# articles

feed_id: https://krebsonsecurity.com/?p=56563
title: Microsoft Patch Tuesday, August 2021 Edition
uri: Microsoft-Patch-Tuesday-August-2021-Edition
url: https://krebsonsecurity.com/2021/08/microsoft-patch-tuesday-august-2021-edition/
content:
<p><strong>Microsoft</strong> today released software updates to plug at least 44 security vulnerabilities in its <strong>Windows</strong> operating systems and related products. The software giant warned that attackers already are pouncing on one of the flaws, which ironically enough involves an easy-to-exploit bug in the software component responsible for patching <strong>Windows 10</strong> PCs and <strong>Windows Server 2019</strong> machines.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="757" height="556" /></p>
<p>Microsoft said attackers have seized upon <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36948" target="_blank" rel="noopener">CVE-2021-36948</a>, which is a weakness in the <strong>Windows Update Medic</strong> service. Update Medic is a new service that lets users repair Windows Update components from a damaged state so that the device can continue to receive updates.</p>
<p>Redmond says while CVE-2021-36948 is being actively exploited, it is not aware of exploit code publicly available. The flaw is an &#8220;elevation of privilege&#8221; vulnerability that affects Windows 10 and <strong>Windows Server 2019</strong>, meaning it can be leveraged in combination with another vulnerability to let attackers run code of their choice as administrator on a vulnerable system.</p>
<p>&#8220;CVE-2021-36948 is a privilege escalation vulnerability &#8211; the cornerstone of modern intrusions as they allow attackers the level of access to do things like hide their tracks and create user accounts,&#8221; said <strong>Kevin Breen</strong> of <a href="https://www.immersivelabs.com" target="_blank" rel="noopener">Immersive Labs</a>. &#8220;In the case of ransomware attacks, they have also been used to ensure maximum damage.&#8221;<span id="more-56563"></span></p>
<p>According to Microsoft, critical flaws are those that can be exploited remotely by malware or malcontents to take complete control over a vulnerable Windows computer &#8212; and with little to no help from users. Top of the heap again this month: Microsoft also took another stab at fixing a broad class of weaknesses in its printing software.</p>
<p>Last month, the company rushed out an emergency update to patch &#8220;<a href="https://krebsonsecurity.com/2021/07/microsoft-issues-emergency-patch-for-windows-flaw/" target="_blank" rel="noopener">PrintNightmare</a>&#8221; &#8212; a critical hole in its Windows Print Spooler software that was being attacked in the wild. Since then, a number of researchers have discovered holes in that patch, allowing them to circumvent its protections.</p>
<p>Today&#8217;s Patch Tuesday fixes another critical Print Spooler flaw (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36936" target="_blank" rel="noopener">CVE-2021-36936</a>), but it&#8217;s not clear if this bug is a variant of PrintNightmare or a unique vulnerability all on its own, said <strong>Dustin Childs</strong> at <strong>Trend Micro&#8217;s Zero Day Initiative</strong>.</p>
<p>&#8220;Microsoft does state low privileges are required, so that should put this in the non-wormable category, but you should still prioritize testing and deployment of this Critical-rated bug,&#8221; Childs said.</p>
<p>Microsoft said the Print Spooler patch it is pushing today should address all publicly documented security problems with the service.</p>
<p>&#8220;Today we are addressing this risk by changing the default Point and Print driver installation and update behavior to require administrator privileges,&#8221; Microsoft said in a blog post. &#8220;This change may impact Windows print clients in scenarios where non-elevated users were previously able to add or update printers. However, we strongly believe that the security risk justifies the change. <span class="m_-3365397633775064127normaltextrun">This change will take effect with the installation of the </span><span class="m_-3365397633775064127normaltextrun">security updates released on </span><span class="m_-3365397633775064127normaltextrun">August 10, 2021 for all versions of Windows, and is </span><span class="m_-3365397633775064127normaltextrun">documented as <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34481" target="_blank" rel="noopener">CVE-2021-34481</a>.</span>&#8221;</p>
<p>August brings yet another critical patch (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-34535" target="_blank" rel="noopener">CVE-2021-34535</a>) for the <strong>Windows Remote Desktop</strong> service, and this time the flaw is in the Remote Desktop client instead of the server.</p>
<p><a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-26424" target="_blank" rel="noopener">CVE-2021-26424</a> &#8212; a scary, critical bug in the <strong>Windows TCP/IP</strong> component &#8212; earned a CVSS score of 9.9 (10 is the worst), and is present in <strong>Windows 7</strong> through <strong>Windows 10</strong>, and Windows Server 2008 through 2019 (Windows 7 is no longer being supported with security updates).</p>
<p>Microsoft said it was not aware of anyone exploiting this bug yet, although the company assigned it the label &#8220;exploitation more likely,&#8221; meaning it may not be difficult for attackers to figure out. CVE-2021-26424 could be exploited by sending a single malicious data packet to a vulnerable system.</p>
<p>For a complete rundown of all patches released today and indexed by severity, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+August+2021+Patch+Tuesday/27736/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it&#8217;s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/2021/defcon-2-august-updates-include-print-spooler-fixes/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that are causing problems for Windows users.</p>
<p>On that note, before you update <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.</p>


feed_id: https://krebsonsecurity.com/?p=56578
title: New Anti Anti-Money Laundering Services for Crooks
uri: New-Anti-Anti-Money-Laundering-Services-for-Crooks
url: https://krebsonsecurity.com/2021/08/new-anti-anti-money-laundering-services-for-crooks/
content:
<p>A new dark web service is marketing to cybercriminals who are curious to see how their various cryptocurrency holdings and transactions may be linked to known criminal activity. Dubbed &#8220;<strong>Antinalysis,&#8221; </strong>the service purports to offer a glimpse into how one&#8217;s payment activity might be flagged by law enforcement agencies and private companies that try to link suspicious cryptocurrency transactions to real people.</p>
<div id="attachment_56584" style="width: 771px" class="wp-caption aligncenter"><a href="media/2a7d66af.ant-result.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56584" loading="lazy" class="wp-image-56584" src="media/2a7d66af.ant-result.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result.png" alt="" width="761" height="623" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result.png 971w, https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result-768x629.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/ant-result-782x640.png 782w" sizes="(max-width: 761px) 100vw, 761px" /></a><p id="caption-attachment-56584" class="wp-caption-text">Sample provided by Antinalysis.</p></div>
<p>&#8220;Worried about dirty funds in your BTC address? Come check out Antinalysis, the new address risk analyzer,&#8221; reads the service&#8217;s announcement, pointing to a link only accessible via ToR. &#8220;This service is dedicated to individuals that have the need to possess complete privacy on the blockchain, offering a perspective from the opponent&#8217;s point of view in order for the user to comprehend the possibility of his/her funds getting flagged down under autocratic illegal charges.&#8221;</p>
<p>The ad continues:</p>
<blockquote><p>Some people might ask, why go into all that? Just cash out in XMR and be done with it. The problem is, cashing out in Monero raises eyebrows on exchanges and mail by cash method is sometimes risky as well. If you use BTC-&gt;XMR-&gt;BTC method, you&#8217;ll still get flagged down by our services labelled as high risk exchange (not to mention LE and exchanges). Our service provides you with a view from LE/exchange&#8217;s perspective of things (with similar accuracy, but quite different approach) that provides you with basic knowledge of how &#8220;clean&#8221; your address is.&#8221;</p></blockquote>
<p><strong>Tom Robinson</strong>, co-founder of blockchain intelligence firm <a href="https://www.eliptic.co" target="_blank" rel="noopener">Elliptic</a>, said Antinalysis is designed to help crypto money launderers test whether their funds will be identified as proceeds of crime by regulated financial exchanges.</p>
<p>&#8220;Cryptoassets have become an important tool for cybercriminals,&#8221; Robinson <a href="https://www.elliptic.co/blog/cybercriminals-have-built-their-own-blockchain-analytics-tool" target="_blank" rel="noopener">wrote</a>. &#8220;The likes of ransomware and darknet markets rely on payments being made in Bitcoin and other cryptocurrencies. However, laundering and cashing-out these proceeds is a major challenge.&#8221;</p>
<p>Cryptocurrency exchanges make use of blockchain analytics tools, he said, to check customer deposits for links to illicit activity. By tracing a transaction back through the blockchain, these tools can identify whether the funds originated from a wallet associated with ransomware or any other criminal activity.</p>
<p>&#8220;The launderer therefore risks being identified as a criminal and being reported to law enforcement whenever they send funds to a business using such a tool,&#8221; Robinson said. &#8220;Antinalysis seeks to help crypto launderers to avoid this, by giving them a preview of what a blockchain analytics tool will make of their bitcoin wallet and the funds it contains.&#8221;</p>
<p><img loading="lazy" class="alignright wp-image-56585" src="media/4e9d5398.antinalysis.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/antinalysis.png" alt="" width="274" height="247" /></p>
<p>Each lookup at Antinalysis costs roughly USD $3, with a minimum $30 purchase. Other plans go as high as $6,000 for 5,000 requests.</p>
<p>Robinson says the creator of Antinalysis is also one of the developers of <strong>Incognito Market</strong>, a darknet marketplace specializing in the sale of narcotics.</p>
<p>&#8220;Incognito was launched in late 2020, and accepts payments in both Bitcoin and <a href="https://en.wikipedia.org/wiki/Monero" target="_blank" rel="noopener">Monero</a>, a cryptoasset offering heightened anonymity,&#8221; he wrote. &#8220;The launch of Antinalysis likely reflects the difficulties faced by the market and its vendors in cashing out their Bitcoin proceeds.&#8221;</p>
<p>Elliptic wasn&#8217;t impressed with the quality of the intelligence provided by Antinalysis, saying it performs poorly on detecting links to major darknet markets and other criminal entities. But with countless criminals now making millions from ransomware, there is certainly a vast, untapped market for services that help those folks improve their operational security.</p>
<p>&#8220;It is also significant because it makes blockchain analytics available to the public for the first time,&#8221; Robinson wrote. &#8220;To date, this type of analysis has been used primarily by regulated financial service providers.&#8221;<span id="more-56578"></span></p>
<p>That may not be entirely true.<strong> Nick Bax</strong> is an independent expert in tracing cryptocurrency transactions, and he said it appears Antinalysis may be little more than a clone of AMLBot, an anti- anti-money laundering intelligence service that first came online in 2019.</p>
<div id="attachment_56583" style="width: 771px" class="wp-caption aligncenter"><a href="media/eb3e992c.amlbot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/amlbot.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56583" loading="lazy" class="wp-image-56583" src="media/eb3e992c.amlbot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/amlbot.png" alt="" width="761" height="303" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/amlbot.png 1331w, https://krebsonsecurity.com/wp-content/uploads/2021/08/amlbot-768x306.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/amlbot-782x311.png 782w" sizes="(max-width: 761px) 100vw, 761px" /></a><p id="caption-attachment-56583" class="wp-caption-text">AMLBot&#8217;s user interface.</p></div>
<p>&#8220;It looks almost identical to the cheap version of AMLBot,&#8221; Bax told KrebsOnSecurity. &#8220;My guess is they&#8217;re just white-labeling that.&#8221;</p>
<p>Bax said a lookup at AMLBot on the virtual currency address used in the sample provided by Antinalysis shows a near identical result. Here&#8217;s AMLBot&#8217;s result for the same crypto analysis performed by Antinalysis in the screenshot at the top of this story:</p>
<div id="attachment_56586" style="width: 536px" class="wp-caption aligncenter"><a href="media/a94ea499.amlbotresult.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/amlbotresult.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56586" loading="lazy" class="wp-image-56586 size-full" src="media/a94ea499.amlbotresult.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/amlbotresult.png" alt="" width="526" height="851" /></a><p id="caption-attachment-56586" class="wp-caption-text">AMLBot&#8217;s response for the same cryptocurrency address provided as an example by Antinalysis.</p></div>
<p>&#8220;If you look at the breakdown the percentages are all almost identical,&#8221; Bax said. &#8220;I use AMLBot occasionally for good and righteous purposes. And it could also be useful for people who are just selling stuff online to make sure they aren&#8217;t receiving tainted funds.&#8221;</p>
<p><strong>Update, 1:42 p.m. ET:</strong> Corrected the story to note that AMLBot has been around since 2019.</p>
<p><strong>Update, 1:52 p.m. ET:</strong> Elliptic updated its blog post to confirm the connection between Antinanlysis and AMLBot, noting that AMLBot itself is a reseller of yet another service: &#8220;As first suggested in an <a href="https://krebsonsecurity.com/2021/08/new-anti-anti-money-laundering-services-for-crooks/#more-56578" rel="noreferrer" data-ss1628877097="1">article</a> by Brian Krebs, we can now confirm that the results provided by Antinalysis are identical to those provided by AMLBot. It is therefore likely that Antinalysis makes use of the AMLBot API. AMLBot is itself a reseller for Crystal Blockchain, an analytics provider.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=56613
title: T-Mobile Investigating Claims of Massive Data Breach
uri: T-Mobile-Investigating-Claims-of-Massive-Data-Breach
url: https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/
content:
<p>Communications giant <strong>T-Mobile</strong> said today it is investigating the extent of a data breach that hackers claim has exposed sensitive personal data on 100 million T-Mobile USA customers, in many cases including the name, Social Security number, address, date of birth, phone number, security PINs and details that uniquely identify each customer&#8217;s mobile device.</p>
<p>On Sunday, Vice.com <a href="https://www.vice.com/en/article/akg8wg/tmobile-investigating-customer-data-breach-100-million" target="_blank" rel="noopener">broke the news</a> that someone was selling data on 100 million people, and that the data came from T-Mobile. In <a href="https://www.t-mobile.com/news/network/cybersecurity-incident-update-august-2021" target="_blank" rel="noopener">a statement</a> published on its website today, T-Mobile confirmed it had suffered an intrusion involving customer data, but said it was too soon in its investigation to know what was stolen and how many customers may be affected.</p>
<div id="attachment_56617" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56617" loading="lazy" class=" wp-image-56617" src="media/42ff915a.tmob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/tmob.png" alt="" width="753" height="722" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/tmob.png 855w, https://krebsonsecurity.com/wp-content/uploads/2021/08/tmob-768x737.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/tmob-782x750.png 782w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-56617" class="wp-caption-text">A sales thread tied to the allegedly stolen T-Mobile customer data.</p></div>
<p>&#8220;We have determined that unauthorized access to some T-Mobile data occurred, however we have not yet determined that there is any personal customer data involved,&#8221; T-Mobile wrote.</p>
<p>&#8220;We are confident that the entry point used to gain access has been closed, and we are continuing our deep technical review of the situation across our systems to identify the nature of any data that was illegally accessed,&#8221; the statement continued. &#8220;This investigation will take some time but we are working with the highest degree of urgency. Until we have completed this assessment we cannot confirm the reported number of records affected or the validity of statements made by others.&#8221;</p>
<p>The intrusion came to light on Twitter when the account <a href="https://twitter.com/und0xxed" target="_blank" rel="noopener">@und0xxed</a> started tweeting the details. Reached via direct message, Und0xxed said they were not involved in stealing the databases but was instead in charge of finding buyers for the stolen T-Mobile customer data.</p>
<p>Und0xxed said the hackers found an opening in T-Mobile&#8217;s wireless data network that allowed access to two of T-Mobile&#8217;s customer data centers. From there, the intruders were able to dump a number of customer databases totaling more than 100 gigabytes.</p>
<p>They claim one of those databases holds the name, date of birth, SSN, drivers license information, plaintext security PIN, address and phone number of 36 million T-Mobile customers in the United States &#8212; all going back to the mid-1990s.</p>
<p>The hacker(s) claim the purloined data also includes <a href="https://www.guidingtech.com/imei-vs-imsi-number/" target="_blank" rel="noopener">IMSI and IMEI data</a> for 36 million customers. These are unique numbers embedded in customer mobile devices that identify the device and the SIM card that ties that customer&#8217;s device to a telephone number.</p>
<p>&#8220;If you want to verify that I have access to the data/the data is real, just give me a T-Mobile number and I&#8217;ll run a lookup for you and return the IMEI and IMSI of the phone currently attached to the number and any other details,&#8221; @und0xxed said. &#8220;All T-Mobile USA prepaid and postpaid customers are affected; Sprint and the other telecoms that T-Mobile owns are unaffected.&#8221;</p>
<p>Other databases allegedly accessed by the intruders included one for prepaid accounts, which had far fewer details about customers.</p>
<p>&#8220;Prepaid customers usually are just phone number and IMEI and IMSI,&#8221; Und0xxed said. &#8220;Also, the collection of databases includes historical entries, and many phone numbers have 10 or 20 IMEIs attached to them over the years, and the service dates are provided. There&#8217;s also a database that includes credit card numbers with six digits of the cards obfuscated.&#8221;<span id="more-56613"></span></p>
<p>T-Mobile declined to comment beyond what the company said in its blog post today.</p>
<p>In 2015, a computer breach at big three credit bureau<strong> Experian</strong> <a href="https://krebsonsecurity.com/2015/10/experian-breach-affects-15-million-consumers/" target="_blank" rel="noopener">exposed the Social Security numbers and other data on 15 million people who applied for financing from T-Mobile</a>.</p>
<p>Like other mobile providers, T-Mobile is locked in a constant battle with scammers who target its own employees in <a href="https://krebsonsecurity.com/?s=sim+swapping" target="_blank" rel="noopener">SIM swapping attacks</a> and other techniques to wrest control over employee accounts that can provide backdoor access to customer data. In at least <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">one case</a>, retail store employees were complicit in the account takeovers.</p>
<h2>WHO HACKED T-MOBILE?</h2>
<p>The Twitter profile for the account @Und0xxed includes a shout out to <a href="https://twitter.com/intelsecrets" target="_blank" rel="noopener">@IntelSecrets</a>, the Twitter account of a fairly elusive hacker who also has gone by the handles <strong>IRDev</strong> and<strong> V0rtex</strong>. Asked if @IntelSecrets was involved in the T-Mobile intrusion, @und0xxed confirmed that it was.</p>
<p>Speaking to the researcher <strong>Alon Gal</strong> (<a href="https://twitter.com/UnderTheBreach/status/1426923538099970050" target="_blank" rel="noopener">@underthebreach</a>), the hackers responsible for the T-Mobile intrusion said they did it to &#8220;retaliate against the US for the kidnapping and torture of John Erin Binns in Germany by the CIA and Turkish intelligence agents in 2019. We did it to harm US infrastructure.&#8221;</p>
<p>The IntelSecrets nicknames correspond to an individual who has claimed responsibility for modifying the source code for the<a href="https://krebsonsecurity.com/?s=mirai" target="_blank" rel="noopener"> Mirai &#8220;Internet of Things&#8221; botnet</a> to create a variant known as &#8220;<strong>Satori</strong>,&#8221; and supplying it to others who used it for criminal gain and were later caught and prosecuted. Like <strong>Kenny &#8220;NexusZeta&#8221; Schuchmann</strong>, who <a href="https://krebsonsecurity.com/2019/09/satori-iot-botnet-operator-pleads-guilty/" target="_blank" rel="noopener">pleaded guilty in 2019</a> to operating the Satori botnet. Two other young men <a href="https://krebsonsecurity.com/2020/06/new-charges-sentencing-in-satori-iot-botnet-conspiracy/" target="_blank" rel="noopener">have been charged in connection with Satori</a> &#8212; but not IntelSecrets.</p>
