Dark Web for less than the Bitcoin equivalent of a regular coffee at Starbucks. On this front I&#8217;m reminded of <a href="https://krebsonsecurity.com/2014/03/who-built-the-id-theft-service-ssndob-ru/" target="_blank">the case of ssndob[dot]ru</a>, a now-defunct identity theft service that held this data on more than 200 million Americans.</p>
<p>That service was used to look up the name, address, previous address, phone number, Social Security number and date of birth <a href="https://krebsonsecurity.com/2013/04/swatting-incidents-tied-to-id-theft-sites/" target="_blank">on some of America&#8217;s top public figures and celebrities</a> &#8212; data that was later published on a doxing site called exposed[dot]su. The victims of exposed[dot]su included then <strong>First Lady Michelle Obama</strong>; then-director of the <strong>FBI Robert Mueller</strong>; an former <strong>U.S. Attorney General Eric Holder</strong>.</p>
<div id="attachment_25473" style="width: 610px" class="wp-caption aligncenter"><img class="size-large wp-image-25473" src="media/f2651763.exposed-su-600x462.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-600x462.png" alt="Exposed[dot]su was built with the help of identity information obtained and/or stolen from ssndob[dot]ru." width="600" height="462" srcset="http://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-285x219.png 285w, http://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su-600x462.png 600w, http://krebsonsecurity.com/wp-content/uploads/2014/03/exposed-su.png 1263w" sizes="(max-width: 600px) 100vw, 600px" /><p class="wp-caption-text">Exposed[dot]su was built with the help of identity information obtained and/or stolen from ssndob[dot]ru.</p></div>


feed_id: https://krebsonsecurity.com/?p=39307
title: MolinaHealthcare.com Exposed Patient Records
uri: MolinaHealthcare-com-Exposed-Patient-Records
url: https://krebsonsecurity.com/2017/05/molinahealthcare-com-exposed-patient-records/
content:
<p>Earlier this month, KrebsOnSecurity featured <a href="https://krebsonsecurity.com/2017/05/website-flaw-let-true-health-diagnostics-users-view-all-medical-records/" target="_blank">a story about a basic security flaw</a> in the Web site of medical diagnostics firm <strong>True Health Group</strong> that let anyone who was logged in to the site view all other patient records. In that story I mentioned True Health was one of three major healthcare providers with similar website problems, and that the other two providers didn&#8217;t even require a login to view all patient records. Today we&#8217;ll examine a flaw that was just fixed by <strong>Molina Healthcare</strong>, a Fortune 500 company that until recently was exposing countless patient medical claims to the entire Internet without requiring any authentication.</p>
<p><img class="alignright size-full wp-image-39478" src="media/9c30917c.molinalogo.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/molinalogo.png" alt="molinalogo" width="163" height="194" />In April 2017 I received an anonymous tip from a reader who said he&#8217;d figured out that just by changing a single number in the Web address when accessing his recent medical claim at MolinaHealthcare.com he could then view any and all other patient claims.</p>
<p>More alarmingly, the link he was given to access his claim with Molina was accessible to anyone who had the link; no authentication was required to view it. Nor was any authentication required to view any other records that could be accessed by fiddling with the numbers after the bit at the end of Molinahealthcare.com address (e.g., claimID=123456789).</p>
<p>In other words, having access to a single hyperlink to a patient record would allow an attacker to enumerate and download all other claims. The source showed me screenshots of his medical records at Molina, and how when he changed a single number in the URL it happily displayed another patient&#8217;s records.</p>
<p>The records did not appear to include Social Security numbers, but they do include patient names, addresses and dates of birth, as well as potentially sensitive information that may point to specific diseases, such as medical procedure codes and any prescribed medications.<span id="more-39307"></span></p>
<p>I contacted Molina about the issue, and the company released a brief statement saying it had fixed the problem. Molina also said it was trying to figure out how such a mistake was made, and if there was any evidence to suggest the Web site bug had been widely abused.</p>
<p>&#8220;The previously identified security issue has been remediated,&#8221; the company said. &#8220;Because protecting our members’ information is of utmost importance to Molina and out of an abundance of caution, we are taking our ePortal temporarily offline to perform additional testing of our system security. Molina has also engaged Mandiant to assist the company in continuing to strengthen our system security.&#8221;</p>
<p>The company declined to say how many records may have been exposed, but it looks like potentially all of them.</p>
<p>Headquartered in Long Beach, Calif., Molina Healthcare was ranked 201 in 2016 in the Fortune 500. It&#8217;s unconscionable that such a basic, Security 101 flaw could still exist at a major healthcare provider today. However, the more I write about these lame but otherwise very serious vulnerabilities at healthcare firms the more I hear about how common they are from individual readers.</p>
<p>Since <a href="https://krebsonsecurity.com/2017/05/website-flaw-let-true-health-diagnostics-users-view-all-medical-records/" target="_blank">that True Health Group story</a> was published, I&#8217;ve heard about and confirmed two very similar flaws at healthcare/insurance companies. Please keep the tips coming, Dear Readers, and I will do my best to encourage these companies to do more than just pay lip service to security.</p>


feed_id: https://krebsonsecurity.com/?p=39491
title: Trump’s Dumps: ‘Making Dumps Great Again’
uri: Trump-s-Dumps-Making-Dumps-Great-Again
url: https://krebsonsecurity.com/2017/05/trumps-dumps-making-dumps-great-again/
content:
<p>It&#8217;s not uncommon for crooks who peddle stolen credit cards to seize on iconic American figures of wealth and power in the digital advertisements for their shops that run incessantly on various cybercrime forums. Exhibit A: <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank">McDumpals</a>, a hugely popular carding site that borrows the Ronald McDonald character from McDonald&#8217;s and caters to bulk buyers. Exhibit B: <a href="https://krebsonsecurity.com/2016/05/carding-sites-turn-to-the-dark-cloud/" target="_blank">Uncle Sam&#8217;s</a> dumps shop, which wants YOU! to buy American. Today, we&#8217;ll look at an up-and-coming stolen credit card shop called <strong>Trump&#8217;s-Dumps</strong>, which invokes the 45th president&#8217;s likeness and promises to make credit card fraud great again.</p>
<p><img class="aligncenter size-medium wp-image-39492" src="media/52efd1b8.trumpsdumps-580x395.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png" alt="trumpsdumps" width="580" height="395" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-768x524.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-940x641.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps.png 1295w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>One reason thieves who sell stolen credit cards like to use popular American figures in their ads may be that a majority of their clients are people in the United States. Very often we&#8217;re talking about street gang members in the U.S. who use their purchased &#8220;dumps&#8221; &#8212; the data copied from the magnetic stripes of cards swiped through hacked point-of-sale systems &#8212; to make counterfeit copies of the cards. They then use the counterfeit cards in big-box stores to buy merchandise that they can easily resell for cash, such as gift cards, Apple devices and gaming systems.</p>
<p>When most of your clientele are street thugs based in the United States, it helps to leverage a brand strongly associated with America because you gain instant brand recognition with your customers. Also, a great many of these card shops are run by Russians and hosted at networks based in Russia, and the abuse of trademarks closely tied to the U.S. economy is a not-so-subtle &#8220;screw you&#8221; to American consumers.</p>
<p>In some cases, the guys running these card shops are openly hostile to the United States. Loyal readers will recall the stolen credit card shop &#8220;<a href="https://krebsonsecurity.com/?s=rescator&amp;x=0&amp;y=0" target="_blank">Rescator</a>&#8221; &#8212; which was the main source of cards stolen in the <a href="https://krebsonsecurity.com/?s=target+breach&amp;x=0&amp;y=0" target="_blank">Target</a>, <a href="https://krebsonsecurity.com/?s=home+depot+breach&amp;x=0&amp;y=0" target="_blank">Home Depot</a> and <a href="https://krebsonsecurity.com/?s=sally+beauty+breach&amp;x=0&amp;y=0" target="_blank">Sally Beauty</a> breaches (among others) &#8212; was tied to a Ukrainian man who authored a nationalistic, <a href="http://krebsonsecurity.com/2014/09/home-depot-hit-by-same-malware-as-target/" target="_blank">pro-Russian blog</a> which railed against the United States and called for the collapse of the American economy.</p>
<p>In <a href="https://krebsonsecurity.com/2015/05/deconstructing-the-2014-sally-beauty-breach/" target="_blank">deconstructing the 2014 breach at Sally Beauty</a>, I interviewed a former Sally Beauty corporate network administrator who said the customer credit cards being stolen with the help of card-stealing malware installed on Sally Beauty point-of-sale devices that phoned home to a domain called &#8220;anti-us-proxy-war[dot]com.&#8221;</p>
<p>Trump&#8217;s Dumps currently advertises more than 133,000 stolen credit and debit card dumps for sale. The prices range from just under $10 worth of Bitcoin to more than $40 in Bitcoin, depending on which bank issued the card, the cardholder&#8217;s geographic location, and whether the cards are tied to premium, prepaid, business or executive accounts.</p>
<div id="attachment_39495" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39495" src="media/92733b1c.trumdumpinside-580x412.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/trumdumpinside-580x412.png" alt="A &quot;state of the dumps&quot; address on Trump's-Dumps." width="580" height="412" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/trumdumpinside-580x412.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumdumpinside-768x546.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumdumpinside-940x668.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumdumpinside.png 1336w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A &#8220;state of the dumps&#8221; address on Trump&#8217;s-Dumps.</p></div>
<p><span id="more-39491"></span></p>
<p>Trump&#8217;s Dumps is currently hosted on a Russian server that caters to a handful of other high-profile carding shops, including the long-running &#8220;Fe-shop&#8221; and &#8220;Monopoly&#8221; dumps stores.</p>
<p>Sites like Trump&#8217;s Dumps can be taken offline &#8212; by forcing a domain name registrar to revoke the domain &#8212; but the people responsible for running this shop have already registered a slew of similar domains and no doubt have fresh <a href="https://krebsonsecurity.com/?s=bulletproof+hosting&amp;x=0&amp;y=0" target="_blank">bulletproof hosting</a> standing by in case their primary domain is somehow seized.</p>
<p>Also, like many other modern carding sites this one has versions of itself running on the Dark Web &#8212; sites that are only accessible using <a href="https://www.torproject.org/" target="_blank">Tor</a> and are far more difficult to force offline.</p>
<p>The home page of Trump&#8217;s Dumps takes some literary license with splices of President Trump&#8217;s inaugural address (see the above screenshot for the full text):</p>
<blockquote><p>&#8220;WE, THE CITIZENS OF DARK WEB, ARE NOW JOINED IN A GREAT NATIONAL EFFORT TO REBUILD OUR COMMUNITY AND RESTORE ITS PROMISE FOR ALL OF OUR PEOPLE.&#8221;</p>
<p>TOGETHER, WE WILL DETERMINE THE COURSE OF CARDING AND THE BLACKHAT COMMUNITY FOR MANY, MANY YEARS TO COME. WE WILL FACE CHALLENGES. WE WILL CONFRONT HARDSHIPS. BUT WE WILL GET THE JOB DONE.&#8221;</p></blockquote>
<p><strong>The U.S. Secret Service</strong>, which has the <a href="https://www.secretservice.gov/about/history/events/" target="_blank">dual role</a> of protecting the President and busting up counterfeiters (including credit card theft rings), declined to comment for this story.</p>
<h4>WHO RUNS TRUMP&#8217;S DUMPS?</h4>
<p>For now, I&#8217;m disinclined to believe much about <a href="http://webcache.googleusercontent.com/search?q=cache:3R9rJl0PG0EJ:psbdmp.com/iPD4updx+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank">a dox</a> supposedly listing the Trump&#8217;s Dumps administrator&#8217;s various contacts that was released by one of his competitors in the cybercrime underground. However, there are some interesting clues that tie Trump&#8217;s Dumps to a series of hacking attacks on e-commerce providers over the past year. Those clues suggest the criminals behind Trump&#8217;s Dumps are massively into stealing credit card data that fuels both card-present and online fraud.</p>
<p>In the &#8220;contacts&#8221; section of Trump&#8217;s Dumps the proprietors list three Jabber instant messenger IDs. All of them end in @trumplink[dot]su. That site is not currently active, but Web site registration records for the domain show it is tied to the email address &#8220;<strong>rudneva-y@mail.ua</strong>.&#8221;</p>
<p>A reverse WHOIS website registration record search ordered from <strong>domaintools.com</strong> [full disclosure: Domaintools is an advertiser on this blog] shows that this email address is associated with at least 15 other domains. Most of those domains appear to have been registered to look like legitimate Javascript calls that many e-commerce sites routinely make to process transactions, such as &#8220;js-link[dot]su,&#8221; &#8220;js-stat[dot]su,&#8221; and &#8220;js-mod[dot]su&#8221; (the full list is in <a href="media/0511c44b.rudnevadomains.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/05/rudnevadomains.pdf" target="_blank">this PDF</a>).</p>
<p>A Google search on those domains produces <a href="https://www.riskiq.com/blog/labs/magecart-keylogger-injection/" target="_blank">a report</a> from security firm <strong>RiskIQ</strong>, which explains how those domains featured prominently in a series of hacking campaigns against e-commerce websites dating back to March 2016. According to RiskIQ, the attacks targeted online stores running outdated and unpatched versions of shopping cart software from <strong>Magento</strong>, <strong>Powerfront</strong> and <strong>OpenCart</strong>.</p>
<p>These same domains showed up in an attack last October when it was revealed that hackers had <a href="https://krebsonsecurity.com/2016/10/hackers-hit-u-s-senate-gop-committee/" target="_blank">compromised the Web site</a> for the <strong>U.S. Senate GOP Senatorial Committee</strong>, among more than 5,900 other sites that accept credit cards. The intruders tinkered with the GOP Committee site&#8217;s HTML code to insert calls to domains like &#8220;jquery-cloud[dot]net&#8221; to hide the fact that they were stealing all credit card data that donors submitted via the Web site.</p>


feed_id: https://krebsonsecurity.com/?p=39550
title: Credit Card Breach at Kmart Stores. Again.
uri: Credit-Card-Breach-at-Kmart-Stores-Again
url: https://krebsonsecurity.com/2017/05/credit-card-breach-at-kmart-stores-again/
content:
<p>For the second time in less than three years, <strong>Kmart Stores</strong> is battling a malware-based security breach of its store credit card processing systems. <img class="aligncenter size-medium wp-image-39551" src="media/abad755a.kmart-580x333.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/kmart-580x333.png" alt="kmart" width="580" height="333" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/kmart-580x333.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/kmart.png 682w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Last week I began hearing from smaller banks and credit unions who said they strongly suspected another card breach at Kmart. Some of those institutions received alerts from the credit card companies about batches of stolen cards that all had one thing in comment: They were all used at Kmart locations.</p>
<p>Asked to respond to rumors about a card breach, Kmart&#8217;s parent company <strong>Sears Holdings</strong> said some of its payment systems were infected with malicious software:</p>
<blockquote><p>&#8220;We recently became aware that Sears Holdings was a victim of a security incident involving unauthorized credit card activity following certain customer purchases at some of our Kmart stores. We immediately launched a thorough investigation and engaged leading third party forensic experts to review our systems and secure the affected part of our network.&#8221;</p>
<p>&#8220;Our Kmart store payment data systems were infected with a form of malicious code that was undetectable by current anti-virus systems and application controls. Once aware of the new malicious code, we quickly removed it and contained the event. We are confident that our customers can safely use their credit and debit cards in our retail stores.&#8221;</p>
<p>Based on the forensic investigation, NO PERSONAL identifying information (including names, addresses, social security numbers, and email addresses) was obtained by those criminally responsible. However, we believe certain credit card numbers have been compromised. Nevertheless, in light of our EMV compliant point of sale systems, which rolled out last year, we believe the exposure to cardholder data that can be used to create counterfeit cards is limited. There is also <strong><u>no</u></strong> evidence that <a href="http://kmart.com/" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=http://kmart.com&amp;source=gmail&amp;ust=1496367440881000&amp;usg=AFQjCNEth4yO6_Kzp_O6yVo9uBnHfuUPzg">kmart.com</a> or Sears customers were impacted.&#8221;</p></blockquote>
<p>Sears spokesman <strong>Chris Brathwaite</strong> said the company is not commenting on how many of Kmart&#8217;s 735 locations nationwide may have been impacted or how long the breach is believed to have persisted, saying the investigation is ongoing.</p>
<p>&#8220;Given the criminal nature of this attack, Kmart is working closely with federal law enforcement authorities, our banking partners, and IT security firms in this ongoing investigation,&#8221; Sears Holdings said in its statement. &#8220;We are actively enhancing our defenses in light of this new form of malware. Data security is of critical importance to our company, and we continuously review and improve the safeguards that protect our data in response to changing technology and new threats.&#8221;</p>
<p>In October 2014, Sears <a href="https://krebsonsecurity.com/2014/10/malware-based-credit-card-breach-at-kmart/" target="_blank">announced a very similar breach</a> in which the company also stressed that the data stolen did not include customer names, email addresses or other personal information. <span id="more-39550"></span></p>
<p>Both breaches involved malware designed to steal credit and debit card data from hacked point-of-sale (POS) devices. The malware copies account data stored on the card&#8217;s magnetic stripe. Armed with that information, thieves can effectively clone the cards and use them to buy high-priced merchandise from electronics stores and big box retailers.</p>
<p>At least two financial industry sources told KrebsOnSecurity that the breach does not appear to be affecting all Kmart stores. Those same sources said that if the breach had hit all Kmart locations, they would expect to be seeing much bigger alerts from the credit card companies about accounts that are potentially compromised.</p>
<p>All Kmart stores in the United States now have credit card terminals capable of processing transactions from more secure chip-based cards. The chip essentially makes the cards far more difficult and expensive to counterfeit. But not all banks have issued customers chip-enabled cards yet, and thus this latest breach at Kmart likely impacts mainly Kmart customers who shopped at the store using non-chip enabled cards.</p>
<p><strong>Visa</strong> said in March 2017 there were more than 421 million Visa chip cards in the country, representing 58 percent of Visa cards. According to Visa, counterfeit fraud has been declining month over month &#8212; down 58 percent at chip-enabled merchants in December 2016 when compared to the previous year.</p>
<p>Sears also <a href="media/4b0d2479.01_PRIVILEGED20AND20CONFIDENTIAL20FAQ_FINAL.pdf" data-original-source="http://download.sears.com/perf/pdf/01_PRIVILEGED%20AND%20CONFIDENTIAL%20FAQ_FINAL.pdf" target="_blank">has released a FAQ</a> (PDF) that includes a bit more information about this breach disclosure.</p>


feed_id: https://krebsonsecurity.com/?p=39562
title: OneLogin: Breach Exposed Ability to Decrypt Data
uri: OneLogin-Breach-Exposed-Ability-to-Decrypt-Data
url: https://krebsonsecurity.com/2017/06/onelogin-breach-exposed-ability-to-decrypt-data/
content:
<p><strong>OneLogin</strong>, an online service that lets users manage logins to sites and apps from a single platform, says it has suffered a security breach in which customer data was compromised, including the ability to decrypt encrypted data.</p>
<p><img class="alignright size-full wp-image-39566" src="media/38754e69.onelogin.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/onelogin.png" alt="onelogin" width="232" height="287" />Headquartered in San Francisco, OneLogin provides single sign-on and identity management for cloud-base applications. OneLogin counts among its customers some 2,000 companies in 44 countries, over 300 app vendors and more than 70 software-as-a-service providers.</p>
<p>A breach that allowed intruders to decrypt customer data could be extremely damaging for affected customers. After OneLogin customers sign into their account, the service takes care of remembering and supplying the customer&#8217;s usernames and passwords for all of their other applications.</p>
<p>In <a href="https://www.onelogin.com/blog/may-31-2017-security-incident" target="_blank">a brief blog post</a> Wednesday, OneLogin chief information security officer <strong>Alvaro Hoyos</strong> wrote that the company detected unauthorized access to OneLogin data.</p>
<blockquote><p>&#8220;Today we detected unauthorized access to OneLogin data in our US data region. We have since blocked this unauthorized access, reported the matter to law enforcement, and are working with an independent security firm to determine how the unauthorized access happened and verify the extent of the impact of this incident. We want our customers to know that the trust they have placed in us is paramount.&#8221;</p>
<p>&#8220;While our investigation is still ongoing, we have already reached out to impacted customers with specific recommended remediation steps and are actively working to determine how best to prevent such an incident from occurring in the future and will update our customers as these improvements are implemented.&#8221;</p></blockquote>
<p>OneLogin&#8217;s blog post includes no other details, aside from a reference to the company&#8217;s <a href="https://www.onelogin.com/compliance" target="_blank">compliance page</a>. The company has not yet responded to request for comment. However, <em><a href="https://motherboard.vice.com/en_us/article/identity-manager-onelogin-has-suffered-a-nasty-looking-data-breach" target="_blank">Motherboard</a></em> has obtained a copy of a message OneLogin reportedly sent to its customers about the incident, and that missive contains a critical piece of information:</p>
<p>&#8220;Customer data was compromised, including the ability to decrypt encrypted data,&#8221; reads the message OneLogin sent to customers.</p>
<p>According to <em>Motherboard</em>, the message also directed customers to a list of required steps to minimize any damage from the breach, such as generating new API keys and OAuth tokens (OAuth being a system for logging into accounts), creating new security certificates as well as credentials; recycling any secrets stored in OneLogin&#8217;s Secure Notes feature; and having end-users update their passwords.</p>
<p><strong>Gartner Inc.</strong> financial fraud analyst <a href="https://www.gartner.com/analyst/12030/Avivah-Litan" target="_blank">Avivah Litan</a> said she has long discouraged companies from using cloud-based single sign-on services, arguing that they are the digital equivalent to an organization putting all of its eggs in one basket.</p>
<p>&#8220;It&#8217;s just such a massive single point of failure,&#8221; Litan said. &#8220;And this breach shows that other [cloud-based single sign-on] services are vulnerable, too. This is a big deal and it&#8217;s disruptive for victim customers, because they have to now change the inner guts of their authentication systems and there&#8217;s a lot of employee inconvenience while that&#8217;s going on.&#8221;</p>
<p>KrebsOnSecurity will likely update this story throughout the day as more details become available.</p>