<p>How do we know all this about IntelSecrets/IRDev/V0rtex? That identity has acknowledged as much in a series of bizarre lawsuits filed by a person who claims their real name is <strong>John Erin Binns</strong>. The same Binns identity operates the website <strong>intelsecrets[.]ru. </strong></p>
<p>On that site, Binns claims he fled to Germany and Turkey to evade prosecution in the Satori case, only to be kidnapped in Turkey and subjected to various forms of psychological and physical torture. According to Binns, the <strong>U.S. Central Intelligence Agency</strong> (CIA) falsely told their counterparts in Turkey that he was a supporter or member of the Islamic State (ISIS), a claim he says led to his alleged capture and torture by the Turks.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-56618" src="media/9e69c90a.binnsvcia.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/binnsvcia.png" alt="" width="918" height="414" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/binnsvcia.png 918w, https://krebsonsecurity.com/wp-content/uploads/2021/08/binnsvcia-768x346.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/binnsvcia-782x353.png 782w" sizes="(max-width: 918px) 100vw, 918px" /></p>
<p>Since then, Binns has filed a flood of lawsuits naming various federal agencies &#8212; including the <a href="https://www.courtlistener.com/docket/18719615/13/1/binns-v-federal-bureau-of-investigation/#text" target="_blank" rel="noopener">FBI</a>, the <a href="https://www.courtlistener.com/docket/17348542/binns-v-central-intelligence-agency/" target="_blank" rel="noopener">CIA</a>, and the <a href="media/1070b59f.FOIA20Log20FY202020.pdf" data-original-source="https://www.socom.mil/FOIA/FOIA%20Logs/FOIA%20Log%20FY%202020.pdf" target="_blank" rel="noopener">U.S. Special Operations Command</a> (PDF), demanding that the government turn over information collected about him and seeking restitution for his alleged kidnapping at the hands of the CIA.</p>


feed_id: https://krebsonsecurity.com/?p=56638
title: T-Mobile: Breach Exposed SSN/DOB of 40M+ People
uri: T-Mobile-Breach-Exposed-SSN-DOB-of-40M-People
url: https://krebsonsecurity.com/2021/08/t-mobile-breach-exposed-ssn-dob-of-40m-people/
content:
<p><img loading="lazy" class="aligncenter wp-image-56640" src="media/780fc617.tombilelogo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/tombilelogo.png" alt="" width="602" height="304" /></p>
<p><strong>T-Mobile</strong> is warning that a data breach has exposed the names, date of birth, Social Security number and driver&#8217;s license/ID information of more than 40 million current, former or prospective customers who applied for credit with the company. The acknowledgment came less than 48 hours after millions of the stolen T-Mobile customer records went up for sale in the cybercrime underground.</p>
<p>In a statement Tuesday evening, T-Mobile said a &#8220;highly sophisticated&#8221; attack against its network led to the breach of data on millions of customers.</p>
<p>&#8220;Our preliminary analysis is that approximately 7.8 million current T-Mobile postpaid customer accounts’ information appears to be contained in the stolen files, as well as just over 40 million records of former or prospective customers who had previously applied for credit with T-Mobile,&#8221; the company wrote in <a href="https://www.t-mobile.com/news/network/additional-information-regarding-2021-cyberattack-investigation" target="_blank" rel="noopener">a blog post</a>. &#8220;Importantly, no phone numbers, account numbers, PINs, passwords, or financial information were compromised in any of these files of customers or prospective customers.&#8221;</p>
<p>Nevertheless, T-Mobile is urging all T-Mobile postpaid customers to proactively change their account PINs by going online into their T-Mobile account or calling customer care at 611. &#8220;This precaution is despite the fact that we have no knowledge that any postpaid account PINs were compromised,&#8221; the advisory reads.</p>
<p>It is not clear how many people total may be impacted by this breach. T-Mobile hasn&#8217;t yet responded to requests for clarification regarding how many of the 7.8 million current customers may also have been affected by the credit application breach.<span id="more-56638"></span></p>
<p>The intrusion first came to light on Twitter when the account <a href="https://twitter.com/und0xxed" target="_blank" rel="noopener">@und0xxed</a> started tweeting the details, and someone on a cybercrime forum <a href="https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/" target="_blank" rel="noopener">began selling what they claimed were more than 100 million freshly hacked records from T-Mobile</a>. The hackers claimed one of those databases held the name, date of birth, SSN, drivers license information, plaintext security PIN, address and phone number of 36 million T-Mobile customers in the United States — all going back to the mid-1990s.</p>
<p>T-Mobile said it was also able to confirm approximately 850,000 active T-Mobile prepaid customer names, phone numbers and account PINs were also exposed.</p>
<p>&#8220;We have already proactively reset ALL of the PINs on these accounts to help protect these customers, and we will be notifying accordingly right away. No Metro by T-Mobile, former Sprint prepaid, or Boost customers had their names or PINs exposed,&#8221; T-Mobile said. &#8220;We have also confirmed that there was some additional information from inactive prepaid accounts accessed through prepaid billing files. No customer financial information, credit card information, debit or other payment information or SSN was in this inactive file.&#8221;</p>
<p>T-Mobile said it would pay for two years of identity theft protection services for any affected customers, and that it was offering &#8220;an extra step to protect your mobile account with our Account Takeover Protection capabilities for postpaid customers, which makes it harder for customer accounts to be fraudulently ported out and stolen.&#8221; Why it wouldn&#8217;t make that extra protection standard for all accounts all the time is not entirely clear.</p>
<p>This stolen data is being actively sold, but <a href="https://krebsonsecurity.com/2021/07/the-life-cycle-of-a-breached-database/" target="_blank" rel="noopener">if the past is any teacher much of it will wind up posted online soon</a>. It is a safe bet that scammers will use some of this information to target T-Mobile users with phishing messages, account takeovers and harassment.</p>
<p>T-Mobile customers should expect to see phishers taking advantage of public concern over the breach to impersonate the company &#8212; and possibly even messages that include the recipient&#8217;s compromised account details to make the communications look more legitimate.</p>
<p>Data stolen and exposed in this breach may also be used for identity theft. Credit monitoring and ID theft protection services can help you recover from having your identity stolen, but most will do nothing to stop the ID theft from happening. If you want the maximum control over who should be able to view your credit or grant new lines of credit in your name, then <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">a security freeze</a> is your best option.</p>
<p>If you&#8217;re a current T-Mobile customer, by all means change your account PIN as instructed. But regardless of which mobile provider you patronize, consider removing your phone number from as many online accounts as you can. Many online services require you to provide a phone number upon registering an account, but in many cases that number can be removed from your profile afterwards.</p>
<p>Why do I suggest this? Many online services allow users to reset their passwords just by clicking a link sent via SMS, and this unfortunately widespread practice has <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener">turned mobile phone numbers into de facto identity documents</a>. Which means losing control over your phone number thanks to an <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">unauthorized SIM swap or mobile number port-out</a>, divorce, job termination or financial crisis can be devastating.</p>


feed_id: https://krebsonsecurity.com/?p=56667
title: Wanted: Disgruntled Employees to Deploy Ransomware
uri: Wanted-Disgruntled-Employees-to-Deploy-Ransomware
url: https://krebsonsecurity.com/2021/08/wanted-disgruntled-employees-to-deploy-ransomware/
content:
<p>Criminal hackers will try almost anything to get inside a profitable enterprise and secure a million-dollar payday from a ransomware infection. Apparently now that includes emailing employees directly and asking them to unleash the malware inside their employer&#8217;s network in exchange for a percentage of any ransom amount paid by the victim company.</p>
<div id="attachment_56671" style="width: 668px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56671" loading="lazy" class="size-full wp-image-56671" src="media/5fad735b.madalin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/madalin.png" alt="" width="658" height="263" /><p id="caption-attachment-56671" class="wp-caption-text">Image: Abnormal Security.</p></div>
<p><strong>Crane Hassold</strong>, director of threat intelligence at <strong>Abnormal Security</strong>, <a href="https://abnormalsecurity.com/blog/nigerian-ransomware-soliciting-employees-demonware/" rel="noopener" target="_blank">described</a> what happened after he adopted a fake persona and responded to the proposal in the screenshot above. It offered to pay him 40 percent of a million-dollar ransom demand if he agreed to launch their malware inside his employer&#8217;s network.</p>
<p>This particular scammer was fairly chatty, and over the course of five days it emerged that Hassold&#8217;s correspondent was forced to change up his initial approach in planning to deploy the <a href="https://arstechnica.com/gadgets/2021/03/ransomware-operators-are-piling-on-already-hacked-exchange-servers/" rel="noopener" target="_blank">DemonWare ransomware strain</a>, which is freely available on <strong>GitHub</strong>. </p>
<p>&#8220;According to this actor, he had originally intended to send his targets—all senior-level executives—phishing emails to compromise their accounts, but after that was unsuccessful, he pivoted to this ransomware pretext,&#8221; Hassold wrote.</p>
<p>Abnormal Security documented how it tied the email back to a young man in Nigeria who acknowledged he was trying to save up money to help fund a new social network he is building called <strong>Sociogram</strong>.</p>
<div id="attachment_56674" style="width: 641px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56674" loading="lazy" src="media/397da2d9.sociogram.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/sociogram.png" alt="" width="631" height="379" class="size-full wp-image-56674" /><p id="caption-attachment-56674" class="wp-caption-text">Image: Abnormal Security.</p></div>
<p>This attacker&#8217;s approach may seem fairly amateur, but it would be a mistake to dismiss the threat from West African cybercriminals dabbling in ransomware. While multi-million dollar ransomware payments are hogging the headlines, by far the biggest financial losses tied to cybercrime each year stem from so-called <a href="https://krebsonsecurity.com/tag/business-email-compromise/" rel="noopener" target="_blank">Business Email Compromise (BEC) or CEO Scams</a>, in which crooks mainly based in Africa and Southeast Asia will spoof communications from executives at the target firm in a bid to initiate unauthorized international wire transfers.</p>
<p>According to <a href="media/18ed2453.2020_IC3Report.pdf" data-original-source="https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf" rel="noopener" target="_blank">the latest figures</a> (PDF) released by the <a href="https://www.ic3.gov" rel="noopener" target="_blank">FBI Internet Crime Complaint Center</a> (IC3), the reported losses from BEC scams continue to dwarf other cybercrime loss categories, increasing to $1.86 billion in 2020.</p>
<div id="attachment_56673" style="width: 707px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56673" loading="lazy" src="media/3ecaedaf.fbi2020crimesbyloss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/fbi2020crimesbyloss.png" alt="" width="697" height="466" class="size-full wp-image-56673" /><p id="caption-attachment-56673" class="wp-caption-text">Image: FBI</p></div>
<p>&#8220;Knowing the actor is Nigerian really brings the entire story full circle and provides some notable context to the tactics used in the initial email we identified,&#8221; Hassold wrote. &#8220;For decades, West African scammers, primarily located in Nigeria, have perfected the use of social engineering in cybercrime activity.&#8221;</p>
<p>&#8220;While the most common cyber attack we see from Nigerian actors (and most damaging attack globally) is business email compromise (BEC), it makes sense that a Nigerian actor would fall back on using similar social engineering techniques, even when attempting to successfully deploy a more technically sophisticated attack like ransomware,&#8221; Hassold concluded.</p>
<h2>DON&#8217;T QUIT YOUR DAY JOB</h2>
<p>Cybercriminals trolling for disgruntled employees is hardly a new development. Big companies have long been worried about the very real threat of disgruntled employees creating identities on darknet sites and then offering to trash their employer&#8217;s network for a fee (for more on that, see my 2016 story, <a href="https://krebsonsecurity.com/2016/06/rise-of-darknet-stokes-fear-of-the-insider/" rel="noopener" target="_blank">Rise of the Darknet Stokes Fear of the Insider</a>).<span id="more-56667"></span></p>
<p>Indeed, perhaps this enterprising Nigerian scammer is just keeping up with current trends. Several <a href="https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/" rel="noopener" target="_blank">established ransomware affiliate gangs that have recently rebranded under new banners</a> seem to have done away with the affiliate model in favor of just buying illicit access to corporate networks. </p>
<p>For example, the Lockbit 2.0 ransomware-as-a-service gang actually <a href="https://news.sophos.com/en-us/2021/08/09/blackmatter-ransomware-emerges-from-the-shadow-of-darkside/" rel="noopener" target="_blank">includes a solicitation for insiders</a> in the desktop wallpaper left behind on systems encrypted with the malware.</p>
<p>&#8220;Would you like to earn millions of dollars? Our company acquires access to networks of various companies, as well as insider information that can help you steal the most valuable data of any company,&#8221; LockBit&#8217;s unusual ad reads. &#8220;You can provide us accounting data for the access to any company, for example, login and password to RDP, VPN, corporate email, etc. Open our letter at your email. Launch the provided virus on any computer in your company. Companies pay us the foreclosure for the decryption of files and prevention of data leak.&#8221;</p>
<div id="attachment_56675" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56675" loading="lazy" src="media/a8cd3287.lockbit20.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/lockbit20.png" alt="" width="757" height="449" class="size-full wp-image-56675" /><p id="caption-attachment-56675" class="wp-caption-text">Image: Sophos.</p></div>
<p>Likewise, the newly formed <strong>DarkMatter </strong>ransomware gang kicked off its presence on the cybercrime forums with the unassuming thread, &#8220;Buying/monetizing your access to corporate networks.&#8221; The rest of the post reads:</p>
<blockquote><p>We are looking for access to corporate networks in the following countries:<br />
&#8211; the USA<br />
&#8211; Canada<br />
&#8211; Australia<br />
&#8211; the UK</p>
<p>All lines of business except for:<br />
&#8211; Healthcare<br />
&#8211; Government entities.</p>
<p>Requirements:<br />
&#8211; Revenue according to ZoomInfo: over 100 million.<br />
&#8211; Number of hosts: 500 to 15,000.<br />
&#8211; We do not accept networks that anybody else has already tried to work on.</p>
<p>Two options of cooperation:<br />
&#8211; We buy networks: 3 to 100k.<br />
&#8211; We monetize them (subject to negotiation on a case-by-case basis).</p>
<p>How we work:<br />
You select an option of cooperation. -> You provide access to the network. -> We check it. -> We take it or not (depending on whether it meets the requirements).</p></blockquote>


feed_id: https://krebsonsecurity.com/?p=56713
title: Man Robbed of 16 Bitcoin Sues Young Thieves’ Parents
uri: Man-Robbed-of-16-Bitcoin-Sues-Young-Thieves-Parents
url: https://krebsonsecurity.com/2021/08/man-robbed-of-16-bitcoin-sues-young-thieves-parents/
content:
<p>In 2018, <strong>Andrew Schober</strong> was digitally mugged for approximately $1 million worth of bitcoin. After several years of working with investigators, Schober says he&#8217;s confident he has located two young men in the United Kingdom responsible for developing a clever piece of digital clipboard-stealing malware that let them siphon his crypto holdings. Schober is now suing each of their parents in a civil case that seeks to extract what their children would not return voluntarily.</p>
<p><img loading="lazy" class="aligncenter wp-image-52998" src="media/1d542076.coinphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/coinphish.png" alt="" width="663" height="512" /></p>
<p>In a lawsuit filed in Colorado, Schober said the sudden disappearance of his funds in January 2018 prompted him to spend more than $10,000 hiring experts in the field of tracing cryptocurrency transactions. After months of sleuthing, his investigators identified the likely culprits: Two young men in Britain who were both minors at the time of the crime.</p>
<p>A forensic investigation of Schober&#8217;s computer found he&#8217;d inadvertently downloaded malicious software after clicking a link posted on Reddit for a purported cryptocurrency wallet application called &#8220;Electrum Atom.&#8221; Investigators determined that the malware was bundled with the benign program, and was designed to lie in wait for users to copy a cryptocurrency address to their computer&#8217;s temporary clipboard.</p>
<p>When Schober went to move approximately 16.4 bitcoins from one account to another &#8212; by pasting the lengthy payment address he&#8217;d just copied &#8212; the malware replaced his bitcoin payment address with a different address controlled by the young men.</p>
<p>Schober&#8217;s lawsuit lays out how his investigators traced the stolen funds through cryptocurrency exchanges and on to the two youths in the United Kingdom. In addition, they found one of the defendants &#8212; just hours after Schober&#8217;s bitcoin was stolen &#8212; had posted a message to GitHub asking for help accessing the private key corresponding to the public key of the bitcoin address used by the clipboard-stealing malware.</p>
<p>Investigators found the other defendant had the malware code that was bundled with the Electrum Atom application in his Github code library.</p>
<p>Initially, Schober hoped that the parents of the thieving teens would listen to reason, and simply return the money. So he wrote a letter to the parents of both boys:</p>
<p>&#8220;It seems your son has been using malware to steal money from people online,&#8221; reads the opening paragraph of the letter Schober emailed to the parents of the boys, both of whom are studying computer science at U.K. universities. &#8220;Losing that money has been financially and emotionally devastating. He might have thought he was playing a harmless joke, but it has had serious consequences for my life.&#8221;</p>
<div id="attachment_56719" style="width: 574px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56719" loading="lazy" class="size-full wp-image-56719" src="media/1579018f.readwellsletter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/readwellsletter.png" alt="" width="564" height="795" /><p id="caption-attachment-56719" class="wp-caption-text">A portion of the letter than Schober sent to two of the defendants in 2018, after investigators determined their sons were responsible for stealing nearly $1 million in cryptocurrency from Schober.</p></div>
<p>Met with continued silence from the parents for many months, Schober filed suit against the kids and their parents in a Colorado court. A copy of the May 2021 complaint is <a href="media/7770b5b0.schobervthompson.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/schobervthompson.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>Now they are responding. One of the defendants &#8212;<strong>Hazel D. Wells</strong> &#8212; just <a href="media/312557c1.pro-se-wells.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/pro-se-wells.pdf" target="_blank" rel="noopener">filed a motion</a> with the court to represent herself and her son in lieu of hiring an attorney. In a filing on Aug. 9, Wells helpfully included the letter in the screenshot above, and volunteered that her son had been questioned by U.K. authorities in connection with the bitcoin theft.</p>
<p>Neither of the defendants&#8217; families are disputing the basic claim that their kids stole from Mr. Schober. Rather, they&#8217;re claiming that time has run out on Schober&#8217;s legal ability to claim a cause of action against them.<span id="more-56713"></span></p>