feed_id: https://krebsonsecurity.com/?p=39560
title: Following the Money Hobbled vDOS Attack-for-Hire Service
uri: Following-the-Money-Hobbled-vDOS-Attack-for-Hire-Service
url: https://krebsonsecurity.com/2017/06/following-the-money-hobbled-vdos-attack-for-hire-service/
content:
<p>A new report proves the value of following the money in the fight against dodgy cybercrime services known as &#8220;booters&#8221; or &#8220;stressers&#8221; &#8212; virtual hired muscle that can be rented to knock nearly any website offline.</p>
<p>Last fall, two 18-year-old Israeli men <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">were arrested</a> for allegedly running <strong>vDOS</strong>, perhaps the most successful booter service of all time. The young men were detained within hours of being <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">named in a story on this blog</a> as the co-proprietors of the service (KrebsOnSecurity.com would later <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">suffer a three-day outage</a> as a result of <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank">an attack</a> that was <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank">alleged to have been purchased in retribution</a> for my reporting on vDOS).</p>
<div id="attachment_36219" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-36219" src="media/fa2da85d.vdoshome-580x379.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-580x379.png" alt="The vDos home page." width="580" height="379" srcset="http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-580x379.png 580w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-768x502.png 768w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome-940x615.png 940w, http://krebsonsecurity.com/wp-content/uploads/2016/09/vdoshome.png 1191w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The vDos home page.</p></div>
<p>That initial vDOS story was based on data shared by an anonymous source who had hacked vDOS and obtained its private user and attack database. The story showed how the service made approximately $600,000 over just two of the four years it was in operation. Most of those profits came in the form of credit card payments via <strong>PayPal</strong>.</p>
<p>But prior to vDOS&#8217;s takedown in September 2016, the service was already under siege thanks to work done by a group of academic researchers who teamed up with PayPal to identify and close accounts that vDOS and other booter services were using to process customer payments. The researchers found that their interventions cut profits in half for the popular booter service, and helped reduce the number of attacks coming out of it by at least 40 percent.</p>
<p>At the height of vDOS&#8217;s profitability in mid-2015, the DDoS-for-hire service <em>was earning its proprietors more than $42,000 a month</em> in PayPal and Bitcoin payments from thousands of subscribers. That&#8217;s according to an analysis of the leaked vDOS database performed by researchers at <strong>New York University</strong>.</p>
<p>As detailed in August 2015&#8217;s &#8220;<a href="http://krebsonsecurity.com/2015/08/stress-testing-the-booter-services-financially/" target="_blank">Stress-Testing the Booter Services, Financially</a>,&#8221; the researchers posed as buyers of nearly two dozen booter services &#8212; including vDOS &#8212;  in a bid to discover the PayPal accounts that booter services were using to accept payments. In response to their investigations, PayPal began seizing booter service PayPal accounts and balances, effectively launching their own preemptive denial-of-service attacks against the payment infrastructure for these services.</p>
<p>Those tactics worked, according to a paper the NYU researchers <a href="media/29453c87.vdos.pdf" data-original-source="http://damonmccoy.com/papers/vdos.pdf" target="_blank">published today</a> (PDF) at the <a href="http://weis2017.econinfosec.org/program/" target="_blank">Weis 2017 workshop</a> at the University of California, San Diego.</p>
<p>&#8220;We find that VDoS’s revenue was increasing and peaked at over $42,000/month for the month before the start of PayPal’s payment intervention and then started declining to just over $20,000/month for the last full month of revenue,&#8221; the paper notes.</p>
<p><img class="aligncenter size-full wp-image-39599" src="media/59d4ab00.subscribers.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/subscribers.png" alt="subscribers" width="485" height="295" />The NYU researchers found that vDOS had extremely low costs, and virtually all of its business was profit. Customers would pay up front for a subscription to the service, which was sold in booter packages priced from $5 to $300. The prices were based partly on the overall number of seconds that an attack may last (e.g., an hour would be 3,600 worth of attack seconds).</p>
<p>In just two of its four year in operation vDOS was responsible for launching 915,000 DDoS attacks, the paper notes. In adding up all the attack seconds from those 915,000 DDoS attacks, the researchers found vDOS was responsible for 48 &#8220;attack years&#8221; &#8212; the total amount of DDoS time faced by the victims of vDOS.<span id="more-39560"></span></p>
<p>&#8220;As VDoS’s revenue and active subscriber base dwindled, so did the amount of harmful DDoS attacks launched by VDoS,&#8221; the NYU researchers wrote. &#8220;The peak attack time we found was slightly under 100,000 attacks and 5 attack years per month when VDoS’s revenue was slightly over $30,000/month. This decreased to slightly under 60,000 attacks and 3 attack years during the last month for which we have attack data. Unfortunately, we have incomplete attack data and likely missed the peak of VDoS’s attack volume. However, the payment intervention correlates to a 40% decrease in attack volume, which equates to 40,000 fewer attacks and 2 fewer attack years per month.&#8221;</p>
<p>Although a small percentage of vDOS customers shifted paying for their monthly subscriptions to Bitcoin after their preferred PayPal methods were no longer available, the researchers found that most customers who relied on PayPal simply went away and never came back.</p>
<p>&#8220;Near the middle of August 2015, the payment intervention that limited vDOS’s ability to accept PayPal payments began to take its toll on vDOS,&#8221; the researchers wrote. &#8220;Disrupting vDOS’s PayPal payment channel had a noticeable effect on both recurring and new revenue. By August 2015, payments from the PayPal channel decreased by $12,458 (44%) from an average of $28,523 over the previous five months. The Bitcoin payment channel increased by $6,360 (71%), but did not fully compensate for lost revenue from PayPal.&#8221;</p>
<p>The next month, vDOS established a number of ad-hoc payment methods, such as other third-party payment processors that accept credit card payments. However, most of these methods were short lived, likely due to the payment processors learning about the nature of their illicit DDoS service and terminating their accounts, the researchers observed.</p>
<p>&#8220;The revenue from these other regulated payment channels dwindled over a ten month period from $18,167 in September 2015 to $1,700 during June 2016,&#8221; the NYU team wrote. &#8220;The last month of the database leak in July 2016 shows no other forms payments other than Bitcoin.&#8221;</p>
<p>Other developments since vDOS&#8217;s demise in September 2016 have conspired to deal a series of body blows to the booter service industry. In October 2016, <strong>Hackforums</strong> &#8212; until recently the most bustling marketplace on the Internet where people could compare and purchase booter services &#8212; <a href="https://krebsonsecurity.com/2016/10/hackforums-shutters-booter-service-bazaar/" target="_blank">announced it was permanently banning</a> the sale and advertising of these services on the forum.</p>
<p>In December 2016, authorities in the United States and Europe <a href="https://krebsonsecurity.com/2016/12/operation-tarpit-targets-customers-of-online-attack-for-hire-services/" target="_blank">arrested nearly three-dozen people</a> suspected of patronizing booter services. The enforcement action was a stated attempt by authorities to communicate to the public that people can go to jail for hiring booter services.</p>
<p>In April 2017, a U.K. man who ran a booter service that delivered some 1.7 million denial-of-service attacks against victims worldwide was <a href="https://krebsonsecurity.com/2017/04/uk-man-gets-two-years-in-jail-for-running-titanium-stresser-attack-for-hire-service/" target="_blank">sentenced to two years in prison</a>.</p>
<p>Prosecutors in Israel say they are <a href="https://krebsonsecurity.com/2017/03/alleged-vdos-owners-poised-to-stand-trial/" target="_blank">preparing formal charges</a> against the two young Israeli men arrested last year on suspicion of running vDOS.</p>
<p>Check out the full NYU paper <a href="media/29453c87.vdos.pdf" data-original-source="http://damonmccoy.com/papers/vdos.pdf" target="_blank">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=39637
title: Microsoft, Adobe Ship Critical Fixes
uri: Microsoft-Adobe-Ship-Critical-Fixes
url: https://krebsonsecurity.com/2017/06/microsoft-adobe-ship-critical-fixes/
content:
<p><strong>Microsoft</strong> today released security updates to fix almost a hundred security flaws in its various <strong>Windows</strong> operating systems and related software. One bug is so serious that Microsoft is issuing patches for it on <strong>Windows XP</strong> and other operating systems the company no longer officially supports. Separately, <strong>Adobe</strong> has pushed critical updates for its <strong>Flash</strong> and <strong>Shockwave</strong> players, two programs most users would probably be better off without.</p>
<p><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" />According to security firm <a href="https://blog.qualys.com/laws-of-vulnerabilities/2017/06/13/microsoft-fixes-94-security-issues-in-massive-june-update" target="_blank">Qualys</a>, 27 of the 94 security holes Microsoft patches with today&#8217;s release can be exploited remotely by malware or miscreants to seize complete control over vulnerable systems with little or no interaction on the part of the user.</p>
<p>Microsoft this month is fixing <a href="http://CVE-2017-8543" target="_blank">another serious flaw</a> (CVE-2017-8543) present in most versions of Windows that resides in the feature of the operating system which handles file and printer sharing (also known as &#8220;<a href="https://en.wikipedia.org/wiki/Server_Message_Block" target="_blank">Server Message Block</a>&#8221; or the SMB service).</p>
<p>SMB vulnerabilities can be extremely dangerous if left unpatched on a local (internal) corporate network. That&#8217;s because a single piece of malware that exploits this SMB flaw within a network could be used to replicate itself to all vulnerable systems very quickly.</p>
<p>It is this very &#8220;wormlike&#8221; capability &#8212; a flaw in Microsoft&#8217;s SMB service &#8212; that was harnessed for spreading by <a href="https://krebsonsecurity.com/?s=wannacry&amp;x=0&amp;y=0" target="_blank">WannaCry</a>, the global ransomware contagion last month that held files for ransom at countless organizations and <a href="https://krebsonsecurity.com/2017/05/u-k-hospitals-hit-in-widespread-ransomware-attack/" target="_blank">shut down at least 16 hospitals</a> in the United Kingdom.</p>
<p>According to Microsoft, this newer SMB flaw is already being exploited in the wild. The vulnerability affects <strong>Windows Server 2016</strong>, <strong>2012</strong>, <strong>2008</strong> as well as desktop systems like <strong>Windows 10</strong>, <strong>7</strong> and <strong>8.1</strong>.</p>
<p>The SMB flaw &#8212; like the one that WannaCry leveraged &#8212; also affects older, unsupported versions of Windows such as <strong>Windows XP</strong> and <strong>Windows Server 2003</strong>. And, as with that SMB flaw, Microsoft has made the unusual decision to make fixes for this newer SMB bug available for those older versions. Users running XP or Server 2003 can get the update for this flaw <a href="https://support.microsoft.com/en-us/help/4025687/microsoft-security-advisory-4025685-guidance-for-older-platforms" target="_blank">here</a>.</p>
<p>&#8220;Our decision today to release these security updates for platforms not in extended support should not be viewed as a departure from our standard servicing policies,&#8221; <a href="https://blogs.technet.microsoft.com/msrc/2017/06/13/june-2017-security-update-release/" target="_blank">wrote</a> <strong>Eric Doerr</strong>, general manager of Microsoft&#8217;s Security Response Center.</p>
<p>&#8220;Based on an assessment of the current threat landscape by our security engineers, we made the decision to make updates available more broadly,&#8221; Doerr wrote. &#8220;As always, we recommend customers upgrade to the latest platforms. &#8220;The best protection is to be on a modern, up-to-date system that incorporates the latest defense-in-depth innovations. Older systems, even if fully up-to-date, lack the latest security features and advancements.&#8221;</p>
<p>The default browsers on Windows &#8212; <strong>Internet Explorer</strong> or <strong>Edge</strong> &#8212; get their usual slew of updates this month for many of these critical, remotely exploitable bugs. Qualys says organizations using <strong>Microsoft Outlook</strong> should pay special attention to a newly patched bug in the popular mail program because attackers can send malicious email and take complete control over the recipient&#8217;s Windows machine when users merely view a specially crafted email in Outlook.<span id="more-39637"></span></p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />Separately, Adobe has issued updates to fix critical security problems with both its <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-17.html" target="_blank">Flash Player</a> and <a href="https://helpx.adobe.com/security/products/shockwave/apsb17-18.html" target="_blank">Shockwave Player</a>. If you have Shockwave installed, please consider removing it now.</p>
<p>For starters, hardly any sites require this plugin to view content. More importantly, Adobe has a history of patching Shockwave&#8217;s built-in version of Flash several versions behind the stand-alone Flash plugin version. As a result Shockwave has been a high security risk to have installed for many years now. For more on this trend, see <a href="https://krebsonsecurity.com/2014/05/why-you-should-ditch-adobe-shockwave/" target="_blank">Why You Should Ditch Adobe Shockwave</a>.</p>
<p>Same goes for Adobe Flash Player, which probably most users can get by with these days just enabling it in the rare instance that it&#8217;s required. I recommend for users who have an affirmative need for Flash to leave it disabled until that need arises. Otherwise, get rid of it.</p>
<p>Adobe patches dangerous new Flash flaws all the time, and Flash bugs are still the most frequently exploited by exploit kits &#8212; malware booby traps that get stitched into the fabric of hacked and malicious Web sites so that visiting browsers running vulnerable versions of Flash get automatically seeded with malware.</p>
<p>For some ideas about how to hobble or do without Flash (as well as slightly less radical solutions) check out <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to keep Flash, please update it today to version <em>26.0.0.126.</em> The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version). Chrome users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then.</p>
<p>As always, if you experience any issues downloading or installing any of these updates, please leave a note about it in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=39218
title: Inside a Porn-Pimping Spam Botnet
uri: Inside-a-Porn-Pimping-Spam-Botnet
url: https://krebsonsecurity.com/2017/06/inside-a-porn-pimping-spam-botnet/
content:
<p>For several months I&#8217;ve been poking at a decent-sized spam botnet that appears to be used mainly for promoting adult dating sites. Having hit a wall in my research, I decided it might be good to publish what I&#8217;ve unearthed so far to see if this dovetails with any other research out there.</p>
<p>In late October 2016, an anonymous source shared with KrebsOnSecurity.com a list of nearly 100 URLs that &#8212; when loaded into a Firefox browser &#8212; each displayed what appeared to be a crude but otherwise effective text-based panel designed to report in real time how many &#8220;bots&#8221; were reporting in for duty.</p>
<p><a href="http://imgur.com/a/IEhmX" target="_blank">Here&#8217;s a set of archived screenshots</a> of those counters illustrating how these various botnet controllers keep a running tab of how many &#8220;activebots&#8221; &#8212; hacked servers set up to relay spam &#8212; are sitting idly by and waiting for instructions.</p>
<div id="attachment_39543" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/31fa1644.pornspambotnetpanel.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/pornspambotnetpanel.png"><img class="wp-image-39543 size-medium" src="media/8291329c.pornspambotnetpanel-580x210.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/pornspambotnetpanel-580x210.png" alt=" " width="580" height="200" /></a><p class="wp-caption-text">One of the more than 100 panels linked to the same porn spamming operation. In October 2016, these 100 panels reported a total of 1.2 million active bots operating simultaneously.</p></div>
<p>At the time, it was unclear to me how this apparent botnet was being used, and since then the total number of bots reporting in each day has shrunk considerably. During the week the above-linked screen shots were taken, this botnet had more than 1.2 million zombie machines or servers reporting each day (that screen shot archive includes roughly half of the panels found). These days, the total number of servers reporting in to this spam network fluctuates between 50,000 and 100,000.</p>
<p>Thanks to a tip from an anti-spam activist who asked not to be named, I was able to see that the botnet appears to be busy promoting a seemingly endless network of adult dating Web sites connected to just two companies: <strong>CyberErotica</strong>, and <strong>Deniro Marketing LLC</strong> (a.k.a. <strong>AmateurMatch</strong>).</p>
<p>As affiliate marketing programs go, CyberErotica stretches way back &#8212; perhaps to the beginning. According to <a href="https://techcrunch.com/2009/11/15/twitter-facebook-amazon-affiliate-marketing/" target="_blank">TechCrunch</a>, CyberErotica is said to have launched the first online affiliate marketing firm in 1994.</p>
<p>In 2001, CyberErotica&#8217;s parent firm <strong>Voice Media</strong> <a href="https://www.ftc.gov/sites/default/files/documents/cases/2001/04/ftc.gov-voicemediaagree.htm" target="_blank">settled</a> a lawsuit with the U.S. Federal Trade Commission, which <a href="https://www.ftc.gov/sites/default/files/documents/cases/2001/05/ftc.gov-voicemediacmp.htm" target="_blank">alleged</a> that the adult affiliate program was misrepresenting its service as free while it dinged subscribers for monthly charges and made it difficult for them to cancel.</p>
<p>In 2010, Deniro Marketing found itself the subject of <a href="https://www.courtlistener.com/docket/4177501/badella-v-deniro-marketing-llc/" target="_blank">a class-action lawsuit</a> that alleged the company employed spammers to promote an online dating service that was overrun with automated, fake profiles of young women. Those allegations ended in an undisclosed settlement after the judge in the case tossed out the spamming claim because the statute of limitations on those charges had expired.</p>
<p>What&#8217;s unusual (and somewhat lame) about this botnet is that &#8212; through a variety of botnet reporting panels that are still displaying data &#8212; we can get live, real-time updates about the size and status of this crime machine. No authentication or credentials needed. So much for operational security!</p>
<p>The &#8220;mind map&#8221; pictured below contains enough information for nearly anyone to duplicate this research, and includes the full Web address of the botnet reporting panels that are currently online and responding with live updates. I was unable to load these panels in a <strong>Google Chrome browser</strong> (perhaps the XML data on the page is missing some key components), but they loaded fine in <strong>Mozilla Firefox</strong>.</p>
<p>But a note of caution: I&#8217;d strongly encourage anyone interested in following my research to take care before visiting these panels, preferably doing so from a disposable &#8220;virtual&#8221; machine that runs something other than Microsoft Windows.</p>
<p>That&#8217;s because spammers are usually involved in the distribution of malicious software, and spammers who maintain vast networks of apparently compromised systems are almost always involved in creating or at least commissioning the creation of said malware. Worse, porn spammers are some of the lowest of the low, so it&#8217;s only prudent to behave as if any and all of their online assets are actively hostile or malicious.</p>
<div id="attachment_39624" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/ccc1bc44.pornspammerbotnet.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/pornspammerbotnet.png"><img class="wp-image-39624 size-medium" src="media/ccc1bc44.pornspammerbotnet.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/pornspammerbotnet.png" alt=" " width="580" height="400" /></a><p class="wp-caption-text">A &#8220;mind map&#8221; tracing some of the research mentioned in this post.</p></div>
<p><span id="more-39218"></span></p>
<h4>FOLLOW THE HONEY</h4>
<p>So how did KrebsOnSecurity tie the spam that was sent to promote these two adult dating schemes to the network of spam botnet panels that I mentioned at the outset of this post? I should say it helped immensely that one anti-spam source maintains a comprehensive, historic collection of spam samples, and that this source shared more than a half dozen related spam samples. <a href="https://discard.email/en/pillory/are-you-down-for-right-now_6195256463724369996-2b08af7a39cc3a605378cb7af75d9570.htm" target="_blank">Here&#8217;s one of them</a>.</p>
<p>All of those spams had similar information included in their &#8220;headers&#8221; &#8212; the metadata that accompanies all email messages.</p>
<p>Received: from minitanth.info-88.top (037008194168.suwalki.vectranet.pl [37.8.194.168])<br />
Received: from exundancyc.megabulkmessage225.com (109241011223.slupsk.vectranet.pl [109.241.11.223])<br />
Received: from disfrockinga.message-49.top (unknown [78.88.215.251])<br />
Received: from offenders.megabulkmessage223.com (088156021226.olsztyn.vectranet.pl [88.156.21.226])<br />
Received: from snaileaterl.inboxmsg-228.top (109241018033.lask.vectranet.pl [109.241.18.33])<br />
Received: from soapberryl.inboxmsg-242.top (037008209142.suwalki.vectranet.pl [37.8.209.142])<br />
Received: from dicrostonyxc.inboxmsg-230.top (088156042129.olsztyn.vectranet.pl [88.156.42.129])</p>
<p>To learn more about what information you can glean from email headers, see <a href="https://www.howtogeek.com/108205/htg-explains-what-can-you-find-in-an-email-header/" target="_blank">this post</a>. But for now, here&#8217;s a crash course for our purposes. The so-called &#8220;fully qualified domain names&#8221; or FQDNs in the list above can be found just to the right of the open parentheses in each line.</p>
<p>When this information is present in the headers (and not simply listed as &#8220;unknown&#8221;) it is the fully-verified, real name of the machine that sent the message (at least as far as the domain name system is concerned). The dotted address to the right in brackets on each line is the numeric Internet address of the actual machine that sent the message.</p>
<p>The information to the left of the open parentheses is called the &#8220;HELO/EHLO string,&#8221; and an email server administrator can set this information to display whatever he wants: It could be set to bush[dot]whitehouse[dot]gov. Happily, in this case the spammer seems to have been consistent in the naming convention used to identify the sending domains and subdomains.</p>
<p>Back in October 2016 (when these spam messages were sent) the FQDN &#8220;minitanth.info-88[dot]top&#8221; resolved to a specific IP address: 37.8.194.168. Using passive DNS tools from <a href="https://www.dnsdb.info" target="_blank">Farsight Security</a> &#8212; which keeps a historic record of which domain names map to which IP addresses &#8212; I was able to find that the spammer who set up the domain info-88[dot]top had associated the domain with hundreds of third-level subdomains (e.g. minithanth.info-88[dot]top, achoretsq.info-88[dot]top, etc.).</p>
<p>It was also clear that this spammer controlled a great many top-level domain names, and that he had countless third-level subdomains assigned to every domain name. This type of spamming is known as &#8220;snowshoe&#8221; spamming.</p>
<p>Like a snowshoe spreads the load of a traveler across a wide area of snow, snowshoe spamming is a technique used by spammers to spread spam output across many IPs and domains, in order to dilute reputation metrics and evade filters,&#8221; writes anti-spam group <strong>Spamhaus</strong> in its useful <a href="https://www.spamhaus.org/faq/section/Glossary#233" target="_blank">spam glossary</a>.</p>
<p><H4>WORKING BACKWARDS</H4></p>
<p>So, armed with all of that information, it took just one or two short steps to locate the IP addresses of the corresponding botnet reporting panels. Quite simply, one does DNS lookups to find the names of the name servers that were providing DNS service for each of this spammer&#8217;s second-level domains.</p>
<p>Once one has all of the name server names, one simply does yet more DNS lookups &#8212; one for each of the name server names &#8212; in order to get the corresponding IP address for each one.</p>
<p>With that list of IP addresses in hand, a trusted source volunteered to perform a series of scans on the addresses using &#8220;<a href="https://nmap.org/" target="_blank">Nmap</a>,&#8221; a powerful and free tool that can map out any individual virtual doorways or &#8220;ports&#8221; that are open on targeted systems. In this case, an Nmap scan against that list of IPs showed they were all listening for incoming connections on Port 10001.</p>
<p>From there, I took the IP address list and plugged each address individually into the URL field of a browser window in Mozilla Firefox, and then added &#8220;:10001&#8221; to the end of the address. After that, each address happily loaded a Web page displaying the number of bots connecting to each IP address at any given time.</p>
<p>Here&#8217;s the output of one controller that&#8217;s currently getting pinged by more than 12,000 systems configured to relay porn spam (the relevant part is the first bit on the second line below &#8212; &#8220;current activebots=&#8221;). Currently, the entire botnet (counting the active bots from all working bot panels) seems to hover around 80,000 systems.</p>
<p><img class="aligncenter size-medium wp-image-39547" src="media/8ee4f5a8.pornbotpanel-580x183.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/pornbotpanel-580x183.png" alt="pornbotpanel" width="580" height="183" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/pornbotpanel-580x183.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/pornbotpanel-768x243.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/05/pornbotpanel-940x297.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/05/pornbotpanel.png 946w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>At the time, the spam being relayed through these systems was advertising sites that tried to get visitors to sign up for online chat and dating sites apparently affiliated with Deniro Marketing and CyberErotica.</p>
<p>Seeking more information, I began searching the Web for information about CyberErotica&#8217;s affiliate offerings and I found that the affiliate program&#8217;s marketing division is run by a guy who uses the email address <strong>scott@cecash.com</strong>.</p>
<p>A Google search quickly reveals that scott@cecash.com also advertises he can be reached using the <a href="https://icq.com/" target="_blank">ICQ</a> instant messenger address of <strong>55687349</strong>. I checked icq.com&#8217;s member lookup page, and found the name attached to <a href="https://icq.com/people/556878349" target="_blank">ICQ# 55687349</a> is &#8220;Scott Philips.&#8221;</p>
<p>Mr. Philips didn&#8217;t return messages seeking comment. But I couldn&#8217;t help wonder about the similarity between that name and a convicted Australian porn spammer named Scott Phillips (NB: two &#8220;l&#8217;s in Phillips).</p>
<p>In 2010, <strong>Scott Gregory Phillips</strong> was <a href="http://www.smh.com.au/technology/technology-news/internet-porn-king-fined-2m-20101201-18gbu.html" target="_blank">fined AUD $2 million</a> for running a business that employed people to create fake profiles on dating websites in a bid to obtain the mobile phone numbers of dating website users. Phillips&#8217; operation then sent SMS texts such as &#8220;get laid, text your number to&#8230;&#8221;, and then charged $5 on the mobile accounts of people who replied.</p>
<p>Phillips&#8217; <a href="https://www.facebook.com/scottphillipstrading/" target="_blank">Facebook page</a> and <a href="https://www.quora.com/profile/Scott-Phillips-55#" target="_blank">Quora profile</a> would have us believe he has turned his life around and is now making a living through day trading. Reached via email, Phillips said he is a loyal reader who long ago quit the spam business.</p>
<p>&#8220;I haven&#8217;t been in the spam business since 2002 or so,&#8221; Phillips said. &#8220;I did some SMS spam in 2005, got about 18 million bucks worth of fines for it, and went straight.&#8221;</p>
<p>Phillips says he builds &#8220;automated commodity trading systems&#8221; now, and that virtually all modern spam is botnet-based.</p>
<p>&#8220;As far as I know the spam industry is 100% botnet these days, and not a viable proposition for adult sites,&#8221; he told KrebsOnSecurity.</p>
<p>Well, it&#8217;s certainly a viable proposition for some spammer. The most frustrating aspect of this research is that &#8212; in spite of the virtually non-existent operational security employed by whoever built this particular crime machine, I still have no real data on how the botnet is being built, what type of malicious software may be involved, or who&#8217;s responsible.</p>
<p>If anyone has additional research or information on this botnet, please don&#8217;t hesitate to leave a comment below or <a href="https://krebsonsecurity.com/about/" target="_blank">get in touch with me directly</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39657
title: Credit Card Breach at Buckle Stores
uri: Credit-Card-Breach-at-Buckle-Stores
url: https://krebsonsecurity.com/2017/06/credit-card-breach-at-buckle-stores/
content:
<p><strong>The Buckle Inc.</strong>, a clothier that operates more than 450 stores in 44 U.S. states, disclosed Friday that its retail locations were hit by malicious software designed to steal customer credit card data. The disclosure came hours after KrebsOnSecurity contacted the company regarding reports from sources in the financial sector about a possible breach at the retailer.</p>
<p><img class="aligncenter size-full wp-image-39662" src="media/3097bb31.buckle.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/buckle.png" alt="buckle" width="397" height="329" /></p>
<p>On Friday morning, KrebsOnSecurity contacted The Buckle after receiving multiple tips from sources in the financial industry about a pattern of fraud on customer credit and debit cards which suggested a breach of point-of-sale systems at Buckle stores across the country.</p>
<p>Later Friday evening, The Buckle Inc. released <a href="https://corporate.buckle.com/about/data-security-incident" target="_blank">a statement</a> saying that point-of-sale malware was indeed found installed on cash registers at Buckle retail stores, and that the company believes the malware was stealing customer credit card data between Oct. 28, 2016 and April 14, 2017. The Buckle said purchases made on its online store were not affected.</p>
<p>As with the <a href="https://krebsonsecurity.com/2017/05/credit-card-breach-at-kmart-stores-again/" target="_blank">recent POS-malware based breach at Kmart</a>, The Buckle said all of its stores are equipped with EMV-capable card terminals, meaning the point-of-sale machines can accommodate newer, more secure chip-based credit and debit cards. The malware copies account data stored on the card’s magnetic stripe. Armed with that information, thieves can clone the cards and use them to buy high-priced merchandise from electronics stores and big box retailers.<span id="more-39657"></span></p>
<p>The trouble is that <a href="https://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">not all banks have issued chip-enabled cards</a>, which are far more expensive and difficult for thieves to counterfeit. Customers who shopped at compromised Buckle stores using a chip-based card would not be in danger of having their cards cloned and used elsewhere, but the stolen card data could still be used for e-commerce fraud.</p>
<p><strong>Visa</strong> said in March 2017 there were more than 421 million Visa chip cards in the country, representing 58 percent of Visa cards. According to Visa, counterfeit fraud has been declining month over month — down 58 percent at chip-enabled merchants in December 2016 when compared to the previous year.</p>
<p>The United States is the last of the G20 nations to make the shift to chip-based cards. Visa has said it typically took about three years after the liability shifts in other countries before 90% of payment card transactions were “chip-on-chip,” or generated by a chip card used at a chip-based terminal.</p>
<p>Virtually every other country that has made the jump to chip-based cards saw fraud trends shifting from card-present to card-not-present (online, phone) fraud as it became more difficult for thieves to counterfeit physical credit cards. Data collected by consumer credit bureau <strong>Experian</strong> <a href="http://www.experian.com/blogs/insights/2017/03/e-commerce-fraud-rates-spike-in-2016/" target="_blank">suggests</a> that e-commerce fraud increased 33 percent last year over 2015.</p>


feed_id: https://krebsonsecurity.com/?p=39608
title: Why So Many Top Hackers Hail from Russia
uri: Why-So-Many-Top-Hackers-Hail-from-Russia
url: https://krebsonsecurity.com/2017/06/why-so-many-top-hackers-hail-from-russia/
content:
<p>Conventional wisdom says one reason so many hackers seem to hail from Russia and parts of the former Soviet Union is that these countries have traditionally placed a much greater emphasis than educational institutions in the West on teaching information technology in middle and high schools, and yet they lack a Silicon Valley-like pipeline to help talented IT experts channel their skills into high-paying jobs. This post examines the first part of that assumption by examining a breadth of open-source data.</p>
<p>The supply side of that conventional wisdom seems to be supported by an analysis of educational data from both the U.S. and Russia, which indicates there are several stark and important differences between how American students are taught and tested on IT subjects versus their counterparts in Eastern Europe.</p>
<p><img class="aligncenter size-medium wp-image-39684" src="media/a174b440.computered-580x389.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/computered-580x389.png" alt="computered" width="580" height="389" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/computered-580x389.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/computered-768x514.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/06/computered-940x630.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/06/computered.png 1551w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Compared to the United States there are quite a few more high school students in Russia who choose to specialize in information technology subjects. One way to measure this is to look at the number of high school students in the two countries who opt to take the advanced placement exam for computer science.</p>
<p>According to <a href="media/411013e6.2015-Exam-Volume-Change.pdf" data-original-source="https://secure-media.collegeboard.org/digitalServices/pdf/research/2015/2015-Exam-Volume-Change.pdf" target="_blank">an analysis</a> (PDF) by <strong>The College Board</strong>, in the ten years between 2005 and 2016 a total of 270,000 high school students in the United States opted to take the national exam in computer science (the &#8220;<a href="media/8319c60d.ap-computer-science-principles-course-and-exam-description.pdf" data-original-source="https://secure-media.collegeboard.org/digitalServices/pdf/ap/ap-computer-science-principles-course-and-exam-description.pdf" target="_blank">Computer Science Advanced Placement</a>&#8221; exam).</p>
<p>Compare that to the numbers from Russia: A <a href="media/91ed6d9c.a14-khenner.pdf" data-original-source="http://www.cs.cmu.edu/~cfrieze/courses/a14-khenner.pdf" target="_blank">2014 study</a> (PDF) on computer science (called &#8220;Informatics&#8221; in Russia) by the <strong>Perm State National Research University</strong> found that roughly 60,000 Russian students register each year to take their nation&#8217;s equivalent to the AP exam &#8212; known as the &#8220;Unified National Examination.&#8221; Extrapolating that annual 60,000 number over ten years suggests that more than twice as many people in Russia &#8212; 600,000 &#8212; have taken the computer science exam at the high school level over the past decade.</p>
<p>In &#8220;<a href="media/c0923774.MSNTS.pdf" data-original-source="https://news.microsoft.com/download/presskits/citizenship/MSNTS.pdf" target="_blank">A National Talent Strategy</a>,&#8221; an in-depth analysis from <strong>Microsoft Corp.</strong> on the outlook for information technology careers, the authors warn that despite its critical and growing importance computer science is taught in only a small minority of U.S. schools. The Microsoft study notes that although there currently are just over 42,000 high schools in the United States, only 2,100 of them were certified to teach the AP computer science course in 2011.</p>
<h4>A HEAD START</h4>
<p>If more people in Russia than in America decide to take the computer science exam in secondary school, it may be because Russian students are required to study the subject beginning at a much younger age. Russia&#8217;s Federal Educational Standards (FES) mandate that informatics be compulsory in middle school, with any school free to choose to include it in their high school curriculum at a basic or advanced level.</p>
<p>&#8220;In elementary school, elements of Informatics are taught within the core subjects &#8216;Mathematics&#8217; and &#8216;Technology,&#8221; the Perm University research paper notes. &#8220;Furthermore, each elementary school has the right to make [the] subject “Informatics” part of its curriculum.&#8221;<span id="more-39608"></span></p>
<p>The core components of the FES informatics curriculum for Russian middle schools are the following:</p>
<p>1. Theoretical foundations<br />
2. Principles of computer&#8217;s functioning<br />
3. Information technologies<br />
4. Network technologies<br />
5. Algorithmization<br />
6. Languages and methods of programming<br />
7. Modeling<br />
8. Informatics and Society</p>
<h4>SECONDARY SCHOOL</h4>
<p>There also are stark differences in how computer science/informatics is taught in the two countries, as well as the level of mastery that exam-takers are expected to demonstrate in their respective exams.</p>
<p>Again, drawing from the Perm study on the objectives in Russia&#8217;s informatics exam, here&#8217;s a rundown of what that exam seeks to test:</p>
<p>Block 1: “Mathematical foundations of Informatics”,<br />
Block 2: “Algorithmization and programming”, and<br />
Block 3: “Information and computer technology.”</p>
<p>The testing materials consist of three parts.</p>
<p>Part 1 is a multiple-choice test with four given options, and it covers all the blocks. Relatively little time is set aside to complete this part.</p>
<p>Part 2 contains a set of tasks of basic, intermediate and advanced levels of complexity. These require brief answers such as a number or a sequence of characteristics.</p>
<p>Part 3 contains a set of tasks of an even higher level of complexity than advanced. These tasks usually involve writing a detailed answer in free form.</p>
<p>According to the Perm study, &#8220;in 2012, part 1 contained 13 tasks; Part 2, 15 tasks; and Part 3, 4 tasks. The examination covers the key topics from the Informatics school syllabus. The tasks with detailed answers are the most labor intensive. These include tasks on the analysis of algorithms, drawing up computer programs, among other types. The answers are checked by the experts of regional examination boards based on standard assessment criteria.&#8221;</p>
<div id="attachment_39676" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39676" src="media/e89d2397.unegraphic-580x328.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/unegraphic-580x328.png" alt="Image: Perm State National Research University, Russia." width="580" height="328" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/unegraphic-580x328.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/unegraphic-768x434.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/06/unegraphic.png 837w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: Perm State National Research University, Russia.</p></div>
<p>In the U.S., the content of the AP computer science exam is spelled out in <a href="media/8319c60d.ap-computer-science-principles-course-and-exam-description.pdf" data-original-source="https://secure-media.collegeboard.org/digitalServices/pdf/ap/ap-computer-science-principles-course-and-exam-description.pdf" target="_blank">this College Board document</a> (PDF).</p>
<p>US Test Content Areas:</p>
<p>Computational Thinking Practices (P)</p>
<p>P1: Connecting Computing<br />
P2: Creating Computational Artifacts<br />
P3: Abstracting<br />
P4: Analyzing Problems and Artifacts<br />
P5: Communicating<br />
P6: Collaborating</p>
<p>The Concept Outline:</p>
<p>Big Idea 1: Creativity<br />
Big idea 2: Abstraction<br />
Big Idea 3: Data and Information<br />
Big Idea 4: Algorithms<br />
Big idea 5: Programming<br />
Big idea 6: The Internet<br />
Big idea 7: Global Impact</p>
<h4>ADMIRING THE PROBLEM</h4>
<p>How do these two tests compare? <strong>Alan Paller</strong>, director of research for the <a href="https://www.sans.org" target="_blank">SANS Institute</a> &#8212; an information security education and training organization &#8212; says topics 2, 3, 4 and 6 in the Russian informatics curriculum above are the &#8220;basics&#8221; on which cybersecurity skills can be built, and they are present beginning in middle school for all Russian students.</p>
<p>&#8220;Very few middle schools teach this in the United States,&#8221; Paller said. &#8220;We don’t teach these topics in general and we definitely don’t test them. The Russians do and they&#8217;ve been doing this for the past 30 years. Which country will produce the most skilled cybersecurity people?&#8221;</p>
<p>Paller said the Russian curriculum virtually ensures kids have far more hands-on experience with computer programming and problem solving. For example, in the American AP test no programming language is specified and the learning objectives are:</p>
<p>“How are programs developed to help people and organizations?&#8221;<br />
&#8220;How are programs used for creative expression?&#8221;<br />
&#8220;How do computer programs implement algorithms?&#8221;<br />
&#8220;How does abstraction make the development of computer programs possible?&#8221;<br />
&#8220;How do people develop and test computer programs?&#8221;<br />
&#8220;Which mathematical and logical concepts are fundamental to programming?”</p>
<p>&#8220;Notice there is almost no need to learn to program — I think they have to write one program (in collaboration with other students),&#8221; Paller wrote in an email to KrebsOnSecurity. &#8220;It&#8217;s like they&#8217;re teaching kids to admire it without learning to do it. The main reason that cyber education fails is that much of the time the students come out of school with almost no usable skills.&#8221;</p>
<h4>THE WAY FORWARD</h4>
<p>On the bright side, there are signs that computer science is becoming a more popular focus for U.S. high school students. According to <a href="media/f32f133a.Program-Summary-Report-2016.pdf" data-original-source="https://secure-media.collegeboard.org/digitalServices/pdf/research/2016/Program-Summary-Report-2016.pdf" target="_blank">the latest AP Test report</a> (PDF) from the College Board, almost 58,000 Americans took the AP exam in computer science last year &#8212; up from 49,000 in 2015.</p>
<p>However, computer science still is far less popular than most other AP test subjects in the United States. More than a half million students opted for the English AP exam in 2016; 405,000 took English literature; almost 283,000 took AP government, while some 159,000 students went for an AP test called &#8220;Human Geography.&#8221;</p>
<div id="attachment_39683" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39683" src="media/518485f5.apexamus16-580x440.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/apexamus16-580x440.png" alt="A breakdown of subject specialization in the 2016 v. 2015 AP tests in the United States. Source: The College Board." width="580" height="440" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/apexamus16-580x440.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/apexamus16-768x583.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/06/apexamus16.png 844w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A breakdown of subject specialization in the 2016 v. 2015 AP tests in the United States. Source: The College Board.</p></div>
<p>This is not particularly good news given the dearth of qualified cybersecurity professionals available to employers. <a href="https://www.isaca.org/pages/default.aspx" target="_blank">ISACA</a>, a non-profit information security advocacy group, estimates there will be a global shortage of two million cyber security professionals by 2019. A <a href="http://blog.isc2.org/isc2_blog/2015/04/isc-study-workforce-shortfall-due-to-hiring-difficulties-despite-rising-salaries-increased-budgets-a.html" rel="noreferrer" data-ss1498091602="1">report</a> from <strong>Frost &amp; Sullivan</strong> and <strong>(ISC)<sup>2</sup></strong> prognosticates there will be more than 1.5 million cybersecurity jobs unfilled by 2020.</p>
<p>The IT recruitment problem is especially acute for companies in the United States. Unable to find enough qualified cybersecurity professionals to hire here in the U.S., companies increasingly are counting on hiring foreigners who have the skills they&#8217;re seeking. However, the Trump administration in April ordered a full review of the country&#8217;s high-skilled immigration visa program, a step that <a href="https://www.recode.net/2017/4/17/15334662/trump-h1b-visa-immigration-order" target="_blank">many believe</a> could produce new rules to clamp down on companies that hire foreigners instead of Americans.</p>
<p>Some of Silicon Valley&#8217;s biggest players are urging policymakers to adopt a more forward-looking strategy to solving the skills gap crisis domestically. In its <a href="media/c0923774.MSNTS.pdf" data-original-source="https://news.microsoft.com/download/presskits/citizenship/MSNTS.pdf" target="_blank">National Talent Strategy report</a> (PDF), Microsoft said it spends 83 percent of its worldwide R&amp;D budget in the United States.</p>
<p>&#8220;But companies across our industry cannot continue to focus R&amp;D jobs in this country if we cannot fill them here,&#8221; reads the Microsoft report. &#8220;Unless the situation changes, there is a growing probability that unfilled jobs will migrate over time to countries that graduate larger numbers of individuals with the <a href="https://en.wikipedia.org/wiki/Science,_technology,_engineering,_and_mathematics" target="_blank">STEM</a> backgrounds that the global economy so clearly needs.&#8221;</p>
<p>Microsoft is urging U.S. policymakers to adopt a nationwide program to strengthen K-12 STEM education by recruiting and training more teachers to teach it. The software giant also says states should be given more funding to broaden access to computer science in high school, and that computer science learning needs to start much earlier for U.S. students.</p>
<p>&#8220;In the short-term this represents an unrealized opportunity for American job growth,&#8221; Microsoft warned. &#8220;In the longer term this may spur the development of economic competition in a field that the United States pioneered.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=39699
title: FBI: Extortion, CEO Fraud Among Top Online Fraud Complaints in 2016
uri: FBI-Extortion-CEO-Fraud-Among-Top-Online-Fraud-Complaints-in-2016
url:
https://krebsonsecurity.com/2017/06/fbi-extortion-ceo-fraud-among-top-online-fraud-complaints-in-2016/