<p>&#8220;Plaintiff alleges two common law causes of action (conversation and trespass to chattel), for which a three-year statute of limitations applies,&#8221; an attorney for the defendants argued in <a href="media/7ffa9ef1.clipboardattorneyresponse.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/clipboardattorneyresponse.pdf" target="_blank" rel="noopener">a filing on Aug. 6</a> (PDF). &#8220;Plaintiff further alleges a federal statutory cause of action, for which a two-year statute of limitations applies. Because plaintiff did not file his lawsuit until May 21, 2021, three years and five months after his injury, his claims should be dismissed.&#8221;</p>
<p>Schober&#8217;s attorneys <a href="media/d2102f71.SchoberResponse.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/SchoberResponse.pdf" target="_blank" rel="noopener">argue</a> (PDF) that &#8220;the statute of limitations begins to run when the Plaintiff knows or has reason to know of the existence and cause of the injury which is the base of his action,&#8221; and that inherent in this concept is the discovery rule, namely: That the statute of limitations does not begin to run until the plaintiff knows or has reason to know of both the existence and cause of his injury.</p>
<p>The plaintiffs point out that Schober&#8217;s investigators didn&#8217;t pinpoint one of the young men&#8217;s involvement until more than a year after they&#8217;d identified his co-conspirator, saying Schober notified the second boy&#8217;s parents in December 2019.</p>
<p>None of the parties to this lawsuit responded to requests for comment.</p>
<div id="attachment_56729" style="width: 777px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56729" loading="lazy" class=" wp-image-56729" src="media/9e6a297c.schobergraphic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/schobergraphic.png" alt="" width="767" height="236" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/schobergraphic.png 891w, https://krebsonsecurity.com/wp-content/uploads/2021/08/schobergraphic-768x236.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/schobergraphic-782x240.png 782w" sizes="(max-width: 767px) 100vw, 767px" /><p id="caption-attachment-56729" class="wp-caption-text">Image: Complaint, Schober v. Thompson, et. al.</p></div>
<p><strong>Mark Rasch</strong>, a former prosecutor with the U.S. Justice Department, said the plaintiff is claiming the parents are liable because he gave them notice of a crime committed by their kids and they failed to respond.</p>
<p>&#8220;A lot of these crimes are being committed by juveniles, and we don&#8217;t have a good juvenile justice system that&#8217;s well designed to both civilly and criminally go after kids,&#8221; Rasch said.</p>
<p>Rasch said he&#8217;s currently an attorney in a number of lawsuits involving young men who&#8217;ve been accused of stealing and laundering millions of dollars of cryptocurrency &#8212; specifically crimes involving <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">SIM swapping</a> &#8212; where the fraudsters trick or bribe an employee at a mobile phone store into transferring control of a target&#8217;s phone number to a device they control.</p>
<p>In those cases, the plaintiffs have sought to extract compensation for their losses from the mobile phone companies &#8212; but so far those lawsuits have largely failed to yield results and are often pushed into arbitration.</p>
<p>Rasch said it makes sense that some victims of cryptocurrency theft are spending some serious coin to track down their assailants and sue them civilly. But he said the legwork needed to make that case is tremendous and costly, and there&#8217;s no guarantee those investments will pay off down the road.</p>
<p>&#8220;These crimes can be monumentally difficult and expensive to track down,&#8221; he said. &#8220;It&#8217;s designed to be difficult to do, but it&#8217;s also not designed to be impossible to do.&#8221;</p>
<p>As evidenced by <a href="https://www.cnbc.com/2021/08/24/coinbase-slammed-for-terrible-customer-service-after-hackers-drain-user-accounts.html" target="_blank" rel="noopener">this week&#8217;s CNBC story</a> on a marked rise in reports of people having their <strong>Coinbase</strong> accounts emptied by fraudsters, many people investing in cryptocurrencies find out the hard way that unlike traditional banking transactions &#8212; funds lost to theft are likely to stay lost because the transactions are irreversible.</p>
<p>Traditionally, the major crypto exchanges have said they&#8217;re not responsible for lost or stolen funds. But perhaps in response to the CNBC story, Coinbase said it was introducing <a href="https://www.coinbase.com/product/uk-coinbase-account-guarantee" target="_blank" rel="noopener">a new pilot &#8220;guarantee&#8221;</a> for U.K. customers only, wherein they will be eligible for a reimbursement of up £150,000 if someone gains unauthorized access to their account and steals funds.</p>
<p>However, it seems unlikely Coinbase&#8217;s new guarantee would cover cases like Schober&#8217;s &#8212; even if he&#8217;d been a U.K. resident and the theft occurred today. One of the caveats that is not covered in the guarantee is sending funds to the wrong address by accident.</p>


feed_id: https://krebsonsecurity.com/?p=56712
title: 15-Year-Old Malware Proxy Network VIP72 Goes Dark
uri: 15-Year-Old-Malware-Proxy-Network-VIP72-Goes-Dark
url: https://krebsonsecurity.com/2021/09/15-year-old-malware-proxy-network-vip72-goes-dark/
content:
<p>Over the past 15 years, a cybercrime anonymity service known as <strong>VIP72</strong> has enabled countless fraudsters to mask their true location online by routing their traffic through millions of malware-infected systems. But roughly two weeks ago, VIP72&#8217;s online storefront &#8212; which ironically enough has remained at the same U.S.-based Internet address for more than a decade &#8212; simply vanished.</p>
<p><img loading="lazy" class="aligncenter wp-image-56769" src="media/56630187.vip72login.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/vip72login.png" alt="" width="756" height="561" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/vip72login.png 865w, https://krebsonsecurity.com/wp-content/uploads/2021/09/vip72login-768x570.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/vip72login-782x580.png 782w" sizes="(max-width: 756px) 100vw, 756px" /></p>
<p>Like other anonymity networks marketed largely on cybercrime forums online, VIP72 routes its customers&#8217; traffic through computers that have been hacked and seeded with malicious software. Using services like VIP72, customers can select network nodes in virtually any country, and relay their traffic while hiding behind some unwitting victim&#8217;s Internet address.</p>
<p>The domain <strong>Vip72[.]org</strong> was originally registered in 2006 to &#8220;<strong>Corpse</strong>,&#8221; the handle adopted by a Russian-speaking hacker who gained infamy several years prior for creating and selling an extremely sophisticated online banking trojan called <strong>A311 Death</strong>, a.k.a. &#8220;<strong>Haxdoor</strong>,&#8221; and &#8220;<strong>Nuclear Grabber</strong>.&#8221; Haxdoor was way ahead of its time in many respects, and it was <a href="https://www.nytimes.com/2007/01/25/technology/25hack.html" target="_blank" rel="noopener">used in multiple million-dollar cyberheists</a> long before multi million-dollar cyberheists became daily front page news.</p>
<div id="attachment_56767" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56767" loading="lazy" class=" wp-image-56767" src="media/00b3ab06.prodexa311.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/prodexa311.png" alt="" width="764" height="436" /><p id="caption-attachment-56767" class="wp-caption-text">An ad circa 2005 for A311 Death, a powerful banking trojan authored by &#8220;Corpse,&#8221; the administrator of the early Russian hacking clique Prodexteam. Image: Google Translate via Archive.org.</p></div>
<p>Between 2003 and 2006, Corpse focused on selling and supporting his Haxdoor malware. Emerging in 2006, VIP72 was clearly one of his side hustles that turned into a reliable moneymaker for many years to come. And it stands to reason that VIP72 was launched with the help of systems already infected with Corpse&#8217;s trojan malware.</p>
<p>The first mention of VIP72 in the cybercrime underground came in 2006 when someone using the handle &#8220;<strong>Revive</strong>&#8221; advertised the service on Exploit, a Russian language hacking forum. Revive established a sales presence for VIP72 on multiple other forums, and the contact details and messages shared privately by that user with other forum members show Corpse and Revive are one and the same.</p>
<p>When asked in 2006 whether the software that powered VIP72 was based on his Corpse software, Revive replied that &#8220;it works on the new Corpse software, specially written for our service.&#8221;<span id="more-56712"></span></p>
<p>One denizen of a Russian language crime forum who complained about the unexplained closure of VIP72 last month said they noticed a change in the site&#8217;s domain name infrastructure just prior to the service&#8217;s disappearance. But that claim could not be verified, as there simply are no signs that any of that infrastructure changed prior to VIP72&#8217;s demise.</p>
<p>In fact, <span class="pullquote pqleft">until mid-August VIP72&#8217;s main home page and supporting infrastructure had remained at the same U.S.-based Internet address for more than a decade</span> &#8212; a remarkable achievement for such a high-profile cybercrime service.</p>
<p>Cybercrime forums in multiple languages are littered with tutorials about how to use VIP72 to hide one&#8217;s location while engaging in financial fraud. From examining some of those tutorials, it is clear that VIP72 is quite popular among cybercriminals who engage in &#8220;credential stuffing&#8221; &#8212; taking lists of usernames and passwords stolen from one site and testing how many of those credentials work at other sites.</p>
<p>Corpse/Revive also long operated an extremely popular service called <strong>check2ip[.]com</strong>, which promised customers the ability to quickly tell whether a given Internet address is flagged by any security companies as malicious or spammy.</p>
<p>Hosted on the same Internet address as VIP72 for the past decade until mid-August 2021, Check2IP also advertised the ability to let customers detect &#8220;DNS leaks,&#8221; instances where configuration errors can expose the true Internet address of hidden cybercrime infrastructure and services online.</p>
<p>Check2IP is so popular that it has become a verbal shorthand for basic due diligence in certain cybercrime communities. Also, Check2IP has been incorporated into a variety of cybercrime services online &#8212; but especially those involved in mass-mailing malicious and phishous email messages.</p>
<div id="attachment_56770" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56770" loading="lazy" class=" wp-image-56770" src="media/c3602d06.check2ip.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/check2ip.png" alt="" width="749" height="607" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/check2ip.png 1134w, https://krebsonsecurity.com/wp-content/uploads/2021/09/check2ip-768x622.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/check2ip-782x634.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-56770" class="wp-caption-text">Check2IP, an IP reputation service that told visitors whether their Internet address was flagged in any spam or malware block lists.</p></div>
<p>It remains unclear what happened to VIP72; users report that the anonymity network is still functioning even though the service&#8217;s website has been gone for two weeks. That makes sense since the infected systems that get resold through VIP72 are still infected and will happily continue to forward traffic so long as they remain infected. Perhaps the domain was seized in a law enforcement operation. </p>
<p>But it could be that the service simply decided to stop accepting new customers because it had trouble competing with an influx of newer, more sophisticated criminal proxy services, as well as with <a href="https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-networks/" target="_blank" rel="noopener">the rise of &#8220;bulletproof&#8221; residential proxy networks</a>. For most of its existence until recently, VIP72 normally had several hundred thousand compromised systems available for rent. By the time its website vanished last month &#8212; that number had dwindled to fewer than 25,000 systems globally.</p>


feed_id: https://krebsonsecurity.com/?p=55319
title: Gift Card Gang Extracts Cash From 100k Inboxes Daily
uri: Gift-Card-Gang-Extracts-Cash-From-100k-Inboxes-Daily
url: https://krebsonsecurity.com/2021/09/gift-card-gang-extracts-cash-from-100k-inboxes-daily/
content:
<p>Some of the most successful and lucrative online scams employ a &#8220;low-and-slow&#8221; approach &#8212; avoiding detection or interference from researchers and law enforcement agencies by stealing small bits of cash from many people over an extended period. Here&#8217;s the story of a cybercrime group that compromises up to 100,000 email inboxes per day, and apparently does little else with this access except siphon gift card and customer loyalty program data that can be resold online.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-56819" src="media/23dcde27.atmoney.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/atmoney.png" alt="" width="627" height="644" /></p>
<p>The data in this story come from a trusted source in the security industry who has visibility into a &#8220;proxy&#8221; network of hacked machines that fraudsters in just about every corner of the Internet are using to anonymize their malicious Web traffic. For the past three years, the source &#8212; we&#8217;ll call him &#8220;Bill&#8221; to preserve his requested anonymity &#8212; has been watching one group of threat actors that is mass-testing millions of usernames and passwords against the world&#8217;s major email providers each day.</p>
<p>Bill said he&#8217;s not sure where the passwords are coming from, but he assumes they are tied to <a href="https://krebsonsecurity.com/2021/07/the-life-cycle-of-a-breached-database/" target="_blank" rel="noopener">various databases for compromised websites that get posted to password cracking and hacking forums on a regular basis</a>. Bill said this criminal group averages between five and ten million email authentication attempts daily, and comes away with anywhere from 50,000 to 100,000 of working inbox credentials.</p>
<p>In about half the cases the credentials are being checked via &#8220;<a href="https://www.nylas.com/blog/nylas-imap-therefore-i-am/" target="_blank" rel="noopener">IMAP</a>,&#8221; which is an email standard used by email software clients like Mozilla&#8217;s <strong>Thunderbird</strong> and <strong>Microsoft Outlook</strong>. With his visibility into the proxy network, Bill can see whether or not an authentication attempt succeeds based on the network response from the email provider (e.g. mail server responds &#8220;OK&#8221; = successful access).</p>
<p>You might think that whoever is behind such a sprawling crime machine would use their access <a href="https://krebsonsecurity.com/2013/06/the-value-of-a-hacked-email-account/" target="_blank" rel="noopener">to blast out spam, or conduct targeted phishing attacks against each victim&#8217;s contacts</a>. But based on interactions that Bill has had with several large email providers so far, this crime gang merely uses custom, automated scripts that periodically log in and search each inbox for digital items of value that can easily be resold.</p>
<p>And they seem particularly focused on stealing gift card data.</p>
<p>&#8220;Sometimes they&#8217;ll log in as much as two to three times a week for months at a time,&#8221; Bill said. &#8220;These guys are looking for low-hanging fruit &#8212; basically cash in your inbox. Whether it&#8217;s related to hotel or airline rewards or just Amazon gift cards, after they successfully log in to the account their scripts start pilfering inboxes looking for things that could be of value.&#8221;</p>
<div id="attachment_56827" style="width: 327px" class="wp-caption alignright"><img aria-describedby="caption-attachment-56827" loading="lazy" class="size-full wp-image-56827" src="media/e5f707d1.gcsnips.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/gcsnips.png" alt="" width="317" height="631" /><p id="caption-attachment-56827" class="wp-caption-text">A sample of some of the most frequent search queries made in a single day by the gift card gang against more than 50,000 hacked inboxes.</p></div>
<p>According to Bill, the fraudsters aren&#8217;t downloading all of their victims&#8217; emails: That would quickly add up to a monstrous amount of data. Rather, they&#8217;re using automated systems to log in to each inbox and search for a variety of domains and other terms related to companies that maintain loyalty and points programs, and/or issue gift cards and handle their fulfillment.</p>
<p>Why go after hotel or airline rewards? Because these accounts can all be cleaned out and deposited onto a gift card number that can be resold quickly online for 80 percent of its value.</p>
<p>&#8220;These guys want that hard digital asset &#8212; the cash that is sitting there in your inbox,&#8221; Bill said. &#8220;You literally just pull cash out of peoples&#8217; inboxes, and then you have all these secondary markets where you can sell this stuff.&#8221;</p>
<p>Bill&#8217;s data also shows that this gang is so aggressively going after gift card data that it will routinely seek new gift card benefits on behalf victims, when that option is available.  For example, many companies now offer employees a &#8220;wellness benefit&#8221; if they can demonstrate they&#8217;re keeping up with some kind of healthy new habit, such as daily gym visits, yoga, or quitting smoking.</p>
<p>Bill said these crooks have figured out a way to tap into those benefits as well.</p>
<p>&#8220;A number of health insurance companies have wellness programs to encourage employees to exercise more, where if you sign up and pledge to 30 push-ups a day for the next few months or something you&#8217;ll get five wellness points towards a $10 Starbucks gift card, which requires 1000 wellness points,&#8221; Bill explained. &#8220;They&#8217;re actually automating the process of replying saying you completed this activity so they can bump up your point balance and get your gift card.&#8221;</p>
<h2>The Gift Card Gang&#8217;s Footprint</h2>
<p>How do the compromised email credentials break down in terms of ISPs and email providers? There are victims on nearly all major email networks, but Bill said several large Internet service providers (ISPs) in Germany and France are heavily represented in the compromised email account data.</p>
<p>&#8220;With some of these international email providers we&#8217;re seeing something like 25,000 to 50,000 email accounts a day get hacked,&#8221; Bill said.  &#8220;I don&#8217;t know why they&#8217;re getting popped so heavily.&#8221;</p>
<p>That may sound like a lot of hacked inboxes, but Bill said some of the bigger ISPs represented in his data have tens or hundreds of millions of customers.<span id="more-55319"></span></p>
<p>Measuring which ISPs and email providers have the biggest numbers of compromised customers is not so simple in many cases, nor is identifying companies with employees whose email accounts have been hacked.</p>
<p>This kind of mapping is often more difficult than it used to be because so many organizations have now outsourced their email to cloud services like <strong>Gmail</strong> and <strong>Microsoft Office365</strong> &#8212; where users can access their email, files and chat records all in one place.</p>
<p>&#8220;It&#8217;s a little complicated with Office 365 because it&#8217;s one thing to say okay how many Hotmail connections are you seeing per day in all this credential-stuffing activity, and you can see the testing against Hotmail&#8217;s site,&#8221; Bill said. &#8220;But with the IMAP traffic we&#8217;re looking at, the usernames being logged into are any of the million or so domains hosted on Office365, many of which will tell you very little about the victim organization itself.&#8221;</p>
<p>On top of that, it&#8217;s also difficult to know how much activity you&#8217;re <em>not</em> seeing.</p>
<p>Looking at the small set of Internet address blocks he knows are associated with Microsoft 365 email infrastructure, Bill examined the IMAP traffic flowing from this group to those blocks. Bill said that <em>in the first week of April 2021, he identified 15,000 compromised Office365 accounts being accessed by this group, spread over 6,500 different organizations that use Office365.</em></p>
<p>&#8220;So I&#8217;m seeing this traffic to just like 10 net blocks tied to Microsoft, which means I&#8217;m only looking at maybe 25 percent of Microsoft&#8217;s infrastructure,&#8221; Bill explained. &#8220;And with our puny visibility into probably less than one percent of overall password stuffing traffic aimed at Microsoft, we&#8217;re seeing 600 Office accounts being breached a day. So if I&#8217;m only seeing one percent, that means we&#8217;re likely talking about tens of thousands of Office365 accounts compromised daily worldwide.&#8221;</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-56829" src="media/4ebc1a21.inbox.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/inbox.png" alt="" width="795" height="207" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/inbox.png 795w, https://krebsonsecurity.com/wp-content/uploads/2021/09/inbox-768x200.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/inbox-782x204.png 782w" sizes="(max-width: 795px) 100vw, 795px" /></p>