content:
<p>Online extortion, tech support scams and phishing attacks that spoof the boss were among the most costly cyber scams reported by consumers and businesses last year, according to new figures from the <strong>FBI&#8217;s Internet Crime Complaint Center</strong> (IC3).</p>
<p>The IC3 report released Thursday correctly identifies some of the most prevalent and insidious forms of cybercrimes today, but the total financial losses tied to each crime type also underscore how infrequently victims actually report such crimes to law enforcement.</p>
<div id="attachment_39701" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39701" src="media/aa7035e8.2016ic3-580x603.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/2016ic3-580x603.png" alt="Source: Internet Crime Complaint Center (IC3)." width="580" height="603" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/2016ic3-580x603.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/2016ic3-768x798.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/06/2016ic3.png 932w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Source: Internet Crime Complaint Center (IC3).</p></div>
<p>For example, the IC3 said it received 17,146 extortion-related complaints, with an adjusted financial loss totaling just over $15 million. In that category, the report identified 2,673 complaints identified as ransomware &#8212; malicious software that scrambles a victim&#8217;s most important files and holds them hostage unless and until the victim pays a ransom (usually in a virtual currency like Bitcoin).</p>
<p>According to the IC3, the losses associated with those ransomware complaints totaled slightly more than $2.4 million. Writing for <a href="https://www.bleepingcomputer.com/forums/f/239/ransomware-help-tech-support/" target="_blank">BleepingComputer.com</a> &#8212; a tech support forum I&#8217;ve long recommended that helps countless ransomware victims &#8212; <strong>Catalin Cimpanu</strong> observes that the FBI&#8217;s ransomware numbers &#8220;are ridiculously small compared to what happens in the real world, where ransomware is one of today&#8217;s most prevalent cyber-threats.&#8221;</p>
<p>&#8220;The only explanation is that people are paying ransoms, restoring from backups, or reinstalling PCs without filing a complaint with authorities,&#8221; Cimpanu writes.</p>
<p>It&#8217;s difficult to know how what percentage of ransomware victims paid the ransom or were able to restore from backups, but one thing is for sure: Relatively few victims are reporting cyber fraud to federal investigators.</p>
<p>The report notes that only an estimated 15 percent of the nation&#8217;s fraud victims report their crimes to law enforcement. For 2016, 298,728 complaints were received, with a total victim loss of $1.33 billion.</p>
<p>If that 15 percent estimate is close to accurate, that means the real cost of cyber fraud for Americans last year was probably closer to $9 billion, and the losses from ransomware attacks upwards of $16 million.<span id="more-39699"></span></p>
<p>The IC3 reports that last year it received slightly more than 12,000 complaints about <a href="https://krebsonsecurity.com/?s=ceo+fraud&amp;x=0&amp;y=0" target="_blank">CEO fraud attacks</a> &#8212; e-mail scams in which the attacker spoofs the boss and tricks an employee at the organization into wiring funds to the fraudster. The fraud-fighting agency said losses from CEO fraud (also known as the &#8220;business email compromise&#8221; or BEC scam) totaled more than $360 million.</p>
<p>Applying that same 15 percent rule, that brings the likely actual losses from CEO fraud schemes to around $2.4 billion last year.</p>
<p>Some 10,850 businesses and consumers reported being targeted by tech support scams last year, with the total reported loss at around $7.8 million. Perhaps unsurprisingly, the IC3 report observed that victims in older age groups reported the highest losses.</p>
<p>Many other, more established types of Internet crimes &#8212; such as romance scams and advanced fee fraud &#8212; earned top rankings in the report. Check out the full report <a href="media/5d0696ba.2016_IC3Report.pdf" data-original-source="https://pdf.ic3.gov/2016_IC3Report.pdf" target="_blank">here</a> (PDF). The FBI urges all victims of computer crimes to report the incidents at <a href="https://www.ic3.gov" target="_blank">IC3.gov</a>. The IC3 unit is part of the FBI&#8217;s Cyber Operations Section, and it uses the reports to compile and refer cases for investigation and prosecution.</p>
<div id="attachment_39703" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39703" src="media/55fedbee.ic32016-ages-580x369.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/ic32016-ages-580x369.png" alt="Source: IC3" width="580" height="369" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/ic32016-ages-580x369.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/ic32016-ages-768x489.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/06/ic32016-ages-940x599.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/06/ic32016-ages.png 1179w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Source: IC3</p></div>


feed_id: https://krebsonsecurity.com/?p=39489
title: Got Robocalled? Don’t Get Mad; Get Busy.
uri: Got-Robocalled-Don-t-Get-Mad-Get-Busy
url: https://krebsonsecurity.com/2017/06/got-robocalled-dont-get-mad-get-busy/
content:
<p>Several times a week my cell phone receives the telephonic equivalent of spam: A robocall. On each occasion the call seems to come from a local number, but when I answer there is that telltale pause followed by an automated voice pitching some product or service. So when I heard from a reader who chose to hang on the line and see where one of these robocalls led him, I decided to dig deeper. This is the story of that investigation. Hopefully, it will inspire readers to do their own digging and help bury this annoying and intrusive practice.</p>
<p><img class="alignright size-full wp-image-39718" src="media/396414ea.robocall.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/robocall.png" alt="robocall" width="268" height="334" />The reader &#8212; Cedric (he asked to keep his last name out of this story) had grown increasingly aggravated with the calls as well, until one day he opted to play along by telling a white lie to the automated voice response system that called him: Yes, he said, yes he definitely was interested in credit repair services.</p>
<p>&#8220;I lied about my name and played like I needed credit repair to buy a home,&#8221; Cedric said. &#8220;I eventually wound up speaking with a representative at creditfix.com.&#8221;</p>
<p>The number that called Cedric &#8212; <a href="tel:(314)%20754-0123" target="_blank">314-754-0123</a> &#8212; was not in service when Cedric tried it back, suggesting it had been spoofed to make it look like it was coming from his local area. However, pivoting off of creditfix.com opened up some useful avenues of investigation.</p>
<p>Creditfix is hosted on a server at the Internet address 208.95.62.8. According to records maintained by <strong>Farsight Security</strong> &#8212; a company that tracks which Internet addresses correspond to which domain names &#8212; that server hosts or recently hosted dozens of other Web sites (the full list is <a href="https://krebsonsecurity.com/wp-content/uploads/2017/06/DNSDB-208-95-62.8.txt" target="_blank">here</a>).</p>
<p>Most of these domains appear tied to various credit repair services owned or run by a guy named <strong>Michael LaSalla</strong> and registered to a mail drop in Las Vegas. Looking closer at who owns the 208.95.62.8 address, we find it is registered to <strong>System Admin, LLC</strong>, a Florida company that lists LaSalla as a manager, according to <a href="http://search.sunbiz.org/Inquiry/CorporationSearch/SearchResultDetail?inquirytype=EntityName&amp;directionType=Initial&amp;searchNameOrder=SYSTEMADMIN%20L130000426810&amp;aggregateId=flal-l13000042681-f57d5a4a-99f9-4b44-881f-b575a29e40a6&amp;searchTerm=SystemAdmin%2C%20LLC&amp;listNameOrder=SYSTEMADMIN%20L130000426810" target="_blank">a lookup</a> at the Florida Secretary of State&#8217;s office.</p>
<p>An Internet search for the company&#8217;s address turns up <a href="http://apps.fcc.gov/cgb/form499/499detail.cfm?FilerNum=831858" target="_blank">a filing</a> by System Admin LLC with the <strong>U.S. Federal Communications Commission </strong>(FCC).<strong> </strong>That filing shows that the CEO of System Admin is <strong>Martin Toha</strong>, an entrepreneur probably best known for founding <strong>voip.com</strong>, a voice-over-IP (VOIP) service that allows customers to make telephone calls over the Internet.</p>
<p>Emails to the contact address at Creditfix.com elicited a response from a Sean in Creditfix&#8217;s compliance department. Sean told KrebsOnSecurity that mine was the second complaint his company had received about robocalls. Sean said he was convinced that his employer was scammed by a lead generation company that is using robocalls to quickly and illegally gin up referrals, which generate commissions for the lead generation firm.</p>
<p>Creditfix said the robocall leads it received appear to have been referred by <strong>Little Brook Media</strong>, a marketing firm in New York City. Little Brook Media did not respond to multiple requests for comment.</p>
<p>Robocalls are permitted for political candidates, but beyond that if the recording is a sales message and you haven&#8217;t given your written permission to get calls from the company on the other end, the call is illegal. According to the <strong>Federal Trade Commission </strong>(FTC), companies are using auto-dialers to send out thousands of phone calls every minute for an incredibly low cost.<span id="more-39489"></span></p>
<p>&#8220;The companies that use this technology don&#8217;t bother to screen for numbers on the national <a href="http://www.donotcall.gov/" rel="noreferrer" data-ss1498396344="1">Do Not Call Registry</a>,&#8221; the FTC notes in <a href="https://www.consumer.ftc.gov/articles/0259-robocalls" target="_blank">an advisory</a> on its site. &#8220;If a company doesn&#8217;t care about obeying the law, you can be sure they&#8217;re trying to scam you.&#8221;</p>
<p>Mr. Toha confirmed that Creditfix was one of his clients, but said none of his clients want leads from robocalls for that very reason. Toha said the problem is that many companies buy marketing leads but don&#8217;t always know where those leads come from or how they are procured.</p>
<p>&#8220;A lot of times clients don&#8217;t know the companies that the ad agency or marketing agency works with,&#8221; Toha said. &#8220;You submit yourself as a publisher to a network of publishers, and what they do is provide calls to marketers.&#8221;</p>
<p><strong>Robby Birnbaum</strong> is a debt relief attorney in Florida and president of the <strong>National Association of Credit Services Organizations</strong>. Birnbaum said no company wants to buy leads from robocalls, and that marketers who fabricate leads this way are not in business for long.</p>
<p>But he said those that end up buying leads from robocall marketers are often smaller mom-and-pop debt relief shops, and that these companies soon find themselves being sued by what Birnbaum called &#8220;<a href="http://webrecon.com/category/fdcpa-case-statistics/" target="_blank">frequent filers</a>,&#8221; lawyers who make a living suing companies for violating laws against robocalls.</p>
<p>&#8220;It&#8217;s been a problem in this industry for a while, but robocalls affect every single business that wants to reach consumers,&#8221; Birnbaum said. He noted that the best practice is for companies to require lead generators to append to each customer file information about how and from where the lead was generated.</p>
<p>&#8220;A lot of these lead companies will not provide that, and when my clients insist on it, those companies have plenty of other customers who will buy those leads,&#8221; Birnbaum said. &#8220;The phone companies can block many of these robocalls, but they don&#8217;t.&#8221;</p>
<p>That may be about to change. The FCC recently approved new rules that would let phone companies block robocallers from using numbers they aren&#8217;t supposed to be using.</p>
<p>&#8220;If a robocaller decides to spoof another phone number — making it appear that they’re calling from a different line to hide their identity — phone providers would be able to block them if they use a number that clearly can’t exist because it hasn’t been assigned or that an existing subscriber has asked not to have spoofed,&#8221; reads <a href="https://www.theverge.com/2017/3/23/15034556/fcc-robocall-spoofed-number-block-list-proposal-vote" target="_blank">a story</a> at <em>The Verge</em>.</p>
<p>The FCC estimates that there are more than 2.4 billion robocalls made every month, or roughly seven calls per person per month. The FTC received nearly 3.5 million robocall complaints in fiscal year 2016, an increase of 60 percent from the year prior.</p>
<p>The newest trend in robocalls is the &#8220;<a href="http://www.cbsnews.com/news/ringless-marketing-calls-robocalls-voicemails-fcc/" target="_blank">ringless voicemail</a>,&#8221; in which the marketing pitch lands directly in your voicemail inbox without ringing the phone. The FCC also is considering new rules to prohibit ringless voicemails.</p>
<p>Readers may be able to avoid some marketing calls by registering their mobile number with the <a href="http://www.donotcall.gov/" target="_blank">Do Not Call registry</a>, but the list appears to do little to deter robocallers. If and when you do receive robocalls, consider <a href="http://complaints.donotcall.gov/" target="_blank">reporting them to the FTC</a>.</p>
<p>Some wireless providers now offer additional services and features to help block automated calls. For example, <strong>AT&amp;T</strong> offers wireless customers its free <a href="https://www.att.com/offers/call-protect.html" target="_blank">Call Protect app</a>, which screens incoming calls and flags those that are likely spam calls. See <a href="https://www.fcc.gov/consumers/guides/stop-unwanted-calls-texts-and-faxes" target="_blank">the FCC&#8217;s robocall resource page</a> for links to resources at your mobile provider.</p>
<p>In addition, there are number of third-party mobile apps designed to block spammy calls, such as <a href="https://www.nomorobo.com/" target="_blank">Nomorobo</a> and <a href="https://www.truecaller.com/" target="_blank">TrueCaller</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39734
title: ‘Petya’ Ransomware Outbreak Goes Global
uri: Petya-Ransomware-Outbreak-Goes-Global
url: https://krebsonsecurity.com/2017/06/petya-ransomware-outbreak-goes-global/
content:
<p>A new strain of ransomware dubbed &#8220;<strong>Petya</strong>&#8221; is worming its way around the world with alarming speed. The malware is spreading using a vulnerability in <strong>Microsoft Windows</strong> that the software giant patched in March 2017 &#8212; the same bug that was exploited by the recent and prolific <a href="https://krebsonsecurity.com/?s=wannacry&amp;x=0&amp;y=0" target="_blank">WannaCry</a> ransomware strain.</p>
<div id="attachment_39737" style="width: 590px" class="wp-caption alignright"><img class="size-medium wp-image-39737" src="media/6ce3dd66.petya-580x335.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/petya-580x335.png" alt="The ransom note that gets displayed on screens of Microsoft Windows computers infected with Petya." width="580" height="335" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/petya-580x335.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/petya-768x444.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/06/petya-940x543.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/06/petya.png 1458w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The ransom note that gets displayed on screens of Microsoft Windows computers infected with Petya.</p></div>
<p>According to multiple news reports, Ukraine appears to be among the hardest hit by Petya. The country&#8217;s government, some domestic banks and largest power companies all warned today that they were dealing with fallout from Petya infections.</p>
<p>Danish transport and energy firm <strong>Maersk</strong> said in <a href="http://www.maersk.com/en" target="_blank">a statement</a> on its Web site that &#8220;We can confirm that Maersk IT systems are down across multiple sites and business units due to a cyber attack.&#8221; In addition, Russian energy giant Rosneft <a href="https://twitter.com/RosneftRu/status/879665160012673024" target="_blank">said on Twitter</a> that it was facing a &#8220;powerful hacker attack.&#8221; However, neither company referenced ransomware or Petya.</p>
<p>Security firm <strong>Symantec</strong> confirmed that Petya uses the &#8220;<a href="https://en.wikipedia.org/wiki/EternalBlue" target="_blank">Eternal Blue</a>&#8221; exploit, a digital weapon that was believed to have been developed by the <strong>U.S. National Security Agency</strong> and in April 2017 leaked online by a hacker group calling itself the <strong>Shadow Brokers</strong>.</p>
<p>Microsoft <a href="https://krebsonsecurity.com/2017/03/adobe-microsoft-push-critical-security-fixes-10/" target="_blank">released a patch</a> for the Eternal Blue exploit in March (<a href="https://technet.microsoft.com/en-us/library/security/ms17-010.aspx" target="_blank">MS17-010</a>), but many businesses put off installing the fix. Many of those that procrastinated were hit with the WannaCry ransomware attacks in May. U.S. intelligence agencies assess with medium confidence that WannaCry was the work of North Korean hackers.</p>
<p>Organizations and individuals who have not yet applied the Windows update for the Eternal Blue exploit should patch now. However, there are indications that Petya may have other tricks up its sleeve to spread inside of large networks.<span id="more-39734"></span></p>
<p>Russian security firm <strong>Group-IB</strong> <a href="https://twitter.com/GroupIB_GIB/status/879772068300165120" target="_blank">reports</a> that Petya bundles a tool called &#8220;LSADump,&#8221; which can gather passwords and credential data from Windows computers and domain controllers on the network.</p>
<p>Petya seems to be primarily impacting organizations in Europe, however the malware is starting to show up in the United States. <em>Legal Week</em> <a href="http://www.legalweek.com/sites/legalweek/2017/06/27/dla-piper-hit-by-cyber-attack-with-phones-and-computers-down-across-the-firm/?slreturn=20170527161309" target="_blank">reports</a> that global law firm <strong>DLA Piper</strong> has experienced issues with its systems in the U.S. as a result of the outbreak.</p>
<p>Through <a href="https://twitter.com/CyberpoliceUA" target="_blank">its twitter account</a>, the <strong>Ukrainian Cyber Police</strong> said the attack appears to have been seeded through a software update mechanism built into <a href="http://www.me-doc.com.ua/" target="_blank">M.E.Doc</a>, an accounting program that companies working with the Ukranian government need to use.</p>
<p><strong>Nicholas Weaver</strong>, a security researcher at the <a href="https://www.icsi.berkeley.edu/" target="_blank">International Computer Science Institute</a> and a lecturer at <strong>UC Berkeley</strong>, said Petya appears to have been well engineered to be destructive while masquerading as a ransomware strain.</p>
<p>Weaver noted that Petya&#8217;s ransom note includes the same Bitcoin address for every victim, whereas most ransomware strains create a custom Bitcoin payment address for each victim.</p>
<p>Also, he said, Petya urges victims to communicate with the extortionists via an email address, while the majority of ransomware strains require victims who wish to pay or communicate with the attackers to use Tor, a global anonymity network that can be used to host Web sites which can be very difficult to take down.</p>
<p class="p1">&#8220;I’m willing to say with at least moderate confidence that this was a deliberate, malicious, destructive attack or perhaps a test disguised as ransomware,&#8221; Weaver said. &#8220;The best way to put it is that Petya&#8217;s payment infrastructure is a fecal theater.&#8221;</p>
<p class="p1">Ransomware encrypts important documents and files on infected computers and then demands a ransom (usually in Bitcoin) for a digital key needed to unlock the files. With most ransomware strains, victims who do not have recent backups of their files are faced with a decision to either pay the ransom or kiss their files goodbye.</p>
<p>Ransomware attacks like Petya have become such a common pestilence that many companies are now <a href="https://www.technologyreview.com/s/601643/companies-are-stockpiling-bitcoin-to-pay-off-cybercriminals/" target="_blank">reportedly stockpiling Bitcoin</a> in case they need to quickly unlock files that are being held hostage by ransomware.</p>
<p>Security experts warn that Petya and other ransomware strains will continue to proliferate as long as companies delay patching and fail to develop a robust response plan for dealing with ransomware infestations.</p>
<p>According to <strong>ISACA</strong>, a nonprofit that advocates for professionals involved in information security, assurance, risk management and governance, 62 percent of organizations surveyed recently reported experiencing ransomware in 2016, but only 53 percent said they had a formal process in place to address it.</p>
<p><strong>Update: 5:06 p.m. ET:</strong> Added quotes from Nicholas Weaver and links to an analysis by the Ukrainian cyber police.</p>


feed_id: https://krebsonsecurity.com/?p=39745
title: So You Think You Can Spot a Skimmer?
uri: So-You-Think-You-Can-Spot-a-Skimmer
url: https://krebsonsecurity.com/2017/06/so-you-think-you-can-spot-a-skimmer/
content:
<p>This week marks the 50th anniversary of the automated teller machine &#8212; better known to most people as the ATM or cash machine. Thanks to the myriad methods thieves have devised to fleece unsuspecting cash machine users over the years, there are now more ways than ever to get ripped off at the ATM. Think you&#8217;re good at spotting the various scams? A newly released ATM fraud inspection guide may help you test your knowledge.</p>
<p>The first cash machine opened for business on June 27, 1967 at a Barclays bank branch in Enfield, north London, but ATM transactions back then didn&#8217;t remotely resemble the way ATMs work today.</p>
<div id="attachment_39746" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39746" src="media/42aa29b8.1statm-580x380.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/1statm-580x380.png" alt="The first ATM was installed in Enfield, in North London, on June 27, 1967. Image: Barclays Bank." width="580" height="380" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/1statm-580x380.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/1statm.png 641w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The first ATM was installed in Enfield, in North London, on June 27, 1967. Image: Barclays Bank.</p></div>
<p>The cash machines of 1967 relied not on plastic cards but instead on paper checks that the bank would send to customers in the mail. Customers would take those checks &#8212; which had little <a href="https://en.wikipedia.org/wiki/Punched_card" target="_blank">punched-card holes</a> printed across the surface &#8212; and feed them into the ATM, which would then validate the checks and dispense a small amount of cash.</p>
<p>This week, Barclay&#8217;s turned the ATM at the same location into a gold color to mark its golden anniversary, dressing the machine with velvet ropes and a red carpet leading up to the machine&#8217;s PIN pad.</p>
<div id="attachment_39747" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39747" src="media/a6957c19.goldatm-580x322.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/goldatm-580x322.png" alt="The location of the world's first ATM, turned to gold to commemorate the cash machine's golden anniversary. Image: Barclays Bank." width="580" height="322" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/goldatm-580x322.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/goldatm.png 701w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The location of the world&#8217;s first ATM, turned to gold and commemorated with a plaque to mark the cash machine&#8217;s golden anniversary. Image: Barclays Bank.</p></div>
<p>Chances are, the users of that gold ATM have little to worry about from skimmer scammers. But the rest of us practically need a skimming-specific dictionary to keep up with today&#8217;s increasingly ingenious thieves.</p>
<p>These days there are an estimated three million ATMs around the globe, and a seemingly endless stream of innovative criminal skimming devices has introduced us over the years to a range of terms specific to cash machine scams like <a href="http://krebsonsecurity.com/2014/12/more-on-wiretapping-atm-skimmers/" target="_blank">wiretapping</a>, <a href="https://krebsonsecurity.com/2014/11/skimmer-innovation-wiretapping-atms/" target="_blank">eavesdropping</a>, <a href="https://krebsonsecurity.com/2012/11/beware-card-and-cash-trapping-at-the-atm/" target="_blank">card-trapping, cash-trapping</a>, <a href="https://krebsonsecurity.com/2013/12/the-biggest-skimmers-of-all-fake-atms/" target="_blank">false fascias</a>, <a href="https://krebsonsecurity.com/?s=shimming&amp;x=0&amp;y=0" target="_blank">shimming</a>, <a href="http://krebsonsecurity.com/2015/01/thieves-jackpot-atms-with-black-box-attack/" target="_blank">black box attacks</a>, <a href="https://krebsonsecurity.com/2015/11/gas-theft-gangs-fuel-pump-skimming-scams/" target="_blank">bladder bombs</a> (pump skimmers), <a href="http://krebsonsecurity.com/2014/12/more-on-wiretapping-atm-skimmers/" target="_blank">gas attacks</a>, and <a href="https://krebsonsecurity.com/2016/05/crooks-go-deep-with-deep-insert-skimmers/" target="_blank">deep insert skimmers</a>.</p>
<p>Think you&#8217;ve got what it takes to spot the telltale signs of a skimmer? Then have a look at the <a href="media/0303c38b.17fin6542_atm_fraud_inspection_guide_rgb.pdf" data-original-source="https://www.ncr.com/sites/default/files/white_papers/17fin6542_atm_fraud_inspection_guide_rgb.pdf" target="_blank">ATM Fraud Inspection Guide</a> (PDF) from cash machine giant <strong>NCR Corp.</strong>, which briefly touches on the most common forms of ATM skimming and their telltale signs.</p>
<p>For example, below are a few snippets from that guide showing different cash trapping devices made to siphon bills being dispensed from the ATM.</p>
<div id="attachment_39748" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39748" src="media/6075e2ae.cashtrapping-580x205.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/cashtrapping-580x205.png" alt="Cash-trapping devices. Source: NCR." width="580" height="205" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/cashtrapping-580x205.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/cashtrapping-768x272.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/06/cashtrapping-940x333.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/06/cashtrapping.png 1226w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Cash-trapping devices. Source: NCR.</p></div>
<p><span id="more-39745"></span>As sophisticated as many modern ATM skimmers may be, most of them can still be foiled by ATM customers simply <a href="https://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">covering the PIN pad with their hands</a> while entering their PIN (the rare exceptions here involve expensive, complex fraud devices called <a href="media/b2afe186.skimgallery1.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/08/skimgallery1.jpg" target="_blank">&#8220;PIN pad overlays&#8221;</a>).</p>
<p>The proliferation of skimming devices can make a trip to any ATM seem like a stressful experience, but keep in mind that skimmers aren&#8217;t the only thing that can go wrong at an ATM. It’s a good idea to visit only ATMs that are in well-lit and public areas, and to be aware of your surroundings as you approach the cash machine. If you visit a cash machine that looks strange, tampered with, or out of place, then try to find another ATM.</p>
<p>You are far more likely to encounter ATM skimmers over the weekend when the bank is closed (skimmer thieves especially favor long holiday weekends when the banks are closed on Monday). Also, if you have the choice between a stand-alone, free-standing ATM and one that is installed at a fixed location (particularly a bank) opt for the fixed-location machine, which is typically more secure against <a href="https://krebsonsecurity.com/2014/05/thieves-planted-malware-to-hack-atms/" target="_blank">physical tampering</a>.</p>
<div id="attachment_39749" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39749" src="media/c97fa2ab.insert-ncr-580x285.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/06/insert-ncr-580x285.png" alt="&quot;Deep insert&quot; skimmers, top. Below, an ATM &quot;shimming&quot; device. Source: NCR." width="580" height="285" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/06/insert-ncr-580x285.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/06/insert-ncr-768x377.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/06/insert-ncr-940x461.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/06/insert-ncr.png 1237w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">&#8220;Deep insert&#8221; skimmers, top. Below, ATM &#8220;shimming&#8221; devices. Source: NCR.</p></div>


feed_id: https://krebsonsecurity.com/?p=39768
title: Is it Time to Can the CAN-SPAM Act?
uri: Is-it-Time-to-Can-the-CAN-SPAM-Act
url: https://krebsonsecurity.com/2017/07/is-it-time-to-can-the-can-spam-act/
content:
<p>Regulators at the <strong>U.S. Federal Trade Commission</strong> (FTC) are asking for public comment on the effectiveness of the <strong>CAN-SPAM Act</strong>, a 14-year-old federal law that seeks to crack down on unsolicited commercial email. Judging from an unscientific survey by this author, the FTC is bound to get an earful.</p>
<p><img class="aligncenter size-medium wp-image-39769" src="media/3a93d002.spamspamspam-580x453.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/spamspamspam-580x453.png" alt="spamspamspam" width="580" height="453" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/spamspamspam-580x453.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/spamspamspam-768x599.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/spamspamspam.png 829w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Signed into law by <strong>President George W. Bush</strong> in 2003, the &#8220;<a href="https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003" target="_blank">Controlling the Assault of Non-Solicited Pornography and Marketing Act</a>&#8221; was passed in response to a rapid increase in junk email marketing.</p>
<p>The law makes it a misdemeanor to spoof the information in the &#8220;from:&#8221; field of any marketing message, and prohibits the sending of sexually-oriented spam without labeling it &#8220;sexually explicit.&#8221; The law also requires spammers to offer recipients a way to opt-out of receiving further messages, and to process unsubscribe requests within 10 business days.</p>
<p>The &#8220;CAN&#8221; in CAN-SPAM was a play on the verb &#8220;to can,&#8221; as in &#8220;to put an end to,&#8221; or &#8220;to throw away,&#8221; but critics of the law often refer to it as the YOU-CAN-SPAM Act, charging that it essentially legalized spamming. That&#8217;s partly because the law does not require spammers to get permission before they send junk email. But also because the act prevents states from enacting stronger anti-spam protections, and it bars individuals from suing spammers except under laws not specific to email.</p>
<p>Those same critics often argue that the law is rarely enforced, although <a href="https://www.ftc.gov/search/site/can-spam%20settle" target="_blank">a search on the FTC&#8217;s site</a> for CAN-SPAM press releases produces quite a few civil suits brought by the commission against marketers over the years. Nevertheless, any law affecting Internet commerce is bound to need a few tweaks over the years, and CAN-SPAM has been showing its age for some time now.</p>
<p><strong>Ron Guilmette</strong>, an anti-spam activists whose work has been <a href="https://krebsonsecurity.com/?s=guilmette&amp;x=0&amp;y=0" target="_blank">profiled extensively on this blog</a>, didn&#8217;t sugar-coat it, calling CAN-SPAM &#8220;a travesty that was foisted upon the American people by a small handful of powerful companies, most notably AOL and Microsoft, and by their obedient lackeys in Congress.&#8221;</p>
<p>According to Guilmette, the Act was deliberately fashioned so as to nullify California&#8217;s more restrictive anti-spam law, and it made it impossible for individual victims of spam to sue spam senders. Rather, he said, that right was reserved only for the same big companies that lobbied heavily for the passage of the CAN-SPAM Act.</p>
<p><span class="pullquote pqleft">&#8220;The entire Act should be thrown out and replaced,&#8221; Guilmette said. &#8220;It hasn&#8217;t worked to control spam, and it has in fact only served to make the problem worse.&#8221;</span></p>
<p>In the fix-it-don&#8217;t-junk-it camp is <strong>Joe Jerome</strong>, policy counsel for the <a href="https://www.eff.org" target="_blank">Electronic Frontier Foundation</a> (EFF), a nonprofit digital rights advocacy group. Jerome allowed that CAN-SPAM is far from perfect, but he said it has helped to set some ground rules.</p>
<p>&#8220;In her announcement on this effort, Acting Chairman Ohlhausen hinted that regulations can be excessive, outdated, or unnecessary,&#8221; Jerome said. &#8220;Nothing can be further from the case with respect to spam. CAN-SPAM was largely ineffective in stopping absolutely bad, malicious spammers, but it&#8217;s been incredibly important in creating a baseline for commercial email senders. Advertising transparency and easy opt-outs should not be viewed as a burden on companies, and I&#8217;d worry that weakening CAN-SPAM would set us back. If anything, we need stronger standards around opt-outs and quicker turn-around time, not less.&#8221;<span id="more-39768"></span></p>
<p><strong>Dan Balsam</strong>, an American lawyer who&#8217;s <a href="https://en.wikipedia.org/wiki/Daniel_Balsam" target="_blank">made a living</a> suing spammers, has argued that CAN-SPAM is nowhere near as tough as it needs to be on junk emailers. Balsam argues that spammy marketers win as long as the federal law leaves enforcement up to state attorneys general, the FTC and Internet service providers.</p>
<p>&#8220;I would tell the FTC that it&#8217;s a travesty that Congress purports to usurp the states&#8217; traditional authority to regulate advertising,&#8221; Balsam said via email. &#8220;I would tell the FTC that it&#8217;s ridiculous that the CAN-SPAM Act allows spam unless/until the person opts out, unlike e.g. Canada&#8217;s law. And I would tell the FTC that the CAN-SPAM Act isn&#8217;t working because there&#8217;s still obviously a spam problem.&#8221;</p>
<p><strong>Cisco</strong> <a href="http://b2me.cisco.com/en-us-annual-cybersecurity-report-2017" target="_blank">estimates</a> that 65 percent of all email sent today is spam. That&#8217;s down only slightly from 2004 when CAN-SPAM took effect. At the time, <strong>Postini Inc.</strong> &#8212; an email filtering company later bought by <strong>Google</strong> &#8212; estimated that 70 percent of all email was spam.</p>
<p>Those figures may be misleading because a great deal of spam today is simply malicious email. Nobody harbored any illusions that CAN-SPAM could do much to stop the millions of phishing scams, malware and booby-trapped links being blasted out each day by cyber criminals. This type of spam is normally relayed via hacked servers and computers without the knowledge of their legitimate owners. Also, while the world&#8217;s major ISPs have done a pretty good job blocking most pornography spam, it&#8217;s still being blasted out en masse <a href="https://krebsonsecurity.com/2017/06/inside-a-porn-pimping-spam-botnet/" target="_blank">from some of the same criminals who are pumping malware spam</a>.</p>
<p>Making life more miserable and expensive for malware spammers and phishers has been major focus of my work, both <a href="https://krebsonsecurity.com/?s=spam&amp;x=0&amp;y=0" target="_blank">here at KrebsOnSecurity</a> and in my book, <a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank"><em>Spam Nation: The Inside Story of Organized Cybercrime</em></a>. Stay tuned later this week for the results of a lengthy investigation into a spam gang that has stolen millions of Internet addresses to play their trade (a story, by the way, that features prominently the work of the above-quoted anti-spammer Ron Guilmette).</p>
<p>What do you think about the CAN-SPAM law? Sound off in the comments below, and consider leaving a copy of your thoughts at <a href="https://ftcpublic.commentworks.com/ftc/canspamrulereview/" target="_blank">the FTC&#8217;s CAN-SPAM comments page</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39792
title: Who is the GovRAT Author and Mirai Botmaster ‘Bestbuy’?
uri: Who-is-the-GovRAT-Author-and-Mirai-Botmaster-Bestbuy
url: https://krebsonsecurity.com/2017/07/who-is-the-govrat-author-and-mirai-botmaster-bestbuy/
content:
<p>In February 2017, authorities in the United Kingdom arrested a 29-year-old U.K. man on suspicion of knocking more than 900,000 Germans offline in an attack tied to <strong>Mirai</strong>, a malware strain that enslaves Internet of Things (IoT) devices like security cameras and Internet routers for use in large-scale cyberattacks. Investigators haven&#8217;t yet released the man&#8217;s name, but news reports suggest he may be better known by the hacker handle &#8220;<strong>Bestbuy</strong>.&#8221; This post will follow a trail of clues back to one likely real-life identity of Bestbuy.</p>
<p>At the end of November 2016, a <a href="https://www.flashpoint-intel.com/blog/cybercrime/new-mirai-variant-involved-latest-deutsche-telekom-outage/" target="_blank">modified version of Mirai</a> began spreading across the networks of German ISP <strong>Deutsche Telekom</strong>. This version of the Mirai worm spread so quickly that the very act of scanning for new infectable hosts overwhelmed the devices doing the scanning, causing outages for more than 900,000 customers. The same botnet had previously been tied to <a href="https://motherboard.vice.com/en_us/article/nz7ky7/hackers-say-knocking-thousands-of-brits-offline-was-an-accident-mirai" target="_blank">attacks on U.K. broadband providers Post Office and Talk Talk</a>.</p>
<p><img class="aligncenter size-medium wp-image-39804" src="media/8de3d83f.dtoutage-580x678.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/dtoutage-580x678.png" alt="dtoutage" width="580" height="678" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/dtoutage-580x678.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dtoutage-768x898.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dtoutage.png 794w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Security firm <strong>Tripwire</strong> <a href="https://www.tripwire.com/state-of-security/security-data-protection/iot/peter-parker-just-hacked-900000-routers/" target="_blank">published a writeup</a> on that failed Mirai attack, noting that the domain names tied to servers used to coordinate the activities of the botnet were registered variously to a &#8220;Peter Parker&#8221; and &#8220;<strong>Spider man</strong>,&#8221; and to a street address in Israel (27 Hofit St). We&#8217;ll come back to Spider Man in a moment.</p>
<p>According to multiple security firms, the Mirai botnet responsible for the Deutsche Telekom outage was controlled via servers at the Internet address <strong>62.113.238.138</strong>. <strong>Farsight Security</strong>, a company that maps which domain names are tied to which Internet addresses over time, reports that this address has <a href="https://krebsonsecurity.com/wp-content/uploads/2017/07/farsight-62-113-238-138.txt" target="_blank">hosted just nine domains</a>.</p>
<p>The only one of those domains that is not related to Mirai is <strong>dyndn-web[dot]com</strong>, which according to <a href="https://www.bluecoat.com/es/node/18554" target="_blank">a 2015 report</a> from <strong>BlueCoat</strong> (now <strong>Symantec</strong>) was a domain tied to the use and sale of a keystroke logging remote access trojan (RAT) called &#8220;<strong>GovRAT</strong>.&#8221; The trojan is documented to have been used in numerous cyber espionage campaigns against governments, financial institutions, defense contractors and more than 100 corporations.</p>
<p><a href="http://infoarmor.com/products-services/targeted-intelligence/resources/" target="_blank">Another report on GovRAT</a> &#8212; this one from security firm <strong>InfoArmor</strong> &#8212; shows that the GovRAT malware was sold on Dark Web cybercrime forums by a hacker or hackers who went by the nicknames BestBuy and &#8220;Popopret&#8221; (some experts believe these were just two different identities managed by the same cybercriminal).</p>
<div id="attachment_39794" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39794" src="media/5e49f0cd.govrathell-580x249.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/govrathell-580x249.png" alt="The hacker &quot;bestbuy&quot; selling his Govrat trojan on the dark web forum &quot;Hell.&quot; Image: InfoArmor." width="580" height="249" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/govrathell-580x249.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/govrathell-768x329.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/govrathell-940x403.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/govrathell.png 1437w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The hacker &#8220;bestbuy&#8221; selling his GovRAT trojan on the dark web forum &#8220;Hell.&#8221; Image: InfoArmor.</p></div>
<p>GovRAT has been for sale on various other malware and exploit-related sites since at least 2014. On <strong>oday[dot]today</strong>, for example, GovRAT was sold by a user who picked the nickname <strong>Spdr</strong>, and who used the email address <strong>spdr01@gmail.com</strong>.</p>
<p>Recall that the domains used to control the Mirai botnet that hit <strong>Deutsche Telekom</strong> all had some form of Spider Man in the domain registration records. Also, recall that the controller used to manage the GovRAT trojan and that Mirai botnet were both at one time hosted on the same server with just a handful of other (Mirai-related) domains.</p>
<p>According to <a href="media/e719fce4.Advanced_Persistent_Threats_Code_Signing.pdf" data-original-source="https://www.infoarmor.com/wp-content/uploads/2016/04/Advanced_Persistent_Threats_Code_Signing.pdf" target="_blank">a separate report</a> (PDF) from InfoArmor, GovRAT also was sold alongside a service that allows anyone to digitally sign their malware using code-signing certificates stolen from legitimate companies. InfoArmor said the digital signature it found related to the service was issued to an open source developer Singh Aditya, using the email address <strong>parkajackets@gmail.com</strong>.</p>
<p>Interestingly, both of these email addresses &#8212; parkajackets@gmail.com and spdr01@gmail.com &#8212; were connected to similarly-named user accounts at vDOS, for years the largest DDoS-for-hire service (that is, until KrebsOnSecurity last fall <a href="https://krebsonsecurity.com/2016/09/alleged-vdos-proprietors-arrested-in-israel/" target="_blank">outed its proprietors</a> as two 18-year-old Israeli men). </p>
<p>Last summer <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank">vDOS got massively hacked</a>, and a copy of its user and payments databases was shared with this author and with U.S. federal law enforcement agencies. The leaked database shows that both of those email addresses are tied to accounts on vDOS named &#8220;bestbuy&#8221; (bestbuy and bestbuy2).</p>
<div id="attachment_39802" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39802" src="media/dce4dc8c.0daytoday-580x426.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/0daytoday-580x426.png" alt="Spdr01's sales listing for the GovRAT trojan on a malware and exploits site shows he used the email address spdr01@gmail.com" width="580" height="426" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/0daytoday-580x426.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/0daytoday-768x564.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/0daytoday-940x691.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/0daytoday.png 1185w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Spdr01&#8217;s sales listing for the GovRAT trojan on a malware and exploits site shows he used the email address spdr01@gmail.com</p></div>
<p>The leaked vDOS database also contained detailed records of the Internet addresses that vDOS customers used to log in to the attack-for-hire service. Those logs show that the bestbuy and bestbuy2 accounts logged in repeatedly from several different IP addresses in the United Kingdom and in Hong Kong.</p>
<p>The technical support logs from vDOS indicate that the reason the vDOS database shows two different accounts named &#8220;bestbuy&#8221; is the vDOS administrators banned the original &#8220;bestbuy&#8221; account after it was seen logged into the account from both the UK and Hong Kong. Bestbuy&#8217;s pleas to the vDOS administrators that he was not sharing the account and that the odd activity could be explained by his recent trip to Hong Kong did not move them to refund his money or reactivate his original account.</p>
<p>A number of clues in the data above suggest that the person responsible for both this Mirai botnet and GovRAT had ties to Israel. For one thing, the email address spdr01@gmail.com was used to register at least three domain names, all of which are tied back to <a href="https://krebsonsecurity.com/wp-content/uploads/2017/07/domaintoolsreversewhoisonspdr01atgmaildotcom.txt" target="_blank">a large family in Israel</a>. What&#8217;s more, in several dark web postings, Bestbuy can be seen asking if anyone has any &#8220;weed for sale in Israel,&#8221; noting that he doesn&#8217;t want to risk receiving drugs in the mail.</p>
<p>The domains tied to spdr01@gmail.com led down a very deep rabbit hole that ultimately went nowhere useful for this investigation. But it appears the nickname &#8220;spdr01&#8221; and email spdr01@gmail.com was used <a href="https://www.exploit-db.com/exploits/6323/" target="_blank">as early as 2008</a> by <a href="https://github.com/sensepost/autoDANE/blob/master/software/tomcat_check/tomcat-scan.nse" target="_blank">a core member</a> of the Israeli hacking forum and IRC chat room <strong>Binaryvision.co.il</strong>.<span id="more-39792"></span></p>
<p>Visiting <a href="https://www.binaryvision.co.il/?author=4" target="_blank">the Binaryvision archives page for this user</a>, we can see Spdr was a highly technical user who contributed several articles on cybersecurity vulnerabilities and on mobile network security (Google Chrome or Google Translate deftly translates these articles from Hebrew to English).</p>
<p>I got in touch with multiple current members of Binaryvision and asked if anyone still kept in contact with Spdr from the old days. One of the members said he thought Spdr held dual Israeli and U.K. citizenship, that he would be approximately 30 years old at the moment. Another said Spdr was engaged to be married recently. None of those who shared what they recalled about Spdr wished to be identified for this story.</p>
<p>But a bit of searching on those users&#8217; social networking accounts showed they had a friend in common that fit the above description. The <a href="https://www.ja-jp.m.lite.facebook.com/DanielKaye.il" target="_blank">Facebook profile for one Daniel Kaye</a> using the Facebook alias &#8220;DanielKaye.il&#8221; (.il is the top level country code domain for Israel) shows that Mr. Kaye is now 29 years old and is or was engaged to be married to a young woman named Catherine in the United Kingdom.</p>
<p>The background image on Kaye&#8217;s Facebook profile is a picture of Hong Kong, and Kaye&#8217;s last action on Facebook was apparently <a href="https://www.ja-jp.m.lite.facebook.com/DanielKaye.il/posts/845485975557656:0" target="_blank">to review a sports and recreation facility in Hong Kong</a>.</p>
<p><img class="aligncenter size-medium wp-image-39825" src="media/d7b85c31.dankaye-580x296.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/dankaye-580x296.png" alt="dankaye" width="580" height="296" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/dankaye-580x296.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dankaye-768x392.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dankaye-940x480.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dankaye.png 1064w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Using <strong>Domaintools.com</strong> [full disclosure: Domaintools is an advertiser on this blog], I ran a &#8220;reverse WHOIS&#8221; search on the name &#8220;Daniel Kaye,&#8221; and it came back with <a href="https://krebsonsecurity.com/wp-content/uploads/2017/07/domaintoolsreversewhoisondanielkaye.txt" target="_blank">exactly 103 current and historic domain names</a> with this name in their records. One of them in particular caught my eye: <strong>Cathyjewels[dot]com</strong>, which appears to be tied to a homemade jewelry store located in the U.K. that never got off the ground.</p>
<p>Cathyjewels[dot]com was registered in 2014 to a Daniel Kaye in Egham, U.K., using the email address <strong>danielkaye02@gmail.com</strong>. I decided to run this email address through <a href="https://shadowdragon.io/product/socialnet/" target="_blank">Socialnet</a>, a plugin for the data analysis tool <a href="https://www.paterva.com/web7/" target="_blank">Maltego</a> that scours dozens of social networking sites for user-defined terms. Socialnet reports that this email address is tied to an account at <a href="https://en.gravatar.com/" target="_blank">Gravatar</a> &#8212; a service that lets users keep the same avatar at multiple Web sites. The name on that account? You guessed it: <strong>Spdr01</strong>.</p>
<div id="attachment_39796" style="width: 512px" class="wp-caption aligncenter"><img class="size-full wp-image-39796" src="media/19cbc030.danielkaye-spdr-grav.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/danielkaye-spdr-grav.png" alt="The output from the Socialnet plugin for Maltego when one searches for the email address danielkaye02@gmail.com." width="502" height="392" /><p class="wp-caption-text">The output from the Socialnet plugin for Maltego when one searches for the email address danielkaye02@gmail.com.</p></div>
<p>Daniel Kaye did not return multiple requests for comment sent via Facebook and the various email addresses mentioned here.</p>
<p>In case anyone wants to follow up on this research, I highlighted the major links between the data points mentioned in this post in the following mind map (created with the excellent and indispensable <strong>MindNode Pro</strong> for Mac).</p>
<div id="attachment_39807" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/6baed4d9.govratmindmap.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/govratmindmap.png"> <img class="wp-image-39807 size-medium" src="media/e2a83406.govratmindmap-580x283.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/govratmindmap-580x283.png" alt=" " width="580" height="300" /></a><p class="wp-caption-text">A &#8220;mind map&#8221; tracing some of the research mentioned in this post.</p></div>