<p>In <a href="https://www.microsoft.com/security/blog/2020/05/07/protect-accounts-smarter-ways-sign-in-world-passwordless-day/#:~:text=Since%20an%20average%20of%20one,of%20passwords%20only%20goes%20up." target="_blank" rel="noopener">a December 2020 blog post</a> about how Microsoft is moving away from passwords to more robust authentication approaches, the software giant said <em>an average of one in every 250 corporate accounts is compromised each month</em>. As of last year, Microsoft had nearly 240 million active users, according to <a href="https://office365itpros.com/2021/01/28/office-365-insights-microsoft-fy21q2-results/" target="_blank" rel="noopener">this analysis</a>.</p>
<p>&#8220;To me, this is an important story because for years people have been like, yeah we know email isn&#8217;t very secure, but this generic statement doesn&#8217;t have any teeth to it,&#8221; Bill said. &#8220;I don&#8217;t feel like anyone has been able to call attention to the numbers that show why email is so insecure.&#8221;</p>
<p>Bill says that in general companies have a great many more tools available for securing and analyzing employee email traffic when that access is funneled through a Web page or VPN, versus when that access happens via IMAP.</p>
<p>&#8220;It&#8217;s just more difficult to get through the Web interface because on a website you have a plethora of advanced authentication controls at your fingertips, including things like device fingerprinting, scanning for http header anomalies, and so on,&#8221; Bill said. &#8220;But what are the detection signatures you have available for detecting malicious logins via IMAP?&#8221;</p>
<p>Microsoft declined to comment specifically on Bill&#8217;s research, but said customers can block the overwhelming majority of account takeover efforts by enabling multi-factor authentication.</p>
<p>&#8220;For context, our research indicates that multi-factor authentication prevents more than 99.9% of account compromises,&#8221; reads a statement from Microsoft. &#8220;Moreover, for enterprise customers, innovations like Security Defaults, which disables basic authentication and requires users to enroll a second factor, have already significantly decreased the proportion of compromised accounts. In addition, for consumer accounts, adding a second authentication factor is required on all accounts.&#8221;</p>
<h2>A Mess That&#8217;s Likely to Stay That Way</h2>
<p>Bill said he&#8217;s frustrated by having such visibility into this credential testing botnet while being unable to do much about it. He&#8217;s shared his data with some of the bigger ISPs in Europe, but says months later he&#8217;s still seeing those same inboxes being accessed by the gift card gang.</p>
<p>The problem, Bill says, is that many large ISPs lack any sort of baseline knowledge of or useful data about customers who access their email via IMAP. That is, they lack any sort of instrumentation to be able to tell the difference between legitimate and suspicious logins for their customers who read their messages using an email client.</p>
<p>&#8220;My guess is in a lot of cases the IMAP servers by default aren&#8217;t logging every search request, so [the ISP] can&#8217;t go back and see this happening,&#8221; Bill said.</p>
<p>Confounding the challenge, there isn&#8217;t much of an upside for ISPs interested in voluntarily monitoring their IMAP traffic for hacked accounts.</p>
<p>&#8220;Let&#8217;s say you&#8217;re an ISP that <em>does have</em> the instrumentation to find this activity and you&#8217;ve just identified 10,000 of your customers who are hacked. But you also know they are accessing their email exclusively through an email client. What do you do? You can&#8217;t flag their account for a password reset, because there&#8217;s no mechanism in the email client to affect a password change.&#8221;</p>
<p>Which means those 10,000 customers are then going to start receiving error messages whenever they try to access their email.</p>
<p>&#8220;Those customers are likely going to get super pissed off and call up the ISP mad as hell,&#8221; Bill said. &#8220;And that customer service person is then going to have to spend a bunch of time explaining how to use the webmail service. As a result, very few ISPs are going to do anything about this.&#8221;</p>
<h2>Indictators of Compromise (IoCs)</h2>
<p>It&#8217;s not often KrebsOnSecurity has occasion to publish so-called &#8220;indicators of compromise&#8221; (IoC)s, but hopefully some ISPs may find the information here useful. This group automates the searching of inboxes for specific domains and trademarks associated with gift card activity and other accounts with stored electronic value, such as rewards points and mileage programs.</p>
<p><a href="https://docs.google.com/spreadsheets/d/1nh8HHG0wdr5J0AJJJyWG0odhBJJNFzpJ2xLls3nI6bw/edit?usp=sharing" target="_blank" rel="noopener">This file</a> includes the top inbox search terms used in a single 24 hour period by the gift card gang. The numbers on the left in the spreadsheet represent the number of times during that 24 hour period where the gift card gang ran a search for that term in a compromised inbox.</p>
<p>Some of the search terms are focused on specific brands &#8212; such as <strong>Amazon</strong> gift cards or <strong>Hilton Honors</strong> points; others are for major gift card networks like <a href="https://en.wikipedia.org/wiki/Blackhawk_Network_Holdings" target="_blank" rel="noopener">CashStar</a>, which issues cards that are white-labeled by dozens of brands like <strong>Target</strong> and <strong>Nordstrom</strong>. Inboxes hacked by this gang will likely be searched on many of these terms over the span of just a few days.</p>


feed_id: https://krebsonsecurity.com/?p=42684
title: “FudCo” Spam Empire Tied to Pakistani Software Firm
uri: FudCo-Spam-Empire-Tied-to-Pakistani-Software-Firm
url: https://krebsonsecurity.com/2021/09/fudco-spam-empire-tied-to-pakistani-software-firm/
content:
<p>In May 2015, KrebsOnSecurity briefly <a href="https://krebsonsecurity.com/2015/05/phishing-gang-is-audacious-manipulator/" target="_blank" rel="noopener">profiled</a> &#8220;<strong>The Manipulaters</strong>,&#8221; the name chosen by a prolific cybercrime group based in Pakistan that was very publicly selling spam tools and a range of services for crafting, hosting and deploying malicious email. Six years later, a review of the social media postings from this group shows they are prospering, while rather poorly hiding their activities behind a software development firm in Lahore that has secretly enabled an entire generation of spammers and scammers.</p>
<div id="attachment_31110" style="width: 772px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-31110" loading="lazy" class=" wp-image-31110" src="media/29f9756c.manipulaters.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/05/manipulaters.png" alt="" width="762" height="595" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/05/manipulaters.png 965w, https://krebsonsecurity.com/wp-content/uploads/2015/05/manipulaters-580x453.png 580w, https://krebsonsecurity.com/wp-content/uploads/2015/05/manipulaters-940x734.png 940w" sizes="(max-width: 762px) 100vw, 762px" /><p id="caption-attachment-31110" class="wp-caption-text">The Web site in 2015 for the &#8220;Manipulaters Team,&#8221; a group of Pakistani hackers behind the dark web identity &#8220;Saim Raza,&#8221; who sells spam and malware tools and services.</p></div>
<p>The Manipulaters&#8217; core brand in the underground is a shared cybercriminal identity named &#8220;<strong>Saim Raza</strong>,&#8221; who for the past decade across dozens of cybercrime sites and forums has peddled a popular spamming and phishing service variously called &#8220;<strong>Fudtools</strong>,&#8221; &#8220;<strong>Fudpage</strong>,&#8221; &#8220;<strong>Fudsender</strong>,&#8221; etc.</p>
<p>The common acronym in nearly all of Saim Raza&#8217;s domains over the years &#8212; &#8220;FUD&#8221; &#8212; stands for &#8220;<strong>F</strong>ully <strong>U</strong>n-<strong>D</strong>etectable,&#8221; and it refers to cybercrime resources that will evade detection by security tools like antivirus software or anti-spam appliances.</p>
<div id="attachment_56857" style="width: 775px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56857" loading="lazy" class=" wp-image-56857" src="media/590fabbd.ftexploit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit.png" alt="" width="765" height="542" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit.png 1208w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit-768x544.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit-782x553.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ftexploit-100x70.png 100w" sizes="(max-width: 765px) 100vw, 765px" /><p id="caption-attachment-56857" class="wp-caption-text">One of several current Fudtools sites run by The Manipulaters.</p></div>
<p>The current website for Saim Raza&#8217;s Fud Tools (above) offers phishing templates or &#8220;scam pages&#8221; for a variety of popular online sites like <strong>Office365</strong> and <strong>Dropbox</strong>. They also sell &#8220;Doc Exploit&#8221; products that bundle malicious software with innocuous Microsoft Office documents; &#8220;scampage hosting&#8221; for phishing sites; a variety of spam blasting tools like <strong>HeartSender;</strong> and software designed to help spammers route their malicious email through compromised sites, accounts and services in the cloud.</p>
<p>For years leading up to 2015, &#8220;<strong>admin@manipulaters.com</strong>&#8221; was the name on the registration records for thousands of scam domains that spoofed some of the world&#8217;s top banks and brand names, but particularly Apple and Microsoft. When confronted about this, The Manipulaters founder <strong>Madih-ullah Riaz</strong> replied, &#8220;We do not deliberately host or allow any phishing or any other abusive website. Regarding phishing, whenever we receive complaint, we remove the services immediately. Also we are running business since 2006.&#8221;</p>
<div id="attachment_56864" style="width: 271px" class="wp-caption alignright"><a href="media/4528b270.manip-firststeps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/manip-firststeps.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56864" loading="lazy" class="wp-image-56864" src="media/4528b270.manip-firststeps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/manip-firststeps.png" alt="" width="261" height="386" /></a><p id="caption-attachment-56864" class="wp-caption-text">The IT network of The Manipulaters, circa 2013. Image: Facebook</p></div>
<p>Two years later, KrebsOnSecurity received an email from Riaz asking to have his name and that of his business partner removed from the 2015 story, saying it had hurt his company&#8217;s ability to maintain stable hosting for their stable of domains.</p>
<p>&#8220;We run web hosting business and due to your post we got very serious problems especially no data center was accepting us,&#8221; Riaz wrote in a May 2017 email. &#8220;I can see you post on hard time criminals we are not criminals, at least it was not in our knowledge.&#8221;</p>
<p>Riaz said the problem was his company&#8217;s billing system erroneously used The Manipulators&#8217; name and contact information instead of its clients in WHOIS registration records. That oversight, he said, caused many researchers to erroneously attribute to them activity that was coming from just a few bad customers.</p>
<p>&#8220;We work hard to earn money and it is my request, 2 years of my name in your wonderful article is enough punishment and we learned from our mistakes,&#8221; he concluded.</p>
<p>The Manipulaters have indeed learned a few new tricks, but keeping their underground operations air-gapped from their real-life identities is mercifully not one of them.</p>
<h2>ZERO OPERATIONAL SECURITY</h2>
<p>Phishing domain names registered to The Manipulaters included an address in Karachi, with the phone number <strong>923218912562</strong>. That same phone number is shared in the WHOIS records for 4,000+ domains registered through <strong>domainprovider[.]work</strong>, a domain controlled by The Manipulaters that appears to be a reseller of another domain name provider.</p>
<p>One of Saim Raza&#8217;s many ads in the cybercrime underground for his Fudtools service promotes the domain <strong>fudpage[.]com</strong>, and the WHOIS records for that domain share the same Karachi phone number. Fudpage&#8217;s WHOIS records list the contact as &#8220;<strong>admin@apexgrand.com</strong>,&#8221; which is another email address used by The Manipulaters to register domains.</p>
<p><a href="media/ed2ddac3.manipulaters-overlap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/manipulaters-overlap.png" target="_blank" rel="noopener"><img loading="lazy" class="aligncenter wp-image-56882" src="media/ed2ddac3.manipulaters-overlap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/manipulaters-overlap.png" alt="" width="765" height="460" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/manipulaters-overlap.png 1213w, https://krebsonsecurity.com/wp-content/uploads/2021/09/manipulaters-overlap-768x462.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/manipulaters-overlap-782x470.png 782w" sizes="(max-width: 765px) 100vw, 765px" /></a></p>
<p>As I noted in 2015, The Manipulaters Team used domain name service (DNS) settings from another blatantly fraudulent service called &#8216;<strong>FreshSpamTools[.]eu</strong>,&#8217; which was offered by a fellow Pakistani who also conveniently sold phishing toolkits targeting a number of big banks.</p>
<p>The WHOIS records for FreshSpamTools briefly list the email address <strong>bilal.waddaich@gmail.com</strong>, which corresponds to the email address for a Facebook account of a <strong>Bilal &#8220;Sunny&#8221; Ahmad Warraich</strong> (a.k.a. Bilal Waddaich).</p>
<div id="attachment_56858" style="width: 769px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56858" loading="lazy" class=" wp-image-56858" src="media/cbc217d3.bilalwaddaich.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/bilalwaddaich.png" alt="" width="759" height="582" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/bilalwaddaich.png 1023w, https://krebsonsecurity.com/wp-content/uploads/2021/09/bilalwaddaich-768x589.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/bilalwaddaich-782x599.png 782w" sizes="(max-width: 759px) 100vw, 759px" /><p id="caption-attachment-56858" class="wp-caption-text">Bilal Waddaich&#8217;s current Facebook profile photo includes many current and former employees of We Code Solutions.</p></div>
<p>Warraich&#8217;s Facebook profile says he works as an IT support specialist at a software development company in Lahore called <strong>We Code Solutions</strong>.</p>
<div id="attachment_56896" style="width: 779px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56896" loading="lazy" class=" wp-image-56896" src="media/fa6c9741.wecodesolutionshome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/wecodesolutionshome.png" alt="" width="769" height="412" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/wecodesolutionshome.png 1537w, https://krebsonsecurity.com/wp-content/uploads/2021/09/wecodesolutionshome-768x411.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/wecodesolutionshome-782x419.png 782w" sizes="(max-width: 769px) 100vw, 769px" /><p id="caption-attachment-56896" class="wp-caption-text">The We Code Solutions website.</p></div>
<p>A review of the hosting records for the company&#8217;s website <strong>wecodesolutions[.]pk</strong> show that over the past three years it has shared a server with just a handful of other domains, including:</p>
<p>-saimraza[.]tools<br />
-fud[.]tools<br />
-heartsender[.]net<br />
-fudspampage[.]com<br />
-fudteam[.]com<br />
-autoshopscript[.]com<br />
-wecodebilling[.]com<br />
-antibotspanel[.]com<br />
-sellonline[.]tools</p>
<h2>FUD CO</h2>
<p>The profile image atop Warraich&#8217;s Facebook page is a group photo of current and former We Code Solutions employees. Helpfully, many of the faces in that photo have been tagged and associated with their respective Facebook profiles.</p>
<p>For example, the Facebook profile of <strong>Burhan Ul Haq</strong>, a.k.a. &#8220;<strong>Burhan Shaxx</strong>&#8221; says he works in human relations and IT support for We Code Solutions. Scanning through Ul Haq&#8217;s endless selfies on Facebook, it&#8217;s impossible to ignore a series of photos featuring various birthday cakes <em>and the words &#8220;Fud Co&#8221; written in icing on top.</em></p>
<div id="attachment_56859" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56859" loading="lazy" class=" wp-image-56859" src="media/d65eb670.burhancake.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/burhancake.png" alt="" width="764" height="377" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/burhancake.png 950w, https://krebsonsecurity.com/wp-content/uploads/2021/09/burhancake-768x379.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/burhancake-782x386.png 782w" sizes="(max-width: 764px) 100vw, 764px" /><p id="caption-attachment-56859" class="wp-caption-text">Burhan Ul Haq&#8217;s photos show many Fud Co-themed cakes the We Code Solutions employees enjoyed on the anniversary of the Manipulaters Team.</p></div>
<p>Yes, from a review of the Facebook postings of We Code Solutions employees, it appears that for at least the last five years this group has celebrated an anniversary every May with a Fud Co cake, non-alcoholic sparkling wine, and a Fud Co party or group dinner. Let&#8217;s take a closer look at that delicious cake:</p>
<p><img loading="lazy" class="aligncenter wp-image-56860" src="media/8a798345.fudcocake.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake.png" alt="" width="754" height="776" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake.png 834w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake-768x790.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcocake-782x805.png 782w" sizes="(max-width: 754px) 100vw, 754px" /><span id="more-42684"></span></p>
<p>The head of We Code Solutions appears to be a guy named <strong>Rameez Shahzad</strong>, the older individual at the center of the group photo in Warraich&#8217;s Facebook profile. You can tell Shahzad is <a href="https://www.facebook.com/photo.php?fbid=2491160847779183&amp;set=pb.100006558753783.-2207520000..&amp;type=3" target="_blank" rel="noopener">the boss</a> because he is at the center of virtually every group photo he and other We Code Solutions employees posted to their respective Facebook pages.</p>
<div id="attachment_56867" style="width: 776px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56867" loading="lazy" class="wp-image-56867" src="media/b066df15.fudcoteam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam.png" alt="" width="766" height="358" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam.png 1694w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam-768x359.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam-1536x718.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/09/fudcoteam-782x366.png 782w" sizes="(max-width: 766px) 100vw, 766px" /><p id="caption-attachment-56867" class="wp-caption-text">We Code Solutions boss Rameez Shahzad (in sunglasses) is in the center of this group photo, which was posted by employee Burhan Ul Haq, pictured just to the right of Shahzad.</p></div>
<p>Shahzad&#8217;s postings on Facebook are even more revelatory: On Aug. 3, 2018, he posted a screenshot of someone logged into a WordPress site under the username Saim Raza &#8212; the same identity that&#8217;s been pimping Fud Co spam tools for close to a decade now.</p>
<p>&#8220;After [a] long time, Mailwizz ready,&#8221; Shahzad wrote as a caption to the photo:</p>
<div id="attachment_56861" style="width: 778px" class="wp-caption aligncenter"><a href="media/dbdfabc2.ramizsaim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/ramizsaim.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56861" loading="lazy" class="wp-image-56861" src="media/dbdfabc2.ramizsaim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/ramizsaim.png" alt="" width="768" height="365" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/ramizsaim.png 1387w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ramizsaim-768x364.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ramizsaim-782x371.png 782w" sizes="(max-width: 768px) 100vw, 768px" /></a><p id="caption-attachment-56861" class="wp-caption-text">We Code Solutions boss Rameez Shahzad posted on Facebook a screenshot of someone logged into a WordPress site with the username Saim Raza, the same cybercriminal identity that has peddled the FudTools spam empire for more than 10 years.</p></div>
<p>Whoever controlled the Saim Raza cybercriminal identity had a penchant for re-using the same password (&#8220;lovertears&#8221;) across dozens of Saim Raza email addresses. One of Saim Raza&#8217;s favorite email address variations was &#8220;game.changer@[pick ISP here]&#8221;. Another email address advertised by Saim Raza was &#8220;bluebtcus@gmail.com.&#8221;</p>
<p>So it was not surprising to see Rameez Shahzad post a screenshot to his Facebook account of his computer desktop, which shows he is logged into a Skype account that begins with the name &#8220;game.&#8221; and a Gmail account beginning with &#8220;bluebtc.&#8221;</p>
<div id="attachment_56885" style="width: 775px" class="wp-caption aligncenter"><a href="media/f075641f.rameez-gc-bbtc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/rameez-gc-bbtc.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56885" loading="lazy" class="wp-image-56885" src="media/f075641f.rameez-gc-bbtc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/rameez-gc-bbtc.png" alt="" width="765" height="457" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/rameez-gc-bbtc.png 1380w, https://krebsonsecurity.com/wp-content/uploads/2021/09/rameez-gc-bbtc-768x459.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/rameez-gc-bbtc-782x467.png 782w" sizes="(max-width: 765px) 100vw, 765px" /></a><p id="caption-attachment-56885" class="wp-caption-text">Image: Scylla Intel</p></div>