feed_id: https://krebsonsecurity.com/?p=39857
title: B&B Theatres Hit in 2-Year Credit Card Breach
uri: B-B-Theatres-Hit-in-2-Year-Credit-Card-Breach
url: https://krebsonsecurity.com/2017/07/bb-theatres-hit-in-2-year-credit-card-breach/
content:
<p><strong>B&amp;B Theatres</strong>, a company that owns and operates the 7th-largest theater chain in America, says it is investigating a breach of its credit card systems. The acknowledgment comes just days after KrebsOnSecurity reached out to the company for comment on reports from financial industry sources who said they suspected the cinema chain has been leaking customer credit card data to cyber thieves for the past two years.</p>
<p><img class="alignright size-full wp-image-39860" src="media/52d70eb1.bandb.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/bandb.png" alt="bandb" width="196" height="215" />Headquartered in Gladstone, Missouri, B&amp;B Theatres operates approximately 400 screens <a href="https://en.wikipedia.org/wiki/B%26B_Theatres" target="_blank">across 50 locations in seven states</a>, including Arkansas, Arizona, Florida, Kansas, Missouri, Mississippi, Nebraska, Oklahoma and Texas.</p>
<p>In a written statement forwarded by B&amp;B spokesman <strong>Paul Farnsworth</strong>, the company said B&amp;B Theatres was made aware of a potential breach by a local banking partner in one of its communities.</p>
<p>&#8220;Upon being notified we immediately engaged Trustwave, a third party security firm recommended to B&amp;B by partners at major credit card brands, to work with our internal I.T. resources to contain the breach and mitigate any further potential penetration,&#8221; the statement reads. &#8220;While some malware was identified on B&amp;B systems that dated back to 2015, the investigation completed by Trustwave did not conclude that customer data was at risk on all B&amp;B systems for the entirety of the breach.&#8221;</p>
<p>The statement continued:</p>
<p>&#8220;Trustwave&#8217;s investigation has since shown the breach to be contained to the satisfaction of our processing partners as well as the major credit card brands. B&amp;B Theatres values the security of our customer&#8217;s data and will continue to implement the latest available technologies to keep our networks &amp; systems secure into the future.&#8221;</p>
<p>In June, sources at two separate U.S.-based financial institutions reached out to KrebsOnSecurity about alerts they&#8217;d received privately from the credit card associations regarding lists of card numbers that were thought to have been compromised in a recent breach.</p>
<p>The credit card companies generally do not tell financial institutions in these alerts which merchants got breached, leaving banks and credit unions to work backwards from those lists of compromised cards to a so-called &#8220;common point-of-purchase&#8221; (CPP).</p>
<p>In addition to lists of potentially compromised card numbers, the card associations usually include a &#8220;window of exposure&#8221; &#8212; their best estimate of how long the breach lasted. Two financial industry sources said initial reports from the credit card companies said the window of exposure at B&amp;B Theatres was between Sept. 1, 2015 and April 7, 2017.</p>
<p>However, a more recent update to this advisory shared by my sources shows that the window of exposure is currently estimated between April 2015 and April 2017, meaning cyber thieves have likely been siphoning credit and debit card data from B&amp;B Theatres customers for nearly two years undisturbed.<span id="more-39857"></span></p>
<p>Malicious hackers can steal credit card data from organizations that accept cards by hacking into point-of-sale systems remotely and seeding those systems with malicious software that can copy account data stored on a card’s magnetic stripe. Thieves can then use that data to clone the cards and use the counterfeit cards to buy high-priced merchandise from electronics stores and big box retailers.</p>
<p>The statement from B&amp;B Theatres made no mention of whether their credit card systems were set up to handle transactions from more secure chip-based credit and debit cards, which are far more difficult and expensive for thieves to counterfeit.</p>
<p>Under credit card association rules that went into effect in 2015, merchants that do not have the ability to process transactions from chip-based cards assume full liability for all fraudulent charges on purchases involving chip-enabled cards that were instead merely swiped through a regular mag-stripe reader at the point of purchase.</p>
<p>If there is a silver lining in this breach of a major silver screens operator, perhaps it is this: One source in the financial industry told this author that the breach at B&amp;B persisted for so long that a decent percentage of the cards listed in the alerts his employer received from the credit card companies had been listed as compromised in other major breaches and so had already been canceled and re-issued.</p>
<p>Interested in learning the back story of why the United States is embarrassingly the last of the G20 nations to move to more secure chip-based cards? Ever wondered why so many retailers have chip-enabled readers at the checkout counter but are still asking you to swipe? Curious about how cyber thieves have adapted to this bonanza of credit card booty? If you answered &#8220;yes&#8221; to any of the above questions, you may find these stories useful and/or interesting.</p>
<p><a href="https://krebsonsecurity.com/2014/08/why-so-many-card-breaches-a-qa/" target="_blank">Why So Many Card Breaches?</a></p>
<p><a href="https://krebsonsecurity.com/2016/02/the-great-emv-fake-out-no-chip-for-you/" target="_blank">The Great EMV Fake-Out: No Chip for You!</a></p>
<p><a href="https://krebsonsecurity.com/2016/12/visa-delays-chip-deadline-for-pumps-to-2020/" target="_blank">Visa Delays Chip Deadline for Pumps to 2020</a></p>
<p><a href="https://krebsonsecurity.com/2014/10/chip-pin-vs-chip-signature/" target="_blank">Chip &amp; PIN vs. Chip and Signature</a></p>


feed_id: https://krebsonsecurity.com/?p=39856
title: Self-Service Food Kiosk Vendor Avanti Hacked
uri: Self-Service-Food-Kiosk-Vendor-Avanti-Hacked
url: https://krebsonsecurity.com/2017/07/self-service-food-kiosk-vendor-avanti-hacked/
content:
<p><strong>Avanti Markets,</strong> a company whose self-service payment kiosks sit beside shelves of snacks and drinks in thousands of corporate breakrooms across America, has suffered of breach of its internal networks in which hackers were able to push malicious software out to those payment devices, the company has acknowledged. The breach may have jeopardized customer credit card accounts <em>as well as biometric data</em>, Avanti warned.</p>
<p>According to Tukwila, Wash.-based Avanti&#8217;s marketing literature, some 1.6 million customers use the company&#8217;s break room self-checkout devices &#8212; which allow customers to pay for drinks, snacks and other food items with a credit card, fingerprint scan or cash.</p>
<div id="attachment_39870" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39870" src="media/cba52742.avanti-580x623.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/avanti-580x623.png" alt="An Avanti Markets kiosk. Image: Avanti" width="580" height="623" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/avanti-580x623.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/avanti.png 621w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An Avanti Markets kiosk. Image: Avanti</p></div>
<p>Sometime in the last few hours, Avanti published a &#8220;<a href="http://www.avantimarkets.com/notice-of-data-breach/?utm_source=avantiwebsite&amp;utm_medium=breach&amp;utm_campaign=databreach" target="_blank">notice of data breach</a>&#8221; on its Web site.</p>
<p>&#8220;On July 4, 2017, we discovered a sophisticated malware attack which affected kiosks at some Avanti Markets. Based on our investigation thus far, and although we have not yet confirmed the root cause of the intrusion, it appears the attackers utilized the malware to gain unauthorized access to customer personal information from some kiosks. Because not all of our kiosks are configured or used the same way, personal information on some kiosks may have been adversely affected, while other kiosks may not have been affected.&#8221;</p>
<p>Avanti said it appears the malware was designed to gather certain payment card information including the cardholder’s first and last name, credit/debit card number and expiration date.</p>
<p><a href="https://krebsonsecurity.com/?s=pos+vendor+breach&amp;x=0&amp;y=0" target="_blank">Breaches at point-of-sale vendors</a> have become almost regular occurrences over the past few years, but this breach is especially notable as it may also have jeopardized customer biometric data. That&#8217;s because the newer Avanti kiosk systems allow users to <a href="http://www.avantimarkets.com/blog/2017/01/fun-facts-your-fingerprint/" target="_blank">pay using a scan of their fingerprint</a>.</p>
<p>&#8220;In addition, users of the Market Card option may have had their names and email addresses compromised, as well as their biometric information if they used the kiosk’s biometric verification functionality,&#8221; the company warned.</p>
<p>On Thursday, KrebsOnSecurity learned from a source at a law firm that the food vending machine in its employee lunchroom was no longer able to accept credit cards. The source said his firm&#8217;s information technology personnel told him the credit card functionality had been temporarily disabled because of a breach at Avanti.</p>
<p>Another source told this author that Avanti&#8217;s corporate network had been breached, and that Avanti had made the decision to turn off all self-checkouts for now &#8212; although the source said customers could still use cash at the machines.</p>
<p>&#8220;I was told that about half of the self-checkouts do not have P2Pe,&#8221; the source said, on condition of anonymity. P2Pe is short for &#8220;point-to-point encryption,&#8221; and it&#8217;s a technological solution that encrypts sensitive data such as credit card information at every point in the card transaction. In theory, P2Pe should to be able to protect card data even if there is malicious software resident on the device or network in question.</p>
<p>Avanti said in its notice that it had shut down payment processing at some locations, and that the company was working with its operators to purge infected systems of any malware from the attack and to take steps to &#8220;substantially minimize the risk of a data compromise in the future.&#8221;</p>
<h4>THE MALWARE</h4>
<p>On Friday evening, security firm <strong>Risk Analytics </strong>published <a href="https://www.riskanalytics.com/blog/post.php?s=2017-07-07-coming-to-a-break-room-near-you-point-of-sale-malware" target="_blank">a blog post</a> that detailed an experience from a customer who shared a remarkably similar experience to the one referenced by the anonymous law firm source above.</p>
<p>Risk Analytics&#8217;s <strong>Noah Dunker</strong> wrote that the company&#8217;s technology on July 4 flagged suspicious behavior by a break room vending kiosk. Further inspection of the device and communications traffic emanating from it revealed it was infected with a family of <a href="https://krebsonsecurity.com/2015/04/pos-providers-feel-brunt-of-poseidon-malware/" target="_blank">point-of-sale malware known as PoSeidon</a> (a.k.a. &#8220;FindPOS&#8221;) that siphons credit card data from point-of-sale devices.</p>
<p>&#8220;In our analysis of the incident, it seems most likely that the larger vendor was compromised, and some or all of the kiosks maintained by local vendors were impacted,&#8221; Dunker wrote. &#8220;We’ve been able to identify at least two smaller vendors with local operations that have been impacted in two different cities though we are not naming any impacted vendors yet, as we’ve been unable to contact them directly.&#8221;</p>
<p>KrebsOnSecurity reached out to Risk Analytics to see if the vendor of the snack machine used by the victim organization he wrote about also was Avanti. Dunker confirmed that the kiosk vendor that was the subject of his post was indeed Avanti.</p>
<p>Dunker noted that much like point-of-sale devices at many restaurant chains, these snack machines usually are installed and managed by third-party technology companies, adding another layer of complexity to the challenge of securing these devices from hackers.</p>
<p>Dunker said Risk Analytics first noticed something wasn&#8217;t right with its client&#8217;s break room snack machine after it began sending data out of the client&#8217;s network using <a href="https://sslbl.abuse.ch/intel/169fcafd6f04e3f0179483e10281bcfbbbedf773" target="_blank">an SSL encryption certificate</a> that has long been associated with cybercrime activity &#8212; including <a href="https://en.wikipedia.org/wiki/TorrentLocker" target="_blank">ransomware activity</a> dating back to 2015.</p>
<p>&#8220;This is a textbook example of an &#8216;Internet of Things&#8217; (IoT) threat: A network-connected device, controlled and maintained by a third party, which cannot be easily patched, audited, or controlled by your own IT staff,&#8221; Dunker wrote.<span id="more-39856"></span></p>
<h4>ANALYSIS</h4>
<p>Credit card machines and point-of-sale devices are favorite targets of malicious hackers, mainly because the data stolen from those systems is very easy to monetize. However, the point-of-sale industry has a fairly atrocious record of building insecure products and trying to tack on security only after the products have already gone to market. Given this history, it&#8217;s remarkable that some of these same vendors are now encouraging customers to entrust them with biometric data.</p>
<p>Credit cards can be re-issued, but biometric identifiers are for life. Companies that choose to embed biometric capabilities in their products should be held to a far higher security standard than those used to protect card data.</p>
<p>For starters, any device that requests, stores or transmits biometric data should at a minimum ensure that the data remains strongly encrypted both at rest and in transit. Judging by Avanti&#8217;s warning that some customer biometric data may have been compromised in this breach, it seems this may not have been the case for at least a subset of their products.</p>
<p>I would like see some industry acknowledgement of this before we start to see more stand-alone payment applications entice users to supply biometric data, but I share Dunker&#8217;s fear that we may soon see biometric components added to a whole host of Internet-connected (IoT) devices that simply were not designed with security in mind.</p>
<p>Also, breaches like this illustrate why it&#8217;s critically important for organizations to segment their internal networks, and to keep payment systems completely isolated from the rest of the network. However, neither of the victim organizations referenced above appear to have taken this important precaution.</p>
<p>To illustrate this concept a bit further, it may well be that the criminal masterminds behind this attack could have made far more money had they used the remote access they apparently had to these Avanti devices to push ransomware out to Microsoft Windows computers residing on the same internal network as the payment kiosks.</p>


feed_id: https://krebsonsecurity.com/?p=39904
title: Adobe, Microsoft Push Critical Security Fixes
uri: 2017-07-12-Adobe-Microsoft-Push-Critical-Security-Fixes
url: https://krebsonsecurity.com/2017/07/adobe-microsoft-push-critical-security-fixes-11/
content:
<p>It&#8217;s Patch Tuesday, again. That is, if you run <strong>Microsoft Windows</strong> or <strong>Adobe</strong> products. Microsoft issued a dozen patch bundles to fix at least 54 security flaws in Windows and associated software. Separately, Adobe&#8217;s got a new version of its <strong>Flash Player</strong> available that addresses at least three vulnerabilities.</p>
<p><img class="alignright size-full wp-image-26837" src="media/d85cffb4.brokenwindows.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="brokenwindows" width="229" height="240" />The updates from Microsoft concern many of the usual program groups that seem to need monthly security fixes, including Windows, <strong>Internet Explorer</strong>, <strong>Edge</strong>, <strong>Office</strong>, <strong>.NET Framework</strong> and <strong>Exchange.</strong></p>
<p>According to security firm <strong>Qualys</strong>, the Windows update that is most urgent for enterprises tackles <a href="https://support.microsoft.com/en-au/help/4032955/windows-search-remote-code-execution-vulnerability" target="_blank">a critical bug</a> in the Windows Search Service that could be exploited remotely via the <a href="https://en.wikipedia.org/wiki/Server_Message_Block" target="_blank">SMB file-sharing service</a> built into both Windows workstations and servers.</p>
<p>Qualys says the issue affects Windows Server 2016, 2012, 2008 R2, 2008 as well as desktop systems like Windows 10, 7 and 8.1.</p>
<p>&#8220;While this vulnerability can leverage SMB as an attack vector, this is not a vulnerability in SMB itself, and is not related to the recent SMB vulnerabilities leveraged by <a href="https://en.wikipedia.org/wiki/EternalBlue" target="_blank">EternalBlue</a>, <a href="https://krebsonsecurity.com/?s=wannacry&amp;x=0&amp;y=0" target="_blank">WannaCry</a>, and <a href="https://krebsonsecurity.com/2017/06/petya-ransomware-outbreak-goes-global/" target="_blank">Petya</a>.&#8221; Qualys notes, referring to the recent rash of ransomware attacks which leveraged similar vulnerabilities.</p>
<p>Other critical fixes of note in this month&#8217;s release from Microsoft include at least three vulnerabilities in Microsoft&#8217;s built-in browser &#8212; Edge or Internet Explorer depending on your version of Windows. There are at least three serious flaws in these browsers that were publicly detailed prior to today&#8217;s release, suggesting that malicious hackers may have had some advance notice on figuring out how to exploit these weaknesses.</p>
<p><img class="alignleft size-full wp-image-18875" src="media/06f26f56.brokenflash-a.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="brokenflash-a" width="211" height="180" />As it is accustomed to doing on Microsoft&#8217;s Patch Tuesday, Adobe released a new version of its Flash Player browser plugin that addresses a trio of flaws in that program.</p>
<p>The <a href="https://helpx.adobe.com/security/products/flash-player/apsb17-21.html" target="_blank">latest update</a> brings Flash to <em>v. 26.0.0.137</em> for Windows, <strong>Mac</strong> and <strong>Linux</strong> users alike. If you have Flash installed, you should update, hobble or remove Flash as soon as possible. To see which version of Flash your browser may have installed, check out <a href="http://www.adobe.com/software/flash/about/" target="_blank">this page</a>.<span id="more-39904"></span></p>
<p>The smartest option is probably to ditch the program once and for all and significantly increase the security of your system in the process. An extremely powerful and buggy program that binds itself to the browser, Flash is a favorite target of attackers and malware. For some ideas about how to hobble or do without Flash (as well as slightly less radical solutions) check out <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank">A Month Without Adobe Flash Player</a>.</p>
<p>If you choose to keep Flash, please update it today. The most recent versions of Flash should be available from the <a href="https://get.adobe.com/flashplayer/" target="_blank">Flash home page.</a> Windows users who browse the Web with anything other than <strong>Internet Explorer</strong> may need to apply this patch twice, once with IE and again using the alternative browser (Firefox, Opera, e.g.).</p>
<p><strong>Chrome </strong>and IE should auto-install the latest Flash version on browser restart (users may need to manually check for updates in and/or restart the browser to get the latest Flash version). A green arrow in the upper right corner of my Chrome installation today gave me the prompt I needed to update my version to the latest.</p>
<p>Chrome users may need to restart the browser to install or automatically download the latest version. When in doubt, click the vertical three dot icon to the right of the URL bar, select “Help,” then “About Chrome”: If there is an update available, Chrome should install it then.</p>
<p>As always, if you experience any issues downloading or installing any of these updates, please leave a note about it in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=39785
title: Thieves Used Infrared to Pull Data from ATM ‘Insert Skimmers’
uri: Thieves-Used-Infrared-to-Pull-Data-from-ATM-Insert-Skimmers
url: https://krebsonsecurity.com/2017/07/thieves-used-infrared-to-pull-data-from-atm-insert-skimmers/
content:
<p>A greater number of ATM skimming incidents now involve so-called &#8220;insert skimmers,&#8221; wafer-thin fraud devices made to fit snugly and invisibly inside a cash machine’s card acceptance slot. New evidence suggests that at least some of these insert skimmers &#8212; which record card data and store it on a tiny embedded flash drive  &#8212; are equipped with technology allowing them to transmit stolen card data wirelessly via infrared, the same communications technology that <a href="http://electronics.howstuffworks.com/remote-control1.htm" target="_blank">powers a TV remote control</a>.</p>
<p>Last month the Oklahoma City metropolitan area experienced rash of ATM attacks involving insert skimmers. The local <strong>KFOR</strong> news channel on June 28, 2017 <a href="http://kfor.com/2017/06/28/norman-police-warn-of-new-sophisticated-skimmers/" target="_blank">ran a story</a> stating that at least four banks in the area were hit with insert skimmers.</p>
<p>The story quoted a local police detective saying &#8220;the skimmer contains an antenna which transmits your card information to a tiny camera hidden somewhere outside the ATM.&#8221;</p>
<p>Financial industry sources tell KrebsOnSecurity that preliminary analysis of the insert skimmers used in the attacks suggests they were configured to transmit stolen card data wirelessly to the hidden camera using <a href="https://en.wikipedia.org/wiki/Infrared" target="_blank">infrared</a>, a short-range communications technology most commonly found in television remote controls.</p>
<p>Here&#8217;s a look at one of the insert skimmers that Oklahoma authorities recently seized from a compromised ATM:</p>
<div id="attachment_39887" style="width: 427px" class="wp-caption aligncenter"><img class="size-full wp-image-39887" src="media/b492b4cb.is-okdi2.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/is-okdi2.png" alt="An insert skimmer retrieved from a compromised cash machine in Oklahoma City." width="417" height="808" /><p class="wp-caption-text">An insert skimmer retrieved from a compromised cash machine in Oklahoma City. Image: KrebsOnSecurity.com.</p></div>
<p>In such an attack, the hidden camera has a dual function: To record time-stamped videos of ATM users entering their PINs; and to receive card data recorded and transmitted by the insert skimmer. In this scenario, the fraudster could leave the insert skimmer embedded in the ATM&#8217;s card acceptance slot, and merely swap out the hidden camera whenever its internal battery is expected to be depleted.</p>
<p>Of course, the insert skimmer also operates on an embedded battery, but according to my sources the skimmer in question was designed to turn on only when someone uses the cash machine, thereby preserving the battery.</p>
<p>Thieves involved in skimming attacks have hidden spy cameras in some pretty ingenious places, such as a brochure rack to the side of the cash machine or <a href="https://krebsonsecurity.com/2011/01/atm-skimmers-that-never-touch-the-atm/" target="_blank">a safety mirror</a> affixed above the cash machine (some ATMs legitimately place these mirrors so that customers will be alerted if someone is standing behind them at the machine).</p>
<p>More often than not, however, hidden cameras are placed behind tiny pinholes cut into false fascias that thieves install directly above or beside the PIN pad. Unfortunately, I don&#8217;t have a picture of a hidden camera used in the recent Oklahoma City insert skimming attacks.</p>
<p>Here&#8217;s a closer look at the insert skimmer found in Oklahoma:</p>
<div id="attachment_39886" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39886" src="media/61827183.is-okdi3-580x614.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/is-okdi3-580x614.png" alt="Image: KrebsOnSecurity.com." width="580" height="614" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/is-okdi3-580x614.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/is-okdi3-768x813.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/is-okdi3.png 793w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Image: KrebsOnSecurity.com.</p></div>
<p>A source at a financial institution in Oklahoma shared the following images of the individuals who are suspected of installing these insert skimming devices.</p>
<div id="attachment_39889" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39889" src="media/094e8589.skimmerdudes-580x408.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/skimmerdudes-580x408.png" alt="Individuals suspected of installing insert skimmers in a rash of skimming attacks last month in Oklahoma City. Image: KrebsOnSecurity.com." width="580" height="408" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/skimmerdudes-580x408.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/skimmerdudes.png 661w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">Individuals suspected of installing insert skimmers in a rash of skimming attacks last month in Oklahoma City. Image: KrebsOnSecurity.com.</p></div>
<p>As this skimming attack illustrates, most skimmers rely on a hidden camera to record the victim&#8217;s PIN, so it&#8217;s a good idea to cover the pin pad with your hand, purse or wallet while you enter it.</p>
<p>Yes, there are skimming devices that rely on non-video methods to obtain the PIN (such as <a href="media/b2afe186.skimgallery1.jpg" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2010/08/skimgallery1.jpg" target="_blank">PIN pad overlays</a>), but these devices are comparatively rare and quite a bit more expensive for fraudsters to build and/or buy.</p>
<p>So cover the PIN pad. It also protects you against some ne&#8217;er-do-well behind you at the ATM &#8220;shoulder surfing&#8221; you to learn your PIN (which would likely be followed by a whack on the head).</p>
<p>It&#8217;s an elegant and simple solution to a growing problem. But you&#8217;d be amazed at <a href="http://krebsonsecurity.com/2012/09/a-handy-way-to-foil-atm-skimmer-scams/" target="_blank">how many people fail to take this basic, hassle-free precaution</a>.</p>
<p>If you&#8217;re as fascinated as I am with all these skimming devices, check out my series <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank">All About Skimmers</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39919
title: Porn Spam Botnet Has Evil Twitter Twin
uri: Porn-Spam-Botnet-Has-Evil-Twitter-Twin
url: https://krebsonsecurity.com/2017/07/porn-spam-botnet-has-evil-twitter-twin/
content:
<p>Last month KrebsOnSecurity published research into a large distributed network of apparently compromised systems being used to relay huge blasts of junk email promoting &#8220;online dating&#8221; programs &#8212; affiliate-driven schemes traditionally overrun with automated accounts posing as women. New research suggests that another bot-promoting botnet of more than 80,000 automated female Twitter accounts has been pimping the same dating scheme and ginning up millions of clicks from <strong>Twitter</strong> users in the process.</p>
<div id="attachment_39931" style="width: 297px" class="wp-caption alignright"><img class="size-full wp-image-39931" src="media/24647bfc.jillvaughn.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/jillvaughn.png" alt="One of the 80,000+ Twitter bots ZeroFOX found that were enticing male Twitter users into viewing their profile pages." width="267" height="425" /><p class="wp-caption-text">One of the 80,000+ Twitter bots ZeroFOX found that were enticing male Twitter users into viewing their profile pages.</p></div>
<p>Not long after I published <a href="https://krebsonsecurity.com/2017/06/inside-a-porn-pimping-spam-botnet/" target="_blank">Inside a Porn-Pimping Spam Botnet</a>, I heard from researchers at <strong>ZeroFOX</strong>, a security firm that helps companies block attacks coming through social media.</p>
<p><strong>Zack Allen</strong>, manager of threat operations at ZeroFOX, said he had a look at some of the spammy, adult-themed domains being promoted by the botnet in my research and found they were all being promoted through a botnet of bogus Twitter accounts.</p>
<p>Those phony Twitter accounts all featured images of attractive or scantily-clad women, and all were being promoted via suggestive tweets, Allen said.</p>
<p>Anyone who replied was ultimately referred to subscription-based online dating sites run by <strong>Deniro Marketing</strong>, a company based in California. This was the same company that was found to be the beneficiary of spam from <a href="https://krebsonsecurity.com/2017/06/inside-a-porn-pimping-spam-botnet/" target="_blank">the porn botnet I&#8217;d written about in June</a>. Deniro did not respond to requests for comment.</p>
<p>&#8220;We&#8217;ve been tracking this thing since February 2017, and we concluded that the social botnet controllers are probably not part of Deniro Marketing, but most likely are affiliates,&#8221; Allen said.</p>
<p>ZeroFOX found more than 86,262 Twitter accounts were responsible for more than 8.6 million posts on Twitter promoting porn-based sites, many of them promoting domains in a swath of Internet address space owned by Deniro Marketing (<a href="https://bgpview.io/asn/19884#prefixes-v4" target="_blank">ASN19984</a>).</p>
<p>Allen said 97.4% of bot display names had the pattern “Firstname Surname” with the first letters of each name capitalized, and each name separated by a single whitespace character that corresponded to common female names.</p>
<div id="attachment_39934" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39934" src="media/37232bbc.botnames-580x466.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/botnames-580x466.png" alt="An analysis of the Twitter bot names used in the scheme. Graphic: ZeroFOX." width="580" height="466" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/botnames-580x466.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/botnames.png 765w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">An analysis of the Twitter bot names used in the scheme. Graphic: ZeroFOX.</p></div>
<p>The accounts advertise adult content by routinely injecting links from their twitter profiles to a popular hashtag, or by @-mentioning a popular user or influencer on Twitter. Those profile links are shortened with Google&#8217;s <strong>goo.gl</strong> link shortening service, which then redirects to a free hosting domain in the <strong>dot-tk (.tk)</strong> domain space (.tk is the country code for Tokelau &#8212; a group of atolls in the South Pacific).</p>
<p>From there the system is smart enough to redirect users back to Twitter if they appear to be part of any automated attempt to crawl the links (e.g. by using site download and mirroring tools like <a href="https://en.wikipedia.org/wiki/CURL" target="_blank">cURL</a>), the researchers found. They said this was likely a precaution on the part of the spammers to avoid detection by automated scanners looking for bot activity on Twitter. Requests from visitors who look like real users responding to tweets are redirected to the porn spam sites.</p>
<p>Because the links promoted by those spammy Twitter accounts all abused short link services from Twitter and Google, the researchers were able to see that this entire botnet has generated more than 30 million unique clicks from February to June 2017.<span id="more-39919"></span></p>
<p>[SIDE NOTE: Anyone seeking more context about what&#8217;s being promoted here can check out the Web site datinggold[dot]com [Caution: Not-Safe-for-Work], which suggests it&#8217;s an affiliate program that rewards marketers who drive new signups to its array of &#8220;online dating&#8221; offerings &#8212; mostly &#8220;cheating,&#8221; &#8220;hookup&#8221; and &#8220;affair-themed&#8221; sites like &#8220;AdsforSex,&#8221; &#8220;Affair Hookups,&#8221; and &#8220;LocalCheaters.&#8221; Note that this program is only interested in male signups.]</p>
<div id="attachment_39930" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39930" src="media/b6e1aa60.dg-580x326.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/dg-580x326.png" alt="The datinggold affiliate site which pays spammers to bring male signups to &quot;online dating&quot; services." width="580" height="326" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/dg-580x326.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dg-768x432.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dg-940x529.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/dg.png 1089w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The datinggold affiliate site which pays spammers to bring male signups to &#8220;online dating&#8221; services.</p></div>
<p>Allen said the Twitter botnet relies heavily on accounts that have been &#8220;aged&#8221; for a period of time as another method to evade anti-spam techniques used by Twitter, which may treat tweets from new accounts with more prejudice than those from established accounts. ZeroFOX said about 20 percent of the Twitter accounts identified as part of the botnet were aged at least one year before sending their first tweet, and that the botnet overall demonstrates that these affiliate programs have remained lucrative by evolving to harness social media.</p>
<p>&#8220;The final redirect sites encourage the user to sign up for subscription pornography, webcam sites, or fake dating,&#8221; ZeroFOX wrote in a report being issued this week. &#8220;These types of sites, although legal, are known to be scams.&#8221;</p>
<p>Perhaps the most well-known example of the subscription-based dating/cheating service that turned out to be mostly phony was <strong>AshleyMadison</strong>. After AshleyMadison&#8217;s user <a href="https://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/" target="_blank">databases were plundered and published online</a>, the <a href="https://arstechnica.com/tech-policy/2016/07/ashley-madison-admits-using-fembots-to-lure-men-into-spending-money/" target="_blank">company admitted that its service used at least 70,000 female chatbots</a> that were programmed to message new users and try to entice them into replying &#8212; which required a paid account.</p>
<p>&#8220;Many of the sites&#8217; policies claim that the site owners operate most of the profiles,&#8221; ZeroFOX charged. &#8220;They also have overbearing policies that can use personally information of their customers to send to other affiliate programs, yielding more spam to the victim. Much like the infamous ‘<a href="https://krebsonsecurity.com/2010/11/pursuing-koobface-and-partnerka/" target="_blank">partnerka’</a> networks from the <a href="https://krebsonsecurity.com/?s=russian+business+network&amp;x=0&amp;y=0" target="_blank">Russian Business Network</a>, money is paid out via clicks and signups on affiliate programs&#8221; [links added].</p>
<p>Although the Twitter botnet discovered by ZeroFOX has since been dismantled, it not hard to see how this same approach could be very effective at spreading malware. Keep your wits about you while using or cruising social media sites, and be wary of any posts or profiles that match the descriptions and behavior of the bot accounts described here.</p>
<p>For more on this research, see ZeroFOX&#8217;s blog post <a href="http://www.zerofox.com/blog/inside-massive-siren-social-network-spam-botnet" target="_blank">Inside a Massive Siren Social Network Spam Botnet</a>.</p>


feed_id: https://krebsonsecurity.com/?p=39949
title: Experts in Lather Over ‘gSOAP’ Security Flaw
uri: Experts-in-Lather-Over-gSOAP-Security-Flaw
url: https://krebsonsecurity.com/2017/07/experts-in-lather-over-gsoap-security-flaw/
content:
<p><strong>Axis Communications</strong> &#8212; a maker of high-end security cameras whose devices can be found in many high-security areas &#8212; recently patched a dangerous coding flaw in virtually all of its products that an attacker could use to remotely seize control over or crash the devices.</p>
<p>The problem wasn&#8217;t specific to Axis, which seems to have reacted far more quickly than competitors to quash the bug. Rather, the vulnerability resides in open-source, third-party computer code that has been used in countless products and technologies (including a great many security cameras), meaning it may be some time before most vulnerable vendors ship out a fix &#8212; and even longer before users install it.<img class="aligncenter size-medium wp-image-39961" src="media/a4c662c0.cam2cam-580x292.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/cam2cam-580x292.png" alt="cam2cam" width="580" height="292" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/cam2cam-580x292.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/cam2cam-768x386.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/cam2cam-940x472.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/cam2cam.png 1353w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>At issue is a flaw in a bundle of reusable code (often called a &#8220;<a href="https://en.wikipedia.org/wiki/Library_(computing)" target="_blank">code library</a>&#8220;) known as <a href="http://www.cs.fsu.edu/~engelen/soap.html" target="_blank">gSOAP</a>, a widely-used toolkit that software or device makers can use so that their creations can talk to the Internet (or &#8220;<a href="http://xml.silmaril.ie/parsers.html" target="_blank">parse XML</a>&#8221; for my geek readers). By some estimates, there are hundreds &#8212; if not thousands &#8212; of security camera types and other so-called &#8220;Internet of Things&#8221;(IoT) devices that rely upon the vulnerable gSOAP code.</p>
<p>By exploiting the bug, an attacker could force a vulnerable device to run malicious code, block the owner from viewing any video footage, or crash the system. Basically, lots of stuff you <em>don&#8217;t</em> want your pricey security camera system to be doing.</p>
<p><a href="https://www.genivia.com/dev.html" target="_blank">Genivia</a>, the company that maintains gSOAP, released <a href="https://www.genivia.com/advisory.html" target="_blank">an update</a> on June 21, 2017 that fixes the flaw. In short order, Axis released a patch to plug the gSOAP hole <a href="media/ea96ead1.ACV116267_CVE-2017-9765.pdf" data-original-source="https://www.axis.com/files/faq/ACV116267_(CVE-2017-9765).pdf" target="_blank">in nearly 250 of its products.</a></p>
<p>Genivia chief executive <strong>Robert Van Engelen</strong> said his company has already reached out to all of its customers about the issue. He said a majority of customers use the gSOAP software to develop products, but that mostly these are client-side applications or non-server applications that are not affected by this software crash issue.</p>
<p>&#8220;It&#8217;s a crash, not an exploit as far as we know,&#8221; Van Engelen said. &#8220;I estimate that over 85% of the applications are unlikely to be affected by this crash issue.&#8221;</p>
<p>Still, there are almost certainly dozens of other companies that use the vulnerable gSOAP code library and haven&#8217;t (or won&#8217;t) issue updates to fix this flaw, says <strong>Stephen Ridley</strong>, chief technology officer and founder of <a href="https://www.senr.io" target="_blank">Senrio</a> &#8212; the security company that discovered and reported the bug. What&#8217;s more, because the vulnerable code is embedded within device firmware (the built-in software that powers hardware), there is no easy way for end users to tell if the firmware is affected without word one way or the other from the device maker.</p>
<p><span class="pullquote pqleft">&#8220;It is likely that tens of millions of products &#8212; software products and connected devices &#8212; are affected by this,&#8221; Ridley said.</span></p>
<p>&#8220;Genivia claims to have more than 1 million downloads of gSOAP (most likely developers), and IBM, Microsoft, Adobe and Xerox as customers,&#8221; the Senrio <a href="http://blog.senr.io/blog/devils-ivy-flaw-in-widely-used-third-party-code-impacts-millions" target="_blank">report</a> reads. &#8220;On <a href="https://sourceforge.net/projects/gsoap2/" target="_blank" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://sourceforge.net/projects/gsoap2/&amp;source=gmail&amp;ust=1500467125244000&amp;usg=AFQjCNGpDxyPsup7T43kRBPMkg868Y5Z5g">Sourceforge</a>, gSOAP was downloaded more than 1,000 times in one week, and <a href="https://sourceforge.net/projects/gsoap2/files/stats/timeline?dates=2017-01-01+to+2017-07-12" target="_blank" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://sourceforge.net/projects/gsoap2/files/stats/timeline?dates%3D2017-01-01%2Bto%2B2017-07-12&amp;source=gmail&amp;ust=1500467125244000&amp;usg=AFQjCNEf95bdjBgjOF476fvciXqEdhqRlA">30,000 times in 2017</a>. Once gSOAP is downloaded and added to a company’s repository, it’s likely used many times for different product lines.&#8221;<br />
<span id="more-39949"></span></p>
<p>Anyone familiar with the stories published on this blog over the past year knows that most IoT devices &#8212; security cameras in particular &#8212; <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank">do not have a stellar history</a> of shipping in a default-secure state (heck, many of these devices are <a href="https://krebsonsecurity.com/2016/12/researchers-find-fresh-fodder-for-iot-attack-cannons/" target="_blank">running versions of Linux that date back more than a decade</a>). Left connected to the Internet in an insecure state, these devices can quickly be infected with IoT threats like <a href="https://en.wikipedia.org/wiki/Mirai_(malware)" target="_blank">Mirai</a>, which enslave them for use in high-impact denial-of-service attacks designed <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank">to knock people and Web sites offline</a>.</p>
<p>When I heard about this bug I pinged the folks over at <a href="https://www.ipvm.com" target="_blank">IPVM</a>, a trade publication that tracks the video surveillance industry. IPVM Business Analyst <strong>Brian Karas</strong> said the type of flaw (known as a buffer overflow) in this case doesn&#8217;t expose the vulnerable systems to IoT worms like Mirai, which can spread to devices that are running under factory-default usernames and passwords.</p>
<p>IPVM polled almost a dozen top security camera makers, and said only two (including Axis) responded that they used the vulnerable gSOAP library in their products. Another three said they hadn&#8217;t yet determined whether any of their products were potentially vulnerable.</p>
<p>&#8220;You probably wouldn&#8217;t be able to make a universal, Mirai-style exploit for this flaw because it lacks the elements of simplicity and reproduceability,&#8221; Karas said, noting that the exploit requires that an attacker be able to upload at least a 2 GB file to the Web interface for a vulnerable device.</p>
<p>&#8220;In my experience, I don&#8217;t think it&#8217;s that common for embedded systems to accept a 2-gigabyte file upload,&#8221; Karas said. &#8220;Every device is going to respond slightly differently, and it would probably take a lot of time to research each device and put together some kind of universal attack tool. Yes, people should be aware of this and patch if they can, but this is nowhere near as bad as [the threat from] Mirai.&#8221;</p>
<p>Karas said similar to most other cyber security vulnerabilities in network devices, restricting network access to the unit will greatly reduce the chance of exploit.</p>
<p>&#8220;Cameras utilizing a VMS (<a href="https://en.wikipedia.org/wiki/Video_management_system" target="_blank">video management system</a>) or recorder for remote access, instead of being directly connected to the internet, are essentially immune from remote attack (though it is possible for the VMS itself to have vulnerabilities),&#8221; IPVM wrote in an analysis of the gSOAP bug. In addition, changing the factory default settings (e.g., picking decent administrator passwords) and updating the firmware on the devices to the latest version may go a long way toward sidestepping any vulnerabilities.</p>