<p>KrebsOnSecurity attempted to reach We Code Solutions via the contact email address on its website &#8212; info@wecodesolutions[.]pk &#8212; but the message bounced back, saying there was no such address. Similarly, a call to the Lahore phone number listed on the website produced an automated message saying the number is not in service. None of the We Code Solutions employees contacted directly via email or phone responded to requests for comment.</p>
<h2>FAIL BY NUMBERS</h2>
<p>This open-source research on The Manipulaters and We Code Solutions is damning enough. But the real icing on the Fud Co cake is that sometime in 2019, <em>The Manipulaters failed to renew their core domain name</em> &#8212; manipulaters[.]com &#8212; the same one tied to so many of the company&#8217;s past and current business operations.</p>
<p>That domain was quickly scooped up by <a href="https://www.scyllaintel.com/" target="_blank" rel="noopener">Scylla Intel</a>, a cyber intelligence firm that specializes in connecting cybercriminals to their real-life identities. Whoops.</p>
<p>Scylla co-founder <strong>Sasha Angus</strong> said the messages that flooded their inbox once they set up an email server on that domain quickly filled in many of the details they didn&#8217;t already have about The Manipulaters.</p>
<p><span class="pullquote pqright">&#8220;We know the principals, their actual identities, where they are, where they hang out,&#8221; Angus said. &#8220;I&#8217;d say we have several thousand exhibits that we could put into evidence potentially.</span> We have them six ways to Sunday as being the guys behind this Saim Raza spammer identity on the forums.&#8221;</p>
<p>Angus said he and a fellow researcher briefed U.S. prosecutors in 2019 about their findings on The Manipulaters, and that investigators expressed interest but also seemed overwhelmed by the volume of evidence that would need to be collected and preserved about this group&#8217;s activities.</p>
<p>&#8220;I think one of the things the investigators found challenging about this case was not who did what, but just how much bad stuff they&#8217;ve done over the years,&#8221; Angus said. &#8220;With these guys, you keep going down this rabbit hole that never ends because there&#8217;s always more, and it&#8217;s fairly astonishing. They are prolific. If they had halfway decent operational security, they could have been really successful. But thankfully, they don&#8217;t.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=56914
title: Microsoft: Attackers Exploiting Windows Zero-Day Flaw
uri: Microsoft-Attackers-Exploiting-Windows-Zero-Day-Flaw
url: https://krebsonsecurity.com/2021/09/microsoft-attackers-exploiting-windows-zero-day-flaw/
content:
<p><strong>Microsoft Corp.</strong> warns that attackers are exploiting a previously unknown vulnerability in <strong>Windows 10</strong> and many <strong>Windows Server</strong> versions to seize control over PCs when users open a malicious document or visit a booby-trapped website. There is currently no official patch for the flaw, but Microsoft has released recommendations for mitigating the threat.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-56919" src="media/de2e8261.ms-bldg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/ms-bldg.png" alt="" width="617" height="449" /></p>
<p>According to <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444" target="_blank" rel="noopener">a security advisory</a> from Redmond, the security hole <a href="https://us-cert.cisa.gov/ncas/current-activity/2021/09/07/microsoft-releases-mitigations-and-workarounds-cve-2021-40444" target="_blank" rel="noopener">CVE-2021-40444</a> affects the &#8220;MSHTML&#8221; component of <strong>Internet Explorer</strong> (IE) on <strong>Windows 10</strong> and many <strong>Windows Server</strong> versions. IE been slowly abandoned for more recent Windows browsers like <strong>Edge</strong>, but the same vulnerable component also is used by <strong>Microsoft Office</strong> applications for rendering web-based content.</p>
<p>&#8220;An attacker could craft a malicious ActiveX control to be used by a Microsoft Office document that hosts the browser rendering engine,&#8221; Microsoft wrote. &#8220;The attacker would then have to convince the user to open the malicious document. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.&#8221;</p>
<p>Microsoft has not yet released a patch for CVE-2021-40444, but says users can mitigate the threat from this flaw by disabling the installation of all ActiveX controls in IE. Microsoft says the vulnerability is currently being used in targeted attacks, although its advisory credits three different entities with reporting the flaw.</p>
<p>On of the researchers credited &#8212; <strong>EXPMON</strong> &#8212; <a href="https://twitter.com/EXPMON_/status/1435310341689331721" target="_blank" rel="noopener">said on Twitter</a> that it had reproduced the attack on the latest Office 2019 / Office 365 on Windows 10.</p>
<p>&#8220;The exploit uses logical flaws so the exploitation is perfectly reliable (&amp; dangerous),&#8221; EXPMON tweeted.</p>
<p>Windows users could see an official fix for the bug as soon as September 14, when Microsoft is slated to release its monthly &#8220;Patch Tuesday&#8221; bundle of security updates.<span id="more-56914"></span></p>
<p>This year has been a tough one for Windows users and so-called &#8220;zero day&#8221; threats, which refers to vulnerabilities that are not patched by current versions of the software in question, and are being actively exploited to break into vulnerable computers.</p>
<p>Virtually every month in 2021 so far, Microsoft has been forced to respond to zero-day threats targeting huge swaths of its user base. In fact, by my count May was the only month so far this year that Microsoft didn&#8217;t release a patch to fix at least one zero-day attack in Windows or supported software.</p>
<p>Many of those zero-days involve older Microsoft technologies or those that have been retired, like IE11; Microsoft <a href="https://techcommunity.microsoft.com/t5/microsoft-365-blog/microsoft-365-apps-say-farewell-to-internet-explorer-11-and/ba-p/1591666" target="_blank" rel="noopener">officially retired support for Microsoft Office 365 apps and services on IE11</a> last month. In July, Microsoft <a href="https://krebsonsecurity.com/2021/07/microsoft-issues-emergency-patch-for-windows-flaw/" target="_blank" rel="noopener">rushed out a fix for the Print Nightmare vulnerability</a> that was present in every supported version of Windows, only to see the patch cause problems for a number of Windows users.</p>
<p>On June&#8217;s Patch Tuesday, Microsoft <a href="https://krebsonsecurity.com/2021/06/microsoft-patches-six-zero-day-security-holes/" target="_blank" rel="noopener">addressed six zero-day security holes</a>. And of course in March, hundreds of thousands of organizations running <strong>Microsoft Exchange</strong> email servers found those systems <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">compromised with backdoors thanks to four zero-day flaws in Exchange</a>.</p>


feed_id: https://krebsonsecurity.com/?p=56565
title: KrebsOnSecurity Hit By Huge New IoT Botnet “Meris”
uri: KrebsOnSecurity-Hit-By-Huge-New-IoT-Botnet-Meris
url: https://krebsonsecurity.com/2021/09/krebsonsecurity-hit-by-huge-new-iot-botnet-meris/
content:
<p>On Thursday evening, KrebsOnSecurity was the subject of a rather massive (and mercifully brief) distributed denial-of-service (DDoS) attack. The assault came from &#8220;<strong>Meris</strong>,&#8221; the same new &#8220;Internet of Things&#8221; (IoT) botnet behind record-shattering attacks against Russian search giant <strong>Yandex</strong> this week and internet infrastructure firm<strong> Cloudflare</strong> earlier this summer.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-36825" src="media/799359f6.ddosbomb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb.png" alt="" width="699" height="430" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb.png 699w, https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb-580x357.png 580w" sizes="(max-width: 699px) 100vw, 699px" /></p>
<p>Cloudflare recently <a href="https://blog.cloudflare.com/cloudflare-thwarts-17-2m-rps-ddos-attack-the-largest-ever-reported/" target="_blank" rel="noopener">wrote about its attack</a>, which clocked in at 17.2 million bogus requests-per-second. To put that in perspective, Cloudflare serves over 25 million HTTP requests per second on average.</p>
<p>In its Aug. 19 writeup, Cloudflare neglected to assign a name to the botnet behind the attack. But on Thursday DDoS protection firm <strong>Qrator Labs</strong> <a href="https://blog.qrator.net/en/meris-botnet-climbing-to-the-record_142/" target="_blank" rel="noopener">identified the culprit</a> &#8212; &#8220;Meris&#8221; &#8212; a new IoT monster that first emerged at the end of June 2021.</p>
<p>Qrator says Meris has launched even bigger attacks since: A titanic and ongoing DDoS that hit Russian Internet search giant<strong> Yandex</strong> last week is estimated to have been launched by roughly 250,000 malware-infected devices globally, sending 21.8 million bogus requests-per-second.</p>
<p>While last night&#8217;s Meris attack on this site was far smaller than the recent Cloudflare DDoS, it was far larger than <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">the Mirai DDoS attack</a> in 2016 that <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">held KrebsOnSecurity offline for nearly four days</a>. The traffic deluge from Thursday&#8217;s attack on this site was was more than four times what Mirai threw at this site five years ago. This latest attack involved more than two million requests-per-second. By comparison, the 2016 Mirai DDoS generated approximately 450,000 requests-per-second.</p>
<p>According to Qrator, which is working with Yandex on combating the attack, Meris appears to be made up of Internet routers produced by <a href="https://mikrotik.com/" target="_blank" rel="noopener">MikroTik</a>. Qrator says the United States is home to the most number of MikroTik routers that are potentially vulnerable to compromise by Meris &#8212; with more than 42 percent of the world&#8217;s MikroTik systems connected to the Internet (followed by China &#8212; 18.9 percent&#8211; and a long tail of one- and two-percent countries).</p>
<div id="attachment_56933" style="width: 760px" class="wp-caption aligncenter"><a href="media/e0b788ec.mikrotik-globe.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/mikrotik-globe.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56933" loading="lazy" class="wp-image-56933" src="media/e0b788ec.mikrotik-globe.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/mikrotik-globe.png" alt="" width="750" height="359" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/mikrotik-globe.png 879w, https://krebsonsecurity.com/wp-content/uploads/2021/09/mikrotik-globe-768x368.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/mikrotik-globe-782x375.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-56933" class="wp-caption-text">The darker areas indicate larger concentrations of potentially vulnerable MikroTik routers. Qrator says there are about 328,000 MikroTik devices currently responding to requests from the Internet. Image: Qrator.</p></div>
<p>It&#8217;s not immediately clear which security vulnerabilities led to these estimated 250,000 MikroTik routers getting hacked by Meris.</p>
<p>&#8220;The spectrum of RouterOS versions we see across this botnet varies from years old to recent,&#8221; the company wrote. &#8220;The largest share belongs to the version of firmware previous to the current stable one.&#8221;<span id="more-56565"></span></p>
<div id="attachment_56934" style="width: 767px" class="wp-caption aligncenter"><a href="media/c38b4602.meris-os.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/meris-os.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-56934" loading="lazy" class="wp-image-56934" src="media/c38b4602.meris-os.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/meris-os.png" alt="" width="757" height="480" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/meris-os.png 900w, https://krebsonsecurity.com/wp-content/uploads/2021/09/meris-os-768x487.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/meris-os-782x496.png 782w" sizes="(max-width: 757px) 100vw, 757px" /></a><p id="caption-attachment-56934" class="wp-caption-text">Qrator&#8217;s breakdown of Meris-infected MikroTik devices by operating system version.</p></div>
<p>It&#8217;s fitting that Meris would rear its head on the five-year anniversary of the emergence of Mirai, an IoT botnet strain that was engineered to out-compete all other IoT botnet strains at the time. Mirai was extremely successful at crowding out this competition, and quickly grew to infect tens of thousands of IoT devices <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank" rel="noopener">made by dozens of manufacturers</a>.</p>
<p>And then <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">its co-authors</a> decided to <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener">leak the Mirai source code</a>, which led to the proliferation of dozens of Mirai variants, many of which continue to operate today.</p>
<p>The biggest contributor to the IoT botnet problem &#8212; a plethora of companies white-labeling IoT devices that were never designed with security in mind and are often shipped to the customer in default-insecure states &#8212; hasn&#8217;t changed much, mainly because these devices tend to be far cheaper than more secure alternatives.</p>
<p>The good news is that over the past five years, large Internet infrastructure companies like <strong>Akamai</strong>, Cloudflare and <strong>Google</strong> (which protects this site with its <a href="https://projectshield.withgoogle.com/" target="_blank" rel="noopener">Project Shield initiative</a>) have heavily invested in ramping up their ability to withstand these outsized attacks [full disclosure: Akamai is an advertiser on this site].</p>
<p>More importantly, the Internet community at large has gotten better at putting their heads together to fight DDoS attacks, by disrupting the infrastructure abused by these enormous IoT botnets, said <strong>Richard Clayton</strong>, director of <a href="https://www.cambridgecybercrime.uk/" target="_blank" rel="noopener">Cambridge University&#8217;s Cybercrime Centre</a>.</p>
<p>&#8220;It would be fair to say we&#8217;re currently concerned about a couple of botnets which are larger than we have seen for some time,&#8221; Clayton said. &#8220;But equally, you never know they may peter out. There are a lot of people who spend their time trying to make sure these things are hard to keep stable. So there are people out there defending us all.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=56909
title: Microsoft Patch Tuesday, September 2021 Edition
uri: Microsoft-Patch-Tuesday-September-2021-Edition
url: https://krebsonsecurity.com/2021/09/microsoft-patch-tuesday-september-2021-edition/
content:
<p><strong>Microsoft</strong> today pushed software updates to plug dozens of security holes in Windows and related products, including a vulnerability that is already being exploited in active attacks. Also, <strong>Apple</strong> has issued an emergency update to fix a flaw that&#8217;s reportedly been abused to install spyware on <strong>iOS</strong> products, and <strong>Google</strong>&#8216;s got a new version of <strong>Chrome</strong> that tackles two zero-day flaws. Finally, Adobe has released critical security updates for <strong>Acrobat</strong>, <strong>Reader</strong> and a slew of other software.</p>
<p><img loading="lazy" class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="767" height="540" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 767px) 100vw, 767px" /></p>
<p>Four of the flaws fixed in this patch batch earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating, meaning they could be exploited by miscreants or malware to remotely compromise a Windows PC with little or no help from the user.</p>
<p>Top of the critical heap is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40444" target="_blank" rel="noopener">CVE-2021-40444</a>, which affects the “MSHTML” component of <strong>Internet Explorer</strong> (IE) on <strong>Windows 10</strong> and many <strong>Windows Server</strong> versions. In <a href="https://krebsonsecurity.com/2021/09/microsoft-attackers-exploiting-windows-zero-day-flaw/" target="_blank" rel="noopener">a security advisory last week</a>, Microsoft warned attackers already are exploiting the flaw through <strong>Microsoft Office</strong> applications as well as IE.</p>
<p>The critical bug <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2021-36965" target="_blank" rel="noopener">CVE-2021-36965</a> is interesting, as it involves a remote code execution flaw in &#8220;WLAN AutoConfig,&#8221; the component in Windows 10 and many Server versions that handles auto-connections to Wi-Fi networks. One mitigating factor here is that the attacker and target would have to be on the same network, although many systems are configured to auto-connect to Wi-Fi network names with which they have previously connected.</p>
<p><strong>Allan Liska</strong>, senior security architect at <a href="https://www.recordedfuture.com" target="_blank" rel="noopener">Recorded Future</a>, said a similar vulnerability &#8212; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-28316" target="_blank" rel="noopener">CVE-2021-28316</a> &#8212; was announced in April.</p>
<p>&#8220;CVE-2021-28316 was a security bypass vulnerability, not remote code execution, and it has never been reported as publicly exploited,&#8221; Liska said. &#8220;That being said, the ubiquity of systems deployed with WLAN AutoConfig enabled could make it an attractive target for exploitation.&#8221;<span id="more-56909"></span></p>
<p><strong>Kevin Breen</strong> of <a href="https://www.immersivelabs.com/" target="_blank" rel="noopener">Immersive Labs</a> calls attention to several &#8220;privilege escalation&#8221; flaws fixed by Microsoft this month, noting that while these bugs carry lesser severity ratings, Microsoft considers them more likely to be exploited by bad guys and malware.</p>
<p>&#8220;<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38639" target="_blank" rel="noopener">CVE-2021-38639</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36975" target="_blank" rel="noopener">CVE-2021-36975</a> have also been listed as &#8216;exploitation more likely&#8217; and together cover the full range of supported Windows versions,&#8221; Breem wrote. &#8220;I am starting to feel like a broken record when talking about privilege escalation vulnerabilities. They typically have a lower CVSS score than something like Remote Code Execution, but these local exploits can be the linchpin in the post-exploitation phases of an experienced attacker. If you can block them here you have the potential to significantly limit their damage. If we assume a determined attacker will be able to infect a victim’s device through social engineering or other techniques, I would argue that patching these is even more important than patching some other Remote Code execution vulnerabilities.&#8221;</p>
<p>Apple on Monday pushed out <a href="https://support.apple.com/en-us/HT212807" target="_blank" rel="noopener">an urgent security update</a> to fix a &#8220;zero-click&#8221; iOS vulnerability (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-30860" target="_blank" rel="noopener">CVE-2021-30860</a>) reported by researchers at <strong>Citizen Lab</strong> that allows commands to be run when files are opened on certain Apple devices. <a href="https://citizenlab.ca/2021/09/forcedentry-nso-group-imessage-zero-click-exploit-captured-in-the-wild/" target="_blank" rel="noopener">Citizen Lab found</a> that an exploit for CVE-2021-30860 was being used by the <a href="https://en.wikipedia.org/wiki/NSO_Group" target="_blank" rel="noopener">NSO Group</a>, an Israeli tech company whose spyware enables the remote surveillance of smartphones.</p>
<p><strong>Google</strong> also released <a href="https://chromereleases.googleblog.com/2021/09/stable-channel-update-for-desktop.html" target="_blank" rel="noopener">a new version</a> of its <strong>Chrome</strong> browser on Monday to fix nine vulnerabilities, including two that are under active attack. If you&#8217;re running Chrome, keep a lookout for when you see an &#8220;Update&#8221; tab appear to the right of the address bar. If it&#8217;s been a while since you closed the browser, you might see the Update button turn from green to orange and then red. Green means an update has been available for two days; orange means four days have elapsed, and red means your browser is a week or more behind on important updates. Completely close and restart the browser to install any pending updates.</p>
<p>As it usually does on Patch Tuesday, Adobe also released new versions of Reader, Acrobat and <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">a large number of other products</a>. Adobe says it is not aware of any exploits in the wild for any of the issues addressed in its updates today.</p>
<p>For a complete rundown of all patches released today and indexed by severity, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+September+2021+Patch+Tuesday/27834/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/2021/september-2021-its-patch-day/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that are causing problems for Windows users.</p>
<p>On that note, before you update <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.</p>


feed_id: https://krebsonsecurity.com/?p=56999
title: Customer Care Giant TTEC Hit By Ransomware?