feed_id: https://krebsonsecurity.com/?p=39981
title: Trump Hotels Hit By 3rd Card Breach in 2 Years
uri: Trump-Hotels-Hit-By-3rd-Card-Breach-in-2-Years
url: https://krebsonsecurity.com/2017/07/trump-hotels-hit-by-3rd-card-breach-in-2-years/
content:
<p>Maybe some of you missed this amid all the breach news recently (I know I did), but <strong>Trump International Hotels Management LLC</strong> last week announced its third credit-card data breach in the past two years. I thought it might be useful to see these events plotted on a timeline, because it suggests that virtually anyone who used a credit card at a Trump property in the past two years likely has had their card data stolen and put on sale in the cybercrime underground as a result.</p>
<p>On May 2, 2017, KrebsOnSecurity broke the story that travel industry giant <strong>Sabre Corp.</strong> experienced <a href="https://krebsonsecurity.com/2017/05/breach-at-sabre-corp-s-hospitality-unit/" target="_blank">a significant breach</a> of its payment and customer data tied to bookings processed through a reservations system that serves more than 32,000 hotels and other lodging establishments. Last week, Trump International Hotels disclosed the SABRE breach impacted at least 13 Trump Hotel properties between August 2016 and March 2017. Trump Hotels said it was first notified of the breach on June 5.</p>
<div id="attachment_39984" style="width: 590px" class="wp-caption aligncenter"><a class="lightbox" href="media/d56defbc.trumptime.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/trumptime.png"> <img class="wp-image-39807 size-medium" src="media/2cc2a383.trumptime-580x102.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/trumptime-580x102.png" alt=" " width="580" height="200" /></a><p class="wp-caption-text">A timeline of Trump Hotels&#8217; credit card woes over the past two years. Click to enlarge.</p></div>
<p>According to <strong>Verizon</strong>‘s latest annual <a href="http://www.verizonenterprise.com/verizon-insights-lab/dbir/" target="_blank">Data Breach Investigations Report</a> (DBIR), malware attacks on point-of-sale systems used at front desk and hotel restaurant systems “are absolutely rampant” in the hospitality sector. Accommodation was the top industry for point-of-sale intrusions in this year’s data, with 87% of breaches within that pattern.</p>
<p>Other hotel chains that disclosed this past week getting hit in the Sabre breach include 11 <a href="http://www.prnewswire.com/news-releases/hard-rock-hotels--casinos-notifies-guests-of-third-party-vendor-security-incident-300484079.html" target="_blank">Hard Rock</a> properties (another chain hit by <a href="https://www.scmagazine.com/payment-card-breach-at-hard-rock-hotel-casino-las-vegas/article/529306/" target="_blank">multiple card breach incidents</a>); <a href="media/7a04608d.0Impacting20Guest20Payment20Card20Information206867562x7AB84.pdf" data-original-source="http://www.fourseasons.com/content/dam/fourseasons/web/pdfs/Notice%20of%20Sabre%20Data%20Security%20Incident%20Impacting%20Guest%20Payment%20Card%20Information%20(6867562x7AB84).pdf" target="_blank">Four Seasons Hotels and Resorts</a>; and at least two dozen <a href="https://www.loewshotels.com/guest-payment-card-information" target="_blank">Loews Hotels</a> in the United States and Canada.</p>
<h4>ANALYSIS/RANT</h4>
<p>Given its abysmal record of failing to protect customer card data, you might think the hospitality industry would be anxious to assuage guests who may already be concerned that handing over their card at the hotel check-in desk also means consigning that card to cybercrooks (e.g. at underground carding shops like <a href="https://krebsonsecurity.com/2017/05/trumps-dumps-making-dumps-great-again/" target="_blank">Trumps Dumps</a>).</p>
<p>However, so far this year I&#8217;ve been hard-pressed to find any of the major hotel chains that accept more secure chip-based cards, which are designed to make card data stolen by point-of-sale malware and skimmers much more difficult to turn into counterfeit cards. I travel quite a bit &#8212; at least twice a month &#8212; and I have yet to experience a single U.S.-based hotel in the past year asking me to dip my chip-based card as opposed to swiping it.</p>
<div id="attachment_39492" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-39492" src="media/52efd1b8.trumpsdumps-580x395.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png" alt="A carding shop that sells stolen credit cards and invokes 45's likeness and name. No word yet on whether this cybercriminal store actually sold any cards stolen from Trump Hotel properties." width="580" height="395" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-580x395.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-768x524.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps-940x641.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/05/trumpsdumps.png 1295w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">A carding shop that sells stolen credit cards and invokes 45&#8217;s likeness and name. No word yet on whether this cybercriminal store actually sold any cards stolen from Trump Hotel properties.</p></div>
<p>True, chip cards alone aren&#8217;t going to solve the whole problem. Hotels and other merchants that implement the ability to process chip cards still need to ensure the data is encrypted at every step of the transaction (known as &#8220;point-to-point&#8221; or &#8220;end-to-end&#8221; encryption). Investing in technology like tokenization &#8212; which allows merchants to store a code that represents the customer&#8217;s card data instead of the card data itself &#8212; also can help companies become less of a target.</p>
<p>Maybe it wouldn&#8217;t be so irksome if those of us concerned about security or annoyed enough at getting our cards replaced three or four times a year due to fraud could stay at a major hotel chain in the United States and simply pay with cash. But alas, we&#8217;re talking about an industry that essentially <em>requires</em> customers to pay by credit card.</p>
<p><span class="pullquote pqleft">Well, at least I&#8217;ll continue to accrue reward points on my credit card that I can use toward future rounds of Russian roulette with the hotel&#8217;s credit card systems.</span></p>
<p>It&#8217;s bad enough that cities and states routinely levy huge taxes on lodging establishments (the idea being the tax is disproportionately paid by people who don&#8217;t vote or live in the area); now we have the industry-wide &#8220;carder tax&#8221; conveniently added to every stay.<span id="more-39981"></span></p>
<p>What&#8217;s the carder tax you ask? It&#8217;s the sense of dread and the incredulous &#8220;really?&#8221; that wells up when one watches his chip card being swiped yet again at the check-out counter.</p>
<p>It&#8217;s the time wasted on the phone with your bank trying to sort out whether you really made all those fraudulent purchases, and then having to enter your new card number at all those sites and services where the old one was stored. It&#8217;s that awkward moment when the waiter says in front of your date or guests that your card has been declined.</p>
<p>If you&#8217;re brave enough to pay for everything with a debit card (<a href="http://clark.com/personal-finance-credit/dangers-of-debit-cards-how-to-avoid-fraud-theft/" target="_blank">bad idea</a>), it may be the time you spend without access to cash while your bank sorts things out. It may be the aggravation of dealing with bounced checks as a result of the fraud.</p>
<p>I can recall a recent stay wherein right next to the credit card machine at the hotel&#8217;s front desk was a stack of various daily newspapers, one of which had a very visible headline warning of an ongoing credit card breach at the same hotel that was getting ready to swipe my card yet again (by the way, I&#8217;m still kicking myself for not snapping a selfie right then).</p>
<p>After I checked out of that particular hotel, I descended to the parking garage to retrieve a rental car. The garage displayed large signs everywhere warning customers that the property was not responsible for any damage or thefts that may be inflicted on vehicles parked there. I recall thinking at the time that this same hotel probably should have been required to display a similar sign over their credit card machines (actually, they all should).</p>
<p>&#8220;The privacy and protection of our guests’ information is a matter we take very seriously.&#8221; This is from boilerplate text found in both the Trump Hotels and Loews Hotel statements. It sounds nice. Too bad it&#8217;s all hogwash. Once again, the timeline above speaks far more about the hospitality industry&#8217;s attitudes on credit card security than any platitudes offered in these all-too-common breach notifications.</p>
<p>Further reading: </p>
<p><a href="https://krebsonsecurity.com/2015/07/banks-card-breach-at-trump-hotel-properties/" target="_blank">Banks: Card Breach at Trump Hotel Properties</a><br />
<a href="https://krebsonsecurity.com/2015/10/trump-hotel-collection-confirms-card-breach/" target="_blank">Trump Hotel Collection Confirms Card Breach</a><br />
<a href="https://krebsonsecurity.com/2016/04/sources-trump-hotels-breached-again/" target="_blank">Sources: Trump Hotels Breached Again</a><br />
<a href="http://fortune.com/2016/09/23/trump-hotels-settles-new-york-data-breaches/" target="_blank">Trump Hotels Settles Over Data Breach: To Pay $50,000 for 70,000 Stolen Cards</a><br />
<a href="https://krebsonsecurity.com/2017/05/breach-at-sabre-corp-s-hospitality-unit/" target="_blank">Breach at Sabre Corp.&#8217;s Hospitality Unit</a></p>


feed_id: https://krebsonsecurity.com/?p=40048
title: Exclusive: Dutch Cops on AlphaBay ‘Refugees’
uri: Exclusive-Dutch-Cops-on-AlphaBay-Refugees
url: https://krebsonsecurity.com/2017/07/exclusive-dutch-cops-on-alphabay-refugees/
content:
<p>Following <a href="https://krebsonsecurity.com/2017/07/after-alphabays-demise-customers-flocked-to-dark-market-run-by-dutch-police/" target="_blank">today&#8217;s breaking news</a> about U.S. and international authorities taking down the competing Dark Web drug bazaars <strong>AlphaBay</strong> and <strong>Hansa Market</strong>, KrebsOnSecurity caught up with the Dutch investigators who took over Hansa on June 20, 2017. When U.S. authorities shuttered AlphaBay on July 5, police in The Netherlands saw a massive influx of AlphaBay refugees who were unwittingly fleeing directly into the arms of investigators. What follows are snippets from an exclusive interview with <strong>Petra Haandrikman</strong>, team leader of the Dutch police unit that infiltrated Hansa.</p>
<p>Vendors on both AlphaBay and Hansa sold a range of black market items &#8212; most especially controlled substances like heroin. According to the <strong>U.S. Justice Department</strong>, AlphaBay alone had some 40,000 vendors who marketed a quarter-million sales listings for illegal drugs to more than 200,000 customers. The DOJ said that as of earlier this year, AlphaBay had 238 vendors selling heroin. Another 122 vendors advertised <a href="https://en.wikipedia.org/wiki/Fentanyl" target="_blank">Fentanyl</a>, an extremely potent synthetic opioid that has been linked to countless overdoses and deaths.</p>
<p>In our interview, Haandrikman detailed the dual challenges of simultaneously dealing with the exodus of AlphaBay users to Hansa and keeping tabs on the giant increase in new illicit drug orders that were coming in daily as a result.</p>
<div id="attachment_40052" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40052" src="media/877eb74a.alphabayuser-580x515.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayuser-580x515.png" alt="The profile and feedback of a top AlphaBay vendor. " width="580" height="515" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayuser-580x515.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayuser-768x682.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayuser-940x835.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/alphabayuser.png 1126w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The profile and feedback of a top AlphaBay vendor.</p></div>
<p><strong>KrebsOnSecurity (K):</strong> Talk a bit about how your team was able to seize control over Hansa.</p>
<p><strong>Haandrikman (H):</strong> When we knew the FBI was working on AlphaBay, we thought &#8216;What&#8217;s better than if they come to us?&#8217; The FBI wanted [the AlphaBay takedown] to look like an exit scheme [where the proprietors of a dark web marketplace suddenly abscond with everyone&#8217;s money]. And we knew a lot of vendors on AlphaBay would probably come over to Hansa when AlphaBay was closed.</p>
<p><strong>K:</strong> Where was Hansa physically based?</p>
<p><strong>H:</strong> We knew the Hansa servers were in Lithuania, so we sent an <a href="https://en.wikipedia.org/wiki/Mutual_legal_assistance_treaty" target="_blank">MLAT</a> (mutual legal assistance treaty) request Lithuania and requested if we could proceed with our planned actions in their country. They were very willing to help us in our investigations.</p>
<p><strong>K:</strong> So you made a copy of the Hansa servers?</p>
<p><strong>H:</strong> We gained physical access to the machines in Lithuania, and were able to set up some clustering between the [Hansa] database servers in Lithuania and servers we were running in our country. With that, we were able to get a real time copy of the Hansa database, and then copy over the Web site code itself.</p>
<p><strong>K:</strong> Did you have to take Hansa offline for a while during this process?</p>
<p><strong>H:</strong> No, it didn&#8217;t really go offline. We were able to create our own copy of the site that was running on servers in the Netherlands. So there were two copies of the site running simultaneously.</p>
<div id="attachment_40055" style="width: 590px" class="wp-caption aligncenter"><img class="size-medium wp-image-40055" src="media/270f5e64.hansamarket-580x317.png" data-original-source="http://krebsonsecurity.com/wp-content/uploads/2017/07/hansamarket-580x317.png" alt="The now-defunct Hansa Market." width="580" height="317" srcset="http://krebsonsecurity.com/wp-content/uploads/2017/07/hansamarket-580x317.png 580w, http://krebsonsecurity.com/wp-content/uploads/2017/07/hansamarket-768x420.png 768w, http://krebsonsecurity.com/wp-content/uploads/2017/07/hansamarket-940x514.png 940w, http://krebsonsecurity.com/wp-content/uploads/2017/07/hansamarket.png 1022w" sizes="(max-width: 580px) 100vw, 580px" /><p class="wp-caption-text">The now-defunct Hansa Market.</p></div>
<p><strong>K:</strong> At a press conference on this effort at the U.S. Justice Department in Washington, D.C. today, <strong>Rob Wainwright</strong>, director of the European law enforcement organization <strong>Europol</strong>, detailed how the closure of AlphaBay caused a virtual stampede of former AlphaBay buyers and sellers taking their business to Hansa Market. Tell us more about what that influx was like, and how you handled it.</p>
<p><strong>H:</strong> Yes, we called them &#8220;AlphaBay refugees.&#8221; It wasn&#8217;t the technical challenge that caused problems. Because this was a police operation, we wanted to keep up with the orders to see if there were any large amounts [of drugs] being ordered to one place, [so that] we could share information with our law enforcement partners internationally.</p>
<p><strong>K:</strong> How exactly did you deal with that? Were you able to somehow slow down the orders coming in?</p>
<p><strong>H:</strong> We just closed registration on Hansa for new users for a few days. So there was a temporary restriction for being able to register on the site, which slowed down the orders each day to make sure that we could cope with the orders that were coming in.</p>
<p><strong>K:</strong> Did anything unexpected happen as a result?</p>
<p><strong>H:</strong> Some people started selling their Hansa accounts on Reddit. I read somewhere that one Hansa user sold his account for $40. The funny part about that was that sale happened about five minutes before we re-opened registration. There was a lot of frustration from ex-AlphaBay users that weren&#8217;t allowed to register on the site. But we also got defended by the Hansa community on social media, who said it was a great decision by us to educate certain AlphaBay users on Hansa etiquette, which doesn&#8217;t allow the sale of things permitted on AlphaBay and other dark markets, such as child pornography and firearms.<span id="more-40048"></span></p>
<p><strong>K:</strong> You mentioned earlier that the FBI wanted AlphaBay users to think that the reason for the closure of that marketplace was that its operators and administrators had conducted an &#8216;exit scam&#8217; where they ran off with all of the Bitcoin and virtual currency that vendors and buyers had stored in their marketplace wallets temporarily. Why do you think they wanted this to look like an exit scam?</p>
<p><strong>H:</strong> The idea was to hit the dark markets even harder when they think the&#8217;re just moving to an other market and it turns to be law enforcement. Breaking the trust, so that [users] would not feel safe on a dark market.</p>
<p><strong>K:</strong> It has been <a href="https://www.nytimes.com/2017/07/18/business/dealbook/hansa-market-a-dark-web-marketplace-bans-the-sale-of-fentanyl.html" target="_blank">reported</a> that just a few days ago the Hansa market administrators decided to ban the sale of Fentanyl. Were Dutch police involved in that at all?</p>
<p><strong>H:</strong> It was a combination of things. One of the site&#8217;s employees or moderators started a discussion about this drug. We obviously also had our own opinion about it. It was a pretty good dialogue between us and the Hansa moderators to ban this from the site, and [that decision received] a lot of support from the community. But we didn&#8217;t instigate that discussion.</p>
<p><strong>K:</strong> Have the Dutch police arrested anyone in connection with this investigation so far?</p>
<p><strong>H:</strong> Yes, we identified several people in the Netherlands using the site, and there have already been several arrests made [tied to] Fentanyl.</p>
<p><strong>K:</strong> Can you talk about whether your control over Hansa helped you identify users?</p>
<p><strong>H:</strong> We did use some technical tricks to find out who people are, but we can&#8217;t go into that a lot because the investigation is still going on. But we did try to change the behavior [of some Hansa users] by asking for things that helped us to identify a lot of people and money.</p>
<p><strong>K:</strong> What is your overall strategy in all of this?</p>
<p><strong>H:</strong> Our strategy is that we want people to know that the Dark Web is not an anonymous place for criminals. Don&#8217;t think you can just buy or sell your drugs there without eventually getting caught by law enforcement. We want people to know you&#8217;re not safe on the Dark Web. Sooner or later we will come to get you.</p>