uri: Customer-Care-Giant-TTEC-Hit-By-Ransomware
url: https://krebsonsecurity.com/2021/09/customer-care-giant-ttec-hit-by-ransomware/
content:
<p><strong>TTEC</strong>, [<a href="https://www.google.com/finance/quote/TTEC:NASDAQ?sa=X&amp;ved=2ahUKEwjXwqSy4oHzAhWdElkFHTMhCVQQ3ecFegQIDBAS" target="_blank" rel="noopener">NASDAQ: TTEC</a>], a company used by some of the world&#8217;s largest brands to help manage customer support and sales online and over the phone, is dealing with disruptions from a network security incident that appears to be the result of a ransomware attack, KrebsOnSecurity has learned.</p>
<p><img loading="lazy" class="aligncenter wp-image-57001" src="media/9a61447f.ttec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/ttec.png" alt="" width="764" height="405" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/ttec.png 1082w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ttec-768x407.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/ttec-782x415.png 782w" sizes="(max-width: 764px) 100vw, 764px" /></p>
<p>While many companies have been laying off or furloughing workers in response to the Coronavirus pandemic, TTEC has been <a href="https://www.wsj.com/articles/millions-of-jobs-have-been-lost-but-hiring-is-booming-at-these-companies-11602768600" target="_blank" rel="noopener">massively hiring</a>. Formerly TeleTech Holdings Inc., Englewood, Co.-based TTEC now has nearly 60,000 employees, most of whom work from home and answer customer support calls on behalf of a large number of name-brand companies, like <strong>Bank of America</strong>, <strong>Best Buy</strong>, <strong>Credit Karma</strong>, <strong>Dish Network</strong>, <strong>Kaiser Permanente</strong>, <strong>USAA</strong> and <strong>Verizon</strong>.</p>
<p>On Sept. 14, KrebsOnSecurity heard from a reader who passed on an internal message apparently sent by TTEC to certain employees regarding the status of a widespread system outage that began on Sunday, Sept. 12.</p>
<p>&#8220;We&#8217;re continuing to address the system outage impacting access to the network, applications and customer support,&#8221; reads an internal message sent by TTEC to certain employees.</p>
<p>TTEC has not responded to requests for comment. A phone call placed to the media contact number listed on an August 2021 TTEC earnings release produced a message saying it was a non-working number.</p>
<p>TTEC&#8217;s own message to employees suggests the company&#8217;s network may have been hit by the ransomware group &#8220;Ragnar Locker,&#8221; (or else by <a href="https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/" target="_blank" rel="noopener">a rival ransomware gang pretending to be Ragnar</a>). The message urged employees to avoid clicking on a file that suddenly may have appeared in their Windows start menu called &#8220;!RA!G!N!A!R!&#8221;</p>
<p>&#8220;DO NOT click on this file,&#8221; the notice read. &#8220;It&#8217;s a nuisance message file and we&#8217;re working on removing it from our systems.&#8221;</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-57000" src="media/1aa4d00e.ttec-ragnar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/ttec-ragnar.png" alt="" width="515" height="299" /></p>
<p>Ragnar Locker is an aggressive ransomware group that typically demands millions of dollars worth of cryptocurrency in ransom payments. In <a href="https://www.bleepingcomputer.com/news/security/ransomware-gang-threatens-to-leak-data-if-victim-contacts-fbi-police/" target="_blank" rel="noopener">an announcement published on the group&#8217;s darknet leak site this week</a>, the group threatened to publish the full data of victims who seek help from law enforcement and investigative agencies following a ransomware attack.</p>
<p>One of the messages texted to TTEC employees included a link to a <strong>Zoom</strong> videoconference line at <strong>ttec.zoom.us</strong>. Clicking that link opened a Zoom session in which multiple TTEC employees who were sharing their screens took turns using the company&#8217;s Global Service Desk, an internal TTEC system for tracking customer support tickets.</p>
<p>The TTEC employees appear to be using the Zoom conference line to report the status of various customer support teams, most of which are reporting &#8220;unable to work&#8221; at the moment.</p>
<p>For example, TTEC&#8217;s Service Desk reports that hundreds of TTEC employees assigned to work with Bank of America&#8217;s prepaid services are unable to work because they can&#8217;t remotely connect to TTEC&#8217;s customer service tools. More than 1,000 TTEC employees are currently unable to do their normal customer support work for Verizon, according to the Service Desk data. Hundreds of employees assigned to handle calls for Kaiser Permanente also are unable to work.</p>
<p>&#8220;They&#8217;ve been radio silent all week except to notify employees to take another day off,&#8221; said the source who passed on the TTEC messages, who spoke to KrebsOnSecurity on condition of anonymity. &#8220;As far as I know, all low-level employees have another day off today.&#8221;</p>
<p>The extent and severity of the incident at TTEC remains unknown. It is common for companies to disconnect critical systems in the event of a network intrusion, as part of a larger effort to stop the badness from spreading elsewhere. Sometimes disconnecting everything actually does help, or at least helps to keep the attack from spreading to partner networks. But it is those same connections to partner companies that raises concern in the case of TTEC&#8217;s ongoing outage.</p>
<p>In the meantime, if you&#8217;re unlucky enough to need to make a customer service call today, there&#8217;s a better-than-even chance you will experience&#8230;.wait for it&#8230;longer-than-usual hold times.</p>
<p>This is a developing story. Further details or updates will be noted here with a date and time stamp.</p>
<p><strong>Update, 5:37 p.m. ET:</strong> TTEC responded with the following statement:</p>
<blockquote>
<p style="font-weight: 400;">TTEC is committed to cyber security, and to protecting the integrity of our clients’ systems and data. We recently became aware of a cybersecurity incident that has affected certain TTEC systems.  Although as a result of the  incident, some of our data was encrypted and business activities at several facilities have been temporarily disrupted, the company continuous to serve its global clients. TTEC immediately activated its information security incident response business continuity protocols, isolated the systems involved, and took other appropriate measures to contain the incident. We are now in the process of  carefully and deliberately restoring the systems that have been involved.</p>
<p style="font-weight: 400;">We also launched an investigation, typical under the circumstances, to determine the potential impacts.  In serving our clients TTEC, generally, does not maintain our clients’ data, and the investigation to date has not identified compromise to clients’ data. That investigation is on-going and we will take additional action, as appropriate, based on the investigation’s results. This is all the information we have to share until our investigation is complete.</p>
</blockquote>


feed_id: https://krebsonsecurity.com/?p=57016
title: Trial Ends in Guilty Verdict for DDoS-for-Hire Boss
uri: Trial-Ends-in-Guilty-Verdict-for-DDoS-for-Hire-Boss
url: https://krebsonsecurity.com/2021/09/trial-ends-in-guilty-verdict-for-ddos-for-hire-boss/
content:
<p>A jury in California today reached a guilty verdict in the trial of <strong>Matthew Gatrel</strong>, a St. Charles, Ill. man charged in 2018 with operating two online services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against Internet users and websites. Gatrel&#8217;s conviction comes roughly two weeks after his co-conspirator pleaded guilty to criminal charges related to running the services.</p>
<div id="attachment_46107" style="width: 775px" class="wp-caption alignnone"><a href="media/cf505133.downthempanel2.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/downthempanel2.jpg" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-46107" loading="lazy" class="wp-image-46107" src="media/cf505133.downthempanel2.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/downthempanel2.jpg" alt="" width="765" height="570" aria-describedby="caption-attachment-46107" /></a><p id="caption-attachment-46107" class="wp-caption-text">The user interface for Downthem[.]org.</p></div>
<p>Prosecutors for the Central District of California charged Gatrel, 32, and his business partner <strong>Juan &#8220;Severon&#8221; Martinez</strong> of Pasadena, Calif. with operating two DDoS-for-hire or &#8220;booter&#8221; services &#8212; <strong>downthem[.]org</strong> and <strong>ampnode[.]com</strong>.</p>
<p>Despite admitting to FBI agents that he ran these booter services (and turning over plenty of incriminating evidence in the process), Gatrel opted to take his case to trial, defended the entire time by public defenders. Facing the prospect of a hefty sentence if found guilty at trial, Martinez pleaded guilty on Aug. 26 to one count of unauthorized impairment of a protected computer.</p>
<p>Gatrel was <a href="https://www.justice.gov/usao-cdca/pr/illinois-man-convicted-federal-criminal-charges-operating-subscription-based-computer" rel="noopener" target="_blank">convicted</a> on all three charges of violating the Computer Fraud and Abuse Act, including conspiracy to commit unauthorized impairment of a protected computer, conspiracy to commit wire fraud, and unauthorized impairment of a protected computer.</p>
<p>Investigators say Downthem helped some 2,000 customers launch debilitating digital assaults at more than 200,000 targets, including many government, banking, university and gaming Web sites.</p>
<p>Prosecutors alleged that in addition to running and marketing Downthem, the defendants sold huge, continuously updated lists of Internet addresses tied to devices that could be used by other booter services to make attacks far more powerful and effective. In addition, other booter services also drew firepower and other resources from Ampnode.<span id="more-57016"></span></p>
<p>Booter and stresser services let customers pick from among a variety of attack methods, but almost universally the most powerful of these methods involves what’s known as a “reflective amplification attack.” In such assaults, the perpetrators leverage unmanaged Domain Name Servers (DNS) or other devices on the Web to create huge traffic floods.</p>
<p>Ideally, DNS servers only provide services to machines within a trusted domain — such as translating an Internet address from a series of numbers into a domain name, like example.com. But DNS reflection attacks rely on consumer and business routers and other devices equipped with DNS servers that are (mis)configured to accept queries from anywhere on the Web.</p>
<p>Attackers can send spoofed DNS queries to these DNS servers, forging the request so that it appears to come from the target’s network. That way, when the DNS servers respond, they reply to the spoofed (target) address.</p>
<p>The bad guys also can amplify a reflective attack by crafting DNS queries so that the responses are much bigger than the requests. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This “amplification” effect is especially pronounced if the perpetrators query dozens of DNS servers with these spoofed requests simultaneously.</p>
<p>The government charged that Gatrel and Martinez constantly scanned the Internet for these misconfigured devices, and then sold lists of Internet addresses tied to these devices to other booter service operators.</p>
<p>Gatrel&#8217;s sentencing is scheduled for January 27, 2022. He faces a statutory maximum sentence of 35 years in federal prison. However, given the outcome of past prosecutions against other booter service operators, it seems unlikely that Gatrel will spend much time in jail.</p>
<p>The case against Gatrel and Martinez was brought as part of <a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" target="_blank" rel="noopener">a widespread crackdown on booter services in Dec. 2018</a>, when the FBI joined with law enforcement partners overseas to seize 15 different booter service domains.</p>
<p>Federal prosecutors and DDoS experts interviewed at the time said the operation had three main goals: To educate people that hiring DDoS attacks is illegal, to destabilize the flourishing booter industry, and to ultimately reduce demand for booter services.</p>
<p>The jury is still out on whether any of those goals have been achieved with lasting effect.</p>
<p>The original complaint against Gatrel and Martinez is <a href="media/d598ddd0.gatrelcomplaint.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/gatrelcomplaint.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=56912
title: Does Your Organization Have a Security.txt File?
uri: Does-Your-Organization-Have-a-Security-txt-File
url: https://krebsonsecurity.com/2021/09/does-your-organization-have-a-security-txt-file/
content:
<p>It happens all the time: Organizations get hacked because there isn&#8217;t an obvious way for security researchers to let them know about security vulnerabilities or data leaks. Or maybe it isn&#8217;t entirely clear who should get the report when remote access to an organization&#8217;s internal network is being sold in the cybercrime underground.</p>
<p>In a bid to minimize these scenarios, a growing number of major companies are adopting &#8220;<a href="https://securitytxt.org/" target="_blank" rel="noopener">Security.txt</a>,&#8221; a proposed new Internet standard that helps organizations describe their vulnerability disclosure practices and preferences.</p>
<div id="attachment_57043" style="width: 776px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57043" loading="lazy" class=" wp-image-57043" src="media/6c2364d7.samplesecuritytxt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/samplesecuritytxt.png" alt="" width="766" height="367" /><p id="caption-attachment-57043" class="wp-caption-text">An example of a security.txt file. Image: Securitytxt.org.</p></div>
<p>The idea behind Security.txt is straightforward: The organization places a file called security.txt in a predictable place &#8212; such as example.com/security.txt, or example.com/.well-known/security.txt. What&#8217;s in the security.txt file varies somewhat, but most include links to information about the entity&#8217;s vulnerability disclosure policies and a contact email address.</p>
<p>The <a href="https://www.usaa.com/.well-known/security.txt" target="_blank" rel="noopener">security.txt file</a> made available by <strong>USAA</strong>, for example, includes links to its bug bounty program; an email address for disclosing security related matters; its public encryption key and vulnerability disclosure policy; and even a link to a page where USAA thanks researchers who have reported important cybersecurity issues.</p>
<p>Other security.txt disclosures are less verbose, as in the case of <strong>HCA Healthcare</strong>, which <a href="https://gotsecuritytxt.com/query/hcahealthcare.com" target="_blank" rel="noopener">lists</a> a contact email address, and a link to HCA&#8217;s &#8220;responsible disclosure&#8221; policies. Like USAA and many other organizations that have published security.txt files, HCA Healthcare also includes a link to information about IT security job openings at the company.</p>
<p>Having a security.txt file can make it easier for organizations to respond to active security threats. For example, just this morning a trusted source forwarded me the VPN credentials for a major clothing retailer. Finding no security.txt file at the retailer&#8217;s site using <a href="https://gotsecuritytxt.com/query/amazon.com" target="_blank" rel="noopener">gotsecuritytxt.com</a> (which checks a domain for the presence of this contact file), KrebsonSecurity sent an alert to its &#8220;security@&#8221; email address for the retailer&#8217;s domain.</p>
<p>Many organizations have long unofficially used (if not advertised) the email address security@[companydomain] to accept reports about security incidents or vulnerabilities. Perhaps this particular retailer also did so at one point, however my message was returned with a note saying the email had been blocked. KrebsOnSecurity also sent a message to the retailer&#8217;s chief information officer (CIO) &#8212; the only person in a C-level position at the retailer who was in my immediate LinkedIn network. I still have no idea if anyone has read it.</p>
<p>Although security.txt is not yet an official Internet standard as approved by the <strong>Internet Engineering Task Force</strong> (IETF), its basic principles have so far been adopted by at least eight percent of the Fortune 100 companies. According to a review of the domain names for the latest Fortune 100 firms via gotsecuritytxt.com, those include <a href="https://www.google.com/.well-known/security.txt" target="_blank" rel="noopener">Alphabet</a>, <a href="https://www.amazon.com/security.txt" target="_blank" rel="noopener">Amazon</a>, <a href="https://www.facebook.com/.well-known/security.txt" target="_blank" rel="noopener">Facebook</a>, <a href="https://hcahealthcare.com/.well-known/security.txt" target="_blank" rel="noopener">HCA Healthcare</a>, <a href="http://www.kroger.com/.well-known/security.txt" target="_blank" rel="noopener">Kroger</a>, <a href="https://www.pg.com/.well-known/security.txt" target="_blank" rel="noopener">Procter &amp; Gamble</a>, <a href="https://www.usaa.com/.well-known/security.txt" target="_blank" rel="noopener">USAA</a> and <a href="https://www.walmart.com/.well-known/security.txt" target="_blank" rel="noopener">Walmart</a>.</p>
<p>There may be another good reason for consolidating security contact and vulnerability reporting information in one, predictable place. <strong>Alex Holden</strong>, founder of the Milwaukee-based consulting firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, said it&#8217;s not uncommon for malicious hackers to experience problems getting the attention of the proper people within the very same organization they have just hacked.</p>
<p>&#8220;In cases of ransom, the bad guys try to contact the company with their demands,&#8221; Holden said. &#8220;You have no idea how often their messages get caught in filters, get deleted, blocked or ignored.&#8221;<span id="more-56912"></span></p>
<h2>GET READY TO BE DELUGED</h2>
<p>So if security.txt is so great, why haven&#8217;t more organizations adopted it yet? It seems that setting up a security.txt file tends to invite a rather high volume of spam. Most of these junk emails come from self-appointed penetration testers who &#8212; without any invitation to do so &#8212; run automated vulnerability discovery tools and then submit the resulting reports in hopes of securing a consulting engagement or <a href="https://hackerone.com/bug-bounty-programs" target="_blank" rel="noopener">a bug bounty fee</a>.</p>
<p>This dynamic was a major topic of discussion in <a href="https://news.ycombinator.com/item?id=19152145" target="_blank" rel="noopener">these Hacker</a> <a href="https://news.ycombinator.com/item?id=19152145" target="_blank" rel="noopener">News threads</a> on security.txt, wherein a number of readers related their experience of being so flooded with low-quality vulnerability scan reports that it became difficult to spot the reports truly worth pursuing further.</p>
<p><strong>Edwin &#8220;EdOverflow&#8221; Foudil</strong>, the co-author of the proposed notification standard, acknowledged that junk reports are a major downside for organizations that offer up a security.txt file.</p>
<p>&#8220;This is actually stated in the specification itself, and it&#8217;s incredibly important to highlight that organizations that implement this are going to get flooded,&#8221; Foudil told KrebsOnSecurity. &#8220;One reason bug bounty programs succeed is that they are basically a glorified spam filter. But regardless of what approach you use, you&#8217;re going to get inundated with these crappy, sub-par reports.&#8221;</p>
<p>Often these sub-par vulnerability reports come from individuals who have scanned the entire Internet for one or two security vulnerabilities, and then attempted to contact all vulnerable organizations at once in some semi-automated fashion. Happily, Foudil said, many of these nuisance reports can be ignored or grouped by creating filters that look for messages containing keywords commonly found in automated vulnerability scans.</p>
<p>Foudil said despite the spam challenges, he&#8217;s heard tremendous feedback from a number of universities that have implemented security.txt.</p>
<p>&#8220;It&#8217;s been an incredible success with universities, which tend to have lots of older, legacy systems,&#8221; he said. &#8220;In that context, we&#8217;ve seen a ton of valuable reports.&#8221;</p>
<p>Foudil says he&#8217;s delighted that eight of the Fortune 100 firms have already implemented security.txt, even though it has not yet been approved as an IETF standard. When and if security.txt is approved, he hopes to spend more time promoting its benefits.</p>
<p>&#8220;I&#8217;m not trying to make money off this thing, which came about after chatting with quite a few people at DEFCON [the annual security conference in Las Vegas] who were struggling to report security issues to vendors,&#8221; Foudil said. &#8220;The main reason I don&#8217;t go out of my way to promote it now is because it&#8217;s not yet an official standard.&#8221;</p>
<p>Has your organization considered or implemented security.txt? Why or why not? Sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=57039
title: Indictment, Lawsuits Revive Trump-Alfa Bank Story
uri: Indictment-Lawsuits-Revive-Trump-Alfa-Bank-Story
url: https://krebsonsecurity.com/2021/09/lawsuits-indictments-revive-trump-alfa-bank-story/
content:
<p>In October 2016, media outlets reported that data collected by some of the world&#8217;s most renowned cybersecurity experts had identified frequent and unexplained communications between an email server used by the <strong>Trump Organization</strong> and <strong>Alfa Bank</strong>, one of Russia&#8217;s largest financial institutions. Those publications set off speculation about a possible secret back-channel of communications, as well as a series of lawsuits and investigations that culminated last week with the indictment of the same former federal cybercrime prosecutor who brought the data to the attention of the <strong>FBI</strong> five years ago.</p>
<div id="attachment_57067" style="width: 310px" class="wp-caption alignright"><a href="media/69682b89.alfacomplaint.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/alfacomplaint.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-57067" loading="lazy" class="wp-image-57067" src="media/69682b89.alfacomplaint.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/alfacomplaint.png" alt="" width="300" height="368" /></a><p id="caption-attachment-57067" class="wp-caption-text">The first page of Alfa Bank&#8217;s 2020 complaint.</p></div>
<p>Since 2018, access to an exhaustive report commissioned by the U.S. Senate Armed Services Committee on data that prompted those experts to seek out the FBI has been limited to a handful of Senate committee leaders, Alfa Bank, and special prosecutors appointed to look into the origins of the FBI investigation on alleged ties between Trump and Russia.</p>
<p>That report is now public, ironically thanks to <a href="https://www.justsecurity.org/72262/the-trump-alfa-bank-server-mystery-resurfaces/" target="_blank" rel="noopener">a pair of lawsuits filed by Alfa Bank</a>, which doesn&#8217;t directly dispute the information collected by the researchers. Rather, it <a href="media/69682b89.alfacomplaint.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/alfacomplaint.png" target="_blank" rel="noopener">claims</a> that the data they found was the result of a &#8220;highly sophisticated cyberattacks against it in 2016 and 2017&#8221; intended &#8220;to fabricate apparent communications&#8221; between Alfa Bank and the Trump Organization.</p>
<p>The data at issue refers to communications traversing the Domain Name System (DNS), a global database that maps computer-friendly coordinates like Internet addresses (e.g., 8.8.8.8) to more human-friendly domain names (example.com). Whenever an Internet user gets online to visit a website or send an email, the user&#8217;s device sends a query through the Domain Name System.</p>
<p>Many different entities capture and record this DNS data as it traverses the public Internet, allowing researchers to go back later and see which Internet addresses resolved to what domain names, when, and for how long. Sometimes the metadata generated by these lookups can be used to identify or infer persistent network connections between different Internet hosts.</p>
<p>The DNS strangeness was first identified in 2016 by a group of security experts who told reporters they were alarmed at the <a href="https://en.wikipedia.org/wiki/Democratic_National_Committee_cyber_attacks" target="_blank" rel="noopener">hacking of the Democratic National Committee</a>, and grew concerned that the same attackers might also target Republican leaders and institutions.</p>
<p>Scrutinizing the Trump Organization&#8217;s online footprint, the researchers determined that for several months during the spring and summer of 2016, Internet servers at Alfa Bank in Russia, <strong>Spectrum Health</strong> in Michigan, and <strong>Heartland Payment Systems</strong> in New Jersey accounted for nearly all of the several thousand DNS lookups for a specific Trump Organization server (mail1.trump-email.com).</p>
<div id="attachment_57065" style="width: 767px" class="wp-caption aligncenter"><a href="media/dcc0f3c7.mailtrump.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/mailtrump.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-57065" loading="lazy" class="wp-image-57065" src="media/dcc0f3c7.mailtrump.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/mailtrump.png" alt="" width="757" height="465" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/mailtrump.png 904w, https://krebsonsecurity.com/wp-content/uploads/2021/09/mailtrump-768x472.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/mailtrump-782x480.png 782w" sizes="(max-width: 757px) 100vw, 757px" /></a><p id="caption-attachment-57065" class="wp-caption-text">This chart from a court filing Sept. 14, 2021 shows the top sources of traffic to the Trump Organization email server over a four month period in the spring and summer of 2016. DNS lookups from Alfa Bank constituted the majority of those requests.</p></div>
<p>The researchers said they couldn&#8217;t be sure what kind of communications between those servers had caused the DNS lookups, but concluded that the data would be extremely difficult to fabricate.</p>
<p>As recounted in <a href="https://www.newyorker.com/magazine/2018/10/15/was-there-a-connection-between-a-russian-bank-and-the-trump-campaign" target="_blank" rel="noopener">this 2018 New Yorker story</a>, New York Times journalist <strong>Eric Lichtblau</strong> met with FBI officials in late September 2016 to discuss the researchers&#8217; findings, and that the bureau asked him to hold the story because publishing might disrupt an ongoing investigation. On Sept. 21, 2016, Lichtblau reportedly shared the DNS data with <a href="https://bgrdc.com/" target="_blank" rel="noopener">B.G.R.</a>, a Washington lobbying firm that worked with Alfa Bank.</p>
<p>Lichtblau&#8217;s reporting on the DNS findings ended up buried in an October 31, 2016 story titled &#8220;<a href="https://www.nytimes.com/2016/11/01/us/politics/fbi-russia-election-donald-trump.html" target="_blank" rel="noopener">Investigating Donald Trump, F.B.I. Sees No Clear Link to Russia</a>,&#8221; which stated that the FBI &#8220;ultimately concluded that there could be an innocuous explanation, like marketing email or spam,&#8221; that might explain the unusual DNS connections.</p>
<p>But that same day, Slate&#8217;s <strong>Franklin Foer</strong> <a href="http://www.slate.com/articles/news_and_politics/cover_story/2016/10/was_a_server_registered_to_the_trump_organization_communicating_with_russia.html" target="_blank" rel="noopener">published a story</a> based on his interactions with the researchers. Foer noted that roughly two days after Lichtblau shared the DNS data with B.G.R., the Trump Organization email server domain vanished from the Internet &#8212; its domain effectively decoupled from its Internet address.</p>
<p>Foer wrote that The Times hadn&#8217;t yet been in touch with the Trump campaign about the DNS data when the Trump email domain suddenly went offline.  Odder still, four days later the Trump Organization created a new host &#8212; <strong>trump1.contact-client.com</strong> &#8212; and the very first DNS lookup to that new domain came from servers at Alfa Bank.</p>
<p>The researchers concluded that the new domain enabled communication to the very same server via a different route.</p>
<p>&#8220;When a new host name is created, the first communication with it is never random,&#8221; Foer wrote. &#8220;To reach the server after the resetting of the host name, the sender of the first inbound mail has to first learn of the name somehow. It’s simply impossible to randomly reach a renamed server.&#8221;</p>
<p>&#8220;That party had to have some kind of outbound message through SMS, phone, or some noninternet channel they used to communicate [the new configuration],” DNS expert <strong>Paul Vixie</strong> told Foer. &#8220;The first attempt to look up the revised host name came from Alfa Bank. If this was a public server, we would have seen other traces. The only look-ups came from this particular source.&#8221;<span id="more-57039"></span></p>
<h2>THE THEORIES</h2>
<p>Both the Trump organization and Alfa Bank have denied using or establishing any sort of secret channel of communications, and have offered differing explanations as to how the data gathered by the experts could have been faked or misinterpreted.</p>
<p>In <a href="http://www.slate.com/articles/news_and_politics/politics/2016/11/the_trump_server_evaluating_new_evidence_and_countertheories.html" target="_blank" rel="noopener">a follow-up story by Foer</a>, the Trump Organization suggested that the DNS lookups might be the result of spam or email advertising various Trump properties, and said a Florida based marketing firm called <strong>Cendyn</strong> registered and managed the email server in question.</p>
<p>But Cendyn told <strong>CNN</strong> that its contract to provide email marketing services to the Trump Organization <a href="https://www.cnn.com/2017/03/09/politics/fbi-investigation-continues-into-odd-computer-link-between-russian-bank-and-trump-organization/index.html" target="_blank" rel="noopener">ended in March 2016</a> &#8212; weeks before the DNS lookups chronicled by the researchers started appearing. Cendyn told CNN that a different client had been communicating with Alfa Bank using Cendyn communications applications &#8212; a claim that Alfa Bank denied.</p>
<p>Alfa Bank subsequently hired computer forensics firms <strong>Mandiant</strong> and <strong>Stroz Friedberg</strong> to examine the DNS data presented by the researchers. Both companies concluded there was no evidence of email communications between Alfa Bank and the Trump Organization. However, both firms also <a href="media/029d5b95.dinh.to.grassley.feinstein.pdf" data-original-source="http://i2.cdn.turner.com/cnn/2017/images/07/24/dinh.to.grassley.feinstein.pdf" target="_blank" rel="noopener">acknowledged</a> that <em>Alfa Bank didn&#8217;t share any DNS data for the relevant four-month time period identified by the researchers.</em></p>
<p>Another theory for the DNS weirdness outlined in Mandiant&#8217;s report is that Alfa Bank&#8217;s servers performed the repeated DNS lookups for the Trump Organization server because its internal Trend Micro antivirus product routinely scanned domains in emails for signs of malicious activity &#8212; and that incoming marketing emails promoting Trump properties could have explained the traffic.</p>
<p>The researchers maintained this did not explain similar and repeated DNS lookups made to the Trump Organization email server by Spectrum Health, which is closely tied to the DeVos family (Betsy DeVos would later be appointed Secretary of Education by President Trump).</p>
<h2>FISHING EXPEDITION</h2>
<p>In June 2020, Alfa Bank filed two &#8220;John Doe&#8221; lawsuits, one in Pennsylvania and another in Florida. Their stated purpose was to identify the anonymous hackers behind the &#8220;highly sophisticated cyberattacks&#8221; that they claim were responsible for the mysterious DNS lookups.</p>
<p>Alfa Bank has so far subpoenaed at least 49 people or entities &#8212; including all of the security experts quoted in the 2016 media stories referenced above, and others who&#8217;d merely offered their perspectives on the matter via social media. At least 15 of those individuals or entities have since been deposed. Alfa Bank&#8217;s most recent subpoena was issued Aug. 26, 2021.</p>
<p><strong>L. Jean Camp</strong>, a professor at the <strong>Indiana University School of Informatics and Computing</strong>, was among the first to publish some of the DNS data collected by the research group. In 2017, Alfa Bank sent Camp a series of threatening letters suggesting she was &#8220;a central figure&#8221; in the what the company would later claim was &#8220;malicious cyber activity targeting its computer network.&#8221; The letters and responses from her attorneys are published <a href="http://www.ljean.com/NetworkData.php" target="_blank" rel="noopener">on her website</a>.</p>
<p>Camp&#8217;s attorneys and Indiana University have managed to keep her from being deposed by both Alfa Bank and <strong>John H. Durham</strong>, the special counsel appointed by the Trump administration to look into the origins of the Russia investigation (although Camp said Alfa Bank was able to obtain certain emails through the school&#8217;s public records request policy).</p>
<p>&#8220;If MIT had had the commitment to academic freedom that Indiana University has shown throughout this entire process, <a href="https://en.wikipedia.org/wiki/Aaron_Swartz" target="_blank" rel="noopener">Aaron Swartz</a> would still be alive,&#8221; Camp said.</p>
<p>Camp said she&#8217;s bothered that the Alfa Bank and Trump special counsel investigations have cast the researchers in such a sinister light, when many of those subpoenaed have spent a lifetime trying to make the Internet more secure.</p>
<p>&#8220;Not including me, they&#8217;ve subpoenaed some people who are significant, consistent and important contributors to the security of American networks against the very attacks coming from Russia,&#8221; Camp said. <span class="pullquote pqright">&#8220;I think they&#8217;re using law enforcement to attack network security, and to determine the ways in which their previous attacks have been and are being detected.&#8221;</span></p>
<p><strong>Nicholas Weaver</strong>, a lecturer at the computer science department at <strong>University of California, Berkeley</strong>, told KrebsOnSecurity he complied with the subpoena requests for specific emails he&#8217;d sent to colleagues about the DNS data, noting that Alfa Bank could have otherwise obtained them through the schools&#8217; public records policy.</p>
<p>Weaver said Alfa Bank&#8217;s lawsuit has nothing to do with uncovering the truth about the DNS data, but rather with intimidating and silencing researchers who&#8217;ve spoken out about it.</p>
<p>&#8220;It&#8217;s clearly abusive, so I&#8217;m willing to call it out for what it is, which is a John Doe lawsuit for a fishing expedition,&#8221; Weaver said.</p>
<h2>TURNABOUT IS FAIR PLAY</h2>
<p>Among those subpoenaed and deposed by Alfa Bank was <a href="https://en.wikipedia.org/wiki/Daniel_J._Jones" target="_blank" rel="noopener">Daniel J. Jones</a>, a former investigator for the FBI and the U.S. Senate who is perhaps best known for his role in leading the investigation into the U.S. Central Intelligence Agency&#8217;s use of torture in the wake of the Sept. 11 attacks.</p>
<p>Jones runs <strong>The Democracy Integrity Project</strong> (TDIP), a nonprofit in Washington, D.C. whose stated mission includes efforts to research, investigate and help mitigate foreign interference in elections in the United States and its allies overseas. In 2018, U.S. Senate investigators asked TDIP to produce and share a detailed analysis of the DNS data, which it did without payment. That lengthy report was never publicly released by the committee nor anyone else.</p>
<p>That is, until Sept. 14, 2021, when Jones and TDIP filed their own lawsuit against Alfa Bank. According to Jones&#8217; complaint, Alfa Bank had entered into a confidentiality agreement regarding certain sensitive and personal information Jones was compelled to provide as part of complying with the subpoena.</p>
<p>Yet on Aug. 20, Alfa Bank attorneys sent written notice that it was challenging portions of the confidentiality agreement. Jones&#8217; complaint asserts that Alfa Bank intends to publicly file portions of these confidential exhibits, an outcome that could jeopardize his safety.</p>
<p>This would not be the first time testimony Jones provided under a confidentiality agreement ended up in the public eye. TDIP&#8217;s complaint notes that before Jones met with FBI officials in 2017 to discuss Russian disinformation campaigns, he was assured by two FBI agents that his identity would be protected from exposure and that any information he provided to the FBI would not be associated with him.</p>
<p>Nevertheless, in 2018 the House Permanent Select Committee on Intelligence released a redacted report on Russian active measures. The report blacked out Jones&#8217; name, but a series of footnotes in the report named his employer and included links to his organization&#8217;s website. Jones&#8217; complaint spends several pages detailing the thousands of death threats he received after that report was published online.</p>
<h2>THE TDIP REPORT</h2>
<p>As part of his lawsuit against Alfa Bank, Jones published 40 pages from the 600+ page report he submitted to the U.S. Senate in 2018. From reviewing its table of contents, the remainder of the unpublished report appears to delve deeply into details about Alfa Bank&#8217;s history, its owners, and their connections to the Kremlin.</p>
<p>The report notes that unlike other domains the Trump Organization used to send mass marketing emails, the domain at issue &#8212; mail1.trump-email.com &#8212; was configured in such a way that would have prevented it from effectively sending marketing or bulk emails. Or at least prevented most of the missives sent through the domain from ever making it past spam filters.</p>
<p><img loading="lazy" class=" wp-image-57083 aligncenter" src="media/5385deef.spf-trumpemail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/spf-trumpemail.png" alt="" width="763" height="146" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/spf-trumpemail.png 827w, https://krebsonsecurity.com/wp-content/uploads/2021/09/spf-trumpemail-768x147.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/spf-trumpemail-782x149.png 782w" sizes="(max-width: 763px) 100vw, 763px" /></p>
<p>Nor was the domain configured like other Trump Organization domains that demonstrably did send commercial email, Jones&#8217; analysis found. Also, the mail1.trump-email.com domain was never once flagged as sending spam by any of the 57 different spam block lists published online at the time.</p>
<p>&#8220;If large amounts of marketing emails were emanating from mail1.trump-email.com, it&#8217;s likely that some receivers of those emails would have marked them as spam,&#8221; Jones&#8217; 2018 report reasons. &#8220;Spam is nothing new on the internet, and mass mailings create easily observed phenomena, such as a wide dispersion of backscatter queries from spam filters. No such evidence is found in the logs.&#8221;</p>
<p>However, Jones&#8217; report did find that mail1.trump-email.com was configured to <em>accept</em> incoming email. Jones cites testing conducted by one of the researchers who found the mail1.trump-email.com rejected messages with an automated reply saying the server couldn&#8217;t accept messages from that particular sender.</p>
<p>&#8220;This test reveals that either the server was configured to reject email from everyone, or that the server was configured to accept only emails from specific senders,&#8221; TDIP wrote.</p>
<p>The report also puts a finer point on the circumstances surrounding the disappearance of that Trump Organization email domain just two days after The New York Times shared the DNS data with Alfa Bank&#8217;s representatives.</p>
<p>&#8220;After the record was deleted for mail1.trump-email.com on Sept. 23, 2016, Alfa Bank and Spectrum Health continued to conduct DNS lookups for mail1.trump-email.com,&#8221; reads the report. &#8220;In the case of Alfa Bank, this behavior persisted until late Friday night on Sept. 23, 2016 (Moscow time). At that point, Alfa Bank ceased its DNS lookups of mail1.trump-email.com.&#8221;</p>
<p>Less than ten minutes later, a server assigned to Alfa Bank was the first source in the DNS data-set examined (37 million DNS records from January 1, 2016 to January 15, 2017) to conduct a DNS look-up for the server name &#8216;<strong>trump1.contact-client.com</strong>.&#8217; The answer received was <strong>66.216.133.29</strong> &#8212; the same IP address used for mail1.trump-email.com that was deleted in the days after The New York Times inquired with Alfa Bank about the unusual server connections.</p>
<p>&#8220;No servers associated with Alfa Bank ever conducted a DNS lookup for trump1.contact-client.com again, and the next DNS look-up for trump1.contact-client.com did not occur until October 5, 2016,&#8221; the report continues. &#8220;Three of these five look-ups from October 2016 originated from Russia.&#8221;</p>
<p>A copy of the complaint filed by Jones against Alfa Bank is available <a href="media/279d8d32.JonesvAlfa.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/JonesvAlfa.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<h2>THE SUSSMANN INDICTMENT</h2>
<p>The person who first brought the DNS data to the attention of the FBI in Sept. 2016 was <strong>Michael Sussmann</strong>, a 57-year-old cybersecurity lawyer and former computer crimes prosecutor who represented the Democratic National Committee and Hillary Clinton&#8217;s presidential campaign.</p>
<p>Last week, the special counsel Durham <a href="https://www.justice.gov/sco/press-release/file/1433511/download" target="_blank" rel="noopener">indicted</a> Sussmann on charges of making a false statement to the FBI. The New York Times reports the accusation focuses on a meeting Sussmann had Sept. 19, 2016 with <strong>James A. Baker</strong>, the FBI&#8217;s top lawyer at the time. Sussmann had reportedly met with Baker to discuss the DNS data uncovered by the researchers.</p>
<p>&#8220;The indictment says Mr. Sussmann falsely told the F.B.I. lawyer that he had no clients, but he was really representing both a technology executive and the Hillary Clinton campaign,&#8221; The Times <a href="https://www.nytimes.com/2021/09/17/us/politics/michael-sussman-russia-investigation.html" target="_blank" rel="noopener">wrote</a>.</p>
<p>Sussmann has pleaded not guilty to the charges.</p>
<h2>ANALYSIS</h2>
<p><a href="https://www.justice.gov/sco/press-release/file/1433511/download" target="_blank" rel="noopener">The Sussmann indictment</a> refers to the various researchers who contacted him in 2016 by placeholder names, such as Tech Executive-1 and Researcher-1 and Researcher-2. The tone of indictment reads as if describing a vast web of nefarious or illegal activities, although it doesn&#8217;t attempt to address the veracity of any specific concerns raised by the researchers.  Here is one example:</p>
<p>&#8220;From in or about July 2016 through at least in or about February 2017, however, Originator-I, Researcher-I, and Researcher-2 also exploited Internet Company­-1&#8242; s data and other data to assist Tech Executive-I in his efforts to conduct research concerning Trump&#8217;s potential ties to Russia.&#8221;</p>
<p>Quoting from emails between Tech Executive-1 and the researchers, the indictment makes clear that Mr. Durham has subpoenaed many of the same researchers who&#8217;ve been subpoenaed and or deposed in the concurrent John Doe lawsuits from Russia&#8217;s Alfa Bank.</p>
<p>To date, Alfa Bank has yet to name a single defendant in its lawsuits. In the meantime, the Sussmann indictment is being dissected by many users on social media who have been closely following the Trump administration&#8217;s inquiry into the Russia investigation. The majority of these social media posts appear to be crowdsourcing an effort to pinpoint the real-life identities behind the placeholder names in the indictment.</p>
<p>At one level, it doesn&#8217;t matter which explanation of the DNS data you believe: There is a very real possibility that the way this entire inquiry has been handled could negatively affect the FBI&#8217;s ability to collect crucial and sensitive investigative tips for years to come.</p>
<p>After all, who in their right mind is going to volunteer confidential information to the FBI if they fear there&#8217;s even the slightest chance that future shifting political winds could end up seeing them prosecuted, threatened with physical violence or death on social media, and/or exposed to expensive legal fees and depositions from private companies as a result?</p>
<p>Such a perception could give rise to a sort of &#8220;chilling effect,&#8221; discouraging honest, well-meaning people from speaking up when they suspect or know about a potential threat to national security or sovereignty.</p>
<p>This would be a less-than-ideal outcome in the context of today&#8217;s top cyber threat for most organizations: Ransomware. With few exceptions, the U.S. government has watched helplessly as organized cybercrime gangs &#8212; many of whose members hail from Russia or from former Soviet nations that are friendly to Moscow &#8212; have extorted billions of dollars from victims, and disrupted or ruined countless businesses.</p>
<p>To help shift the playing field against ransomware actors, the Justice Department and other federal law enforcement agencies have been trying to encourage more ransomware victims to come forward and share sensitive details about their attacks. The U.S. government has even offered up to $10 million for information leading to the arrest and conviction of cybercriminals involved in ransomware.</p>
<p>But given the way the government has essentially shot the all of the messengers with its handling of the Sussmann case, who could blame those with useful and valid tips if they opted to stay silent?</p>


feed_id: https://krebsonsecurity.com/?p=57118
title: Apple AirTag Bug Enables ‘Good Samaritan’ Attack
uri: Apple-AirTag-Bug-Enables-Good-Samaritan-Attack
url: https://krebsonsecurity.com/2021/09/apple-airtag-bug-enables-good-samaritan-attack/
content:
<p>The new $30 <strong>AirTag</strong> tracking device from <strong>Apple</strong> has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner&#8217;s phone number if the AirTag has been set to lost mode. But according to new research, this same feature can be abused to redirect the Good Samaritan to an iCloud phishing page &#8212; or to any other malicious website.</p>
<p><img loading="lazy" class="aligncenter wp-image-57127" src="media/9f1af2c4.airtag.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/airtag.png" alt="" width="558" height="548" /></p>
<p>The AirTag&#8217;s &#8220;Lost Mode&#8221; lets users alert Apple when an AirTag is missing. Setting it to Lost Mode generates a unique URL at https://found.apple.com, and allows the user to enter a personal message and contact phone number. Anyone who finds the AirTag and scans it with an Apple or Android phone will immediately see that unique Apple URL with the owner&#8217;s message.</p>
<p>When scanned, an AirTag in Lost Mode will present a short message asking the finder to call the owner at at their specified phone number. This information pops up without asking the finder to log in or provide any personal information. But your average Good Samaritan might not know this.</p>
<p>That&#8217;s important because Apple&#8217;s Lost Mode doesn&#8217;t currently stop users from injecting arbitrary computer code into its phone number field &#8212; such as code that causes the Good Samaritan&#8217;s device to visit a phony Apple iCloud login page.</p>
<div id="attachment_57129" style="width: 648px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57129" loading="lazy" class="size-full wp-image-57129" src="media/8181d7de.airtagcall.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/airtagcall.png" alt="" width="638" height="758" /><p id="caption-attachment-57129" class="wp-caption-text">A sample &#8220;Lost Mode&#8221; message. Image: Medium @bobbyrsec</p></div>
<p>The vulnerability was discovered and reported to Apple by <a href="https://www.linkedin.com/in/bobby-rauch/" target="_blank" rel="noopener">Bobby Rauch</a>, a security consultant and penetration tester based in Boston. Rauch told KrebsOnSecurity the AirTag weakness makes the devices cheap and possibly very effective physical trojan horses.</p>
<p>&#8220;I can&#8217;t remember another instance where these sort of small consumer-grade tracking devices at a low cost like this could be weaponized,&#8221; Rauch said.</p>
<p>Consider the scenario where an attacker drops a malware-laden USB flash drive in the parking lot of a company he wants to hack into. Odds are that sooner or later some employee is going to pick that sucker up and plug it into a computer &#8212; just to see what&#8217;s on it (the drive might even be labeled something tantalizing, like &#8220;Employee Salaries&#8221;).</p>
<p>If this sounds like a script from a James Bond movie, you&#8217;re not far off the mark. <a href="https://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/" target="_blank" rel="noopener">A USB stick with malware</a> is very likely how U.S. and Israeli cyber hackers got the infamous <a href="https://en.wikipedia.org/wiki/Stuxnet" target="_blank" rel="noopener">Stuxnet worm</a> into the internal, air-gapped network that powered Iran&#8217;s nuclear enrichment facilities a decade ago. In 2008, a cyber attack <a href="https://en.wikipedia.org/wiki/2008_cyberattack_on_United_States" target="_blank" rel="noopener">described</a> at the time as &#8220;the worst breach of U.S. military computers in history&#8221; was traced back to a USB flash drive left in the parking lot of a U.S. Department of Defense facility.</p>
<p><span class="pullquote pqright">In the modern telling of this caper, a weaponized AirTag tracking device could be used to redirect the Good Samaritan to a phishing page, or to a website that tries to foist malicious software onto her device.</span></p>
<p>Rauch contacted Apple about the bug on June 20, but for three months when he inquired about it the company would say only that it was still investigating. Last Thursday, the company sent Rauch a follow-up email stating they planned to address the weakness in an upcoming update, and in the meantime would he mind not talking about it publicly?</p>
<p>Rauch said Apple never acknowledged basic questions he asked about the bug, such as if they had a timeline for fixing it, and if so whether they planned to credit him in the accompanying security advisory. Or whether his submission would qualify for Apple&#8217;s &#8220;bug bounty&#8221; program, which promises financial rewards of up to $1 million for security researchers who report security bugs in Apple products.</p>
<p>Rauch said he&#8217;s reported many software vulnerabilities to other vendors over the years, and that Apple&#8217;s lack of communication prompted him <a href="https://medium.com/@bobbyrsec/6997da43a216" target="_blank" rel="noopener">to go public with his findings</a> &#8212; even though Apple says staying quiet about a bug until it is fixed is how researchers qualify for recognition in security advisories.</p>
<p>&#8220;I told them, &#8216;I&#8217;m willing to work with you if you can provide some details of when you plan on remediating this, and whether there would be any recognition or bug bounty payout&#8217;,&#8221; Rauch said, noting that he told Apple he planned to publish his findings within 90 days of notifying them. &#8220;Their response was basically, &#8216;We&#8217;d appreciate it if you didn&#8217;t leak this.'&#8221;</p>
<p>Rauch&#8217;s experience echoes that of other researchers interviewed in <a href="https://www.washingtonpost.com/technology/2021/09/09/apple-bug-bounty/" target="_blank" rel="noopener">a recent <em>Washington Post</em> article</a> about how not fun it can be to report security vulnerabilities to Apple, a notoriously secretive company. The common complaints were that Apple is slow to fix bugs and doesn&#8217;t always pay or publicly recognize hackers for their reports, and that researchers often receive little or no feedback from the company.<span id="more-57118"></span></p>
<p>The risk, of course, is that some researchers may decide it&#8217;s less of a hassle to sell their exploits to vulnerability brokers, or on the darknet &#8212; both of which often pay far more than bug bounty awards.</p>
<p>There&#8217;s also a risk that frustrated researchers will simply post their findings online for everyone to see and exploit &#8212; regardless of whether the vendor has released a patch. Earlier this week, a security researcher who goes by the handle &#8220;illusionofchaos&#8221; released writeups on three zero-day vulnerabilities in Apple&#8217;s iOS mobile operating system &#8212; apparently out of frustration over trying to work with Apple&#8217;s bug bounty program.</p>
<p><em>Ars Technica</em> <a href="https://arstechnica.com/information-technology/2021/09/three-ios-0-days-revealed-by-researcher-frustrated-with-apples-bug-bounty/" target="_blank" rel="noopener">reports</a> that on July 19 Apple fixed a bug that llusionofchaos reported on April 29, but that Apple neglected to credit him in its security advisory.</p>
<p>&#8220;Frustration with this failure of Apple to live up to its own promises led illusionofchaos to first threaten, then publicly drop this week&#8217;s three zero-days,&#8221; wrote <strong>Jim Salter</strong> for Ars. &#8220;In illusionofchaos&#8217; own words: &#8216;Ten days ago I asked for an explanation and warned then that I would make my research public if I don&#8217;t receive an explanation. My request was ignored so I&#8217;m doing what I said I would.'&#8221;</p>
<p>Rauch said he realizes the AirTag bug he found probably isn&#8217;t the most pressing security or privacy issue Apple is grappling with at the moment. But he said neither is it difficult to fix this particular flaw, which requires additional restrictions on data that AirTag users can enter into the Lost Mode&#8217;s phone number settings.</p>
<p>&#8220;It&#8217;s a pretty easy thing to fix,&#8221; he said. &#8220;Having said that, I imagine they probably want to also figure out how this was missed in the first place.&#8221;</p>
<p>Apple has not responded to requests for comment.</p>
<p><strong>Update, 12:31:</strong> Rauch shared an email showing Apple communicated their intention to fix the bug just hours <em>before</em> &#8212; not after &#8212; KrebsOnSecurity reached out to them for comment. The story above has been changed to reflect that.</p>


feed_id: https://krebsonsecurity.com/?p=57147
title: The Rise of One-Time Password Interception Bots
uri: The-Rise-of-One-Time-Password-Interception-Bots
url: https://krebsonsecurity.com/2021/09/the-rise-of-one-time-password-interception-bots/
content:
<p>In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since launched bot-based services that make it relatively easy for crooks to phish OTPs from targets.</p>
<div id="attachment_57154" style="width: 325px" class="wp-caption alignright"><img aria-describedby="caption-attachment-57154" loading="lazy" class=" wp-image-57154" src="media/3d98dace.snsranger.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/snsranger.png" alt="" width="315" height="383" /><p id="caption-attachment-57154" class="wp-caption-text">An ad for the OTP interception service/bot &#8220;SMSRanger.&#8221;</p></div>
<p>Many websites now require users to supply both a password and a numeric code/OTP token sent via text message, or one generated by mobile apps like <strong>Authy</strong> and <strong>Google Authenticator</strong>. The idea is that even if the user&#8217;s password gets stolen, the attacker still can&#8217;t access the user&#8217;s account without that second factor &#8212; i.e. without access to the victim&#8217;s mobile device or phone number.</p>
<p>The OTP interception service <a href="https://krebsonsecurity.com/2021/02/u-k-arrest-in-sms-bandits-phishing-service/" target="_blank" rel="noopener">featured earlier this year</a> &#8212;<strong> Otp[.]agency</strong> &#8212; advertised a web-based bot designed to trick targets into giving up OTP tokens. The customer would enter a target’s phone number and name, and OTP Agency would initiate an automated phone call that alerts that person about unauthorized activity on their account.</p>
<p>The call would prompt the target to enter an OTP token generated by their phone’s mobile app (&#8220;for authentication purposes&#8221;), and that code would then get relayed back to the bad guy customers&#8217; panel at the OTP Agency website.</p>
<p>OTP Agency <a href="media/43f22ca4.otp-bye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/otp-bye.png" target="_blank" rel="noopener">took itself offline</a> within hours of that story. But according to research from cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, multiple new OTP interception services have emerged to fill that void. And all of them operate via <strong>Telegram</strong>, a cloud-based instant messaging system.</p>
<p>&#8220;Intel 471 has seen an uptick in services on the cybercrime underground that allow attackers to intercept one-time password (OTP) tokens,&#8221; the company wrote in <a href="https://intel471.com/blog/otp-password-bots-telegram" target="_blank" rel="noopener">a blog post today</a>. &#8220;Over the past few months, we’ve seen actors provide access to services that call victims, appear as a legitimate call from a specific bank and deceive victims into typing an OTP or other verification code into a mobile phone in order to capture and deliver the codes to the operator. Some services also target other popular social media platforms or financial services, providing email phishing and SIM swapping capabilities.&#8221;</p>
<p>Intel471 says one new Telegram OTP bot called &#8220;<strong>SMSRanger</strong>&#8221; is popular because it&#8217;s remarkably easy to use, and probably because of the many testimonials posted by customers who seem happy with its frequent rate of success in extracting OTP tokens when the attacker already has the target&#8217;s &#8220;fullz,&#8221; personal information such as Social Security number and date of birth. From their analysis:</p>
<blockquote><p><span style="font-weight: 400;">&#8220;Those who pay for access can use the bot by entering commands similar to how bots are used on popular workforce collaboration tool Slack. A simple slash command allows a user to enable various &#8216;modes&#8217; — scripts aimed as various services — that can target specific banks, as well as PayPal, Apple Pay, Google Pay, or a wireless carrier. </span></p>
<p><span style="font-weight: 400;">Once a target’s phone number has been </span><span style="font-weight: 400;">entered, the bot does the rest of the work, ultimately granting access to whatever account has been targeted. Users claim that SMSRanger has an efficacy rate of about 80% if the victim answered the call and the full information (fullz) the user provided was accurate and updated.&#8221;</span></p></blockquote>
<p>Another OTP interception service called SMS Buster requires a tad more effort from a customer, Intel 471 explains:</p>
<blockquote><p><span style="font-weight: 400;">&#8220;The bot provides options to disguise a call to make it appear as a legitimate contact from a specific bank while letting the attackers choose to dial from any phone number. From there, an attacker could follow a script to trick a victim into providing sensitive details such as an ATM personal identification number (PIN), card verification value (CVV) and OTP, which could then be sent to an individual’s Telegram account. The bot, which was used by attackers targeting Canadian victims, gives users the chance to launch attacks in French and English.&#8221; </span></p></blockquote>
<p><span style="font-weight: 400;">These services are springing up because they work and they&#8217;re profitable. And they&#8217;re profitable because far too many websites and services funnel users toward multi-factor authentication methods that can be intercepted, spoofed, or misdirected &#8212; like SMS-based one-time codes, or even app-generated OTP tokens.</span><span id="more-57147"></span></p>
<p>The idea behind true &#8220;two-factor authentication&#8221; is that the user is required to present two out of three of the following: Something they have (mobile devices); something they know (passwords); or something they are (biometrics). For example, you present your credentials to a website, and the site prompts you to approve the login via a prompt that pops up on your registered mobile device. That is true two-factor authentication: Something you have, and something you know (and maybe also even something you are).</p>
<div id="attachment_57157" style="width: 311px" class="wp-caption alignleft"><img aria-describedby="caption-attachment-57157" loading="lazy" class="wp-image-57157" src="media/b6dbd037.smsbuster.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/smsbuster.png" alt="" width="301" height="590" /><p id="caption-attachment-57157" class="wp-caption-text">The 2fa SMS Buster bot on Telegram. Image: Intel 471.</p></div>
<p>In addition, these so-called &#8220;push notification&#8221; methods include important time-based contexts that add security: They happen directly after the user submits their credentials; and the opportunity to approve the push notification expires after a short period.</p>
<p>But in so many instances, what sites request is basically two things you know (a password and a one-time code) to be submitted through the same channel (a web browser). This is usually still better than no multi-factor authentication at all, but as these services show there are now plenty of options of circumventing this protection.</p>
<p>I hope these OTP interception services make clear that you should never provide any information in response to an unsolicited phone call. It doesn&#8217;t matter who claims to be calling: If you didn&#8217;t initiate the contact, hang up. Don&#8217;t put them on hold while you call your bank; <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">the scammers can get around that, too</a>. Just hang up. Then you can call your bank or whoever else you need.</p>
<p>Unfortunately, those most likely to fall for these OTP interception schemes are people who are less experienced with technology. If you&#8217;re the resident or family IT geek and have the ability to update or improve the multi-factor authentication profiles for your less tech-savvy friends and loved ones, that would be a fabulous way to show you care &#8212; and to help them head off a potential disaster at the hands of one of these bot services.</p>
<p>When was the last time you reviewed your multi-factor settings and options at the various websites entrusted with your most precious personal and financial information? It might be worth paying a visit to <a href="https://2fa.directory" target="_blank" rel="noopener">2fa.directory</a> (formerly twofactorauth[.]org) for a checkup.</p>


feed_id: https://krebsonsecurity.com/?p=57174
title: FCC Proposal Targets SIM Swapping, Port-Out Fraud
uri: FCC-Proposal-Targets-SIM-Swapping-Port-Out-Fraud
url: https://krebsonsecurity.com/2021/10/fcc-proposal-targets-sim-swapping-port-out-fraud/
content:
<p>The <strong>U.S. Federal Communications Commission</strong> (FCC) is asking for feedback on new proposed rules to crack down on <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">SIM swapping</a> and number port-out fraud, increasingly prevalent scams in which identity thieves hijack a target&#8217;s mobile phone number and use that to wrest control over the victim&#8217;s online identity.</p>
<p><img loading="lazy" class="aligncenter  wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="765" height="482" /></p>
<p>In a long-overdue <a href="https://www.fcc.gov/document/fcc-combating-scams-used-commandeer-consumers-cell-phone-accounts" target="_blank" rel="noopener">notice issued Sept. 30</a>, the FCC said it plans to move quickly on requiring the mobile companies to adopt more secure methods of authenticating customers before redirecting their phone number to a new device or carrier.</p>
<p>&#8220;We have received numerous complaints from consumers who have suffered significant distress, inconvenience, and financial harm as a result of <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">SIM swapping</a> and port-out fraud,&#8221; the FCC wrote. &#8220;Because of the serious harms associated with SIM swap fraud, we believe that a speedy implementation is appropriate.&#8221;</p>
<p>The FCC said the proposal was in response to a flood of complaints to the agency and the <strong>U.S. Federal Trade Commission</strong> (FTC) about fraudulent SIM swapping and <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">number port-out fraud</a>. SIM swapping happens when the fraudsters trick or bribe an employee at a mobile phone store into transferring control of a target’s phone number to a device they control.</p>
<p>From there, the attackers can reset the password for almost any online account tied to that mobile number, because most online services still allow people to reset their passwords simply by clicking a link sent via SMS to the phone number on file.</p>
<p>Scammers commit number port-out fraud by posing as the target and requesting that their number be transferred to a different mobile provider (and to a device the attackers control).</p>
<p>The FCC said the carriers have traditionally sought to address both forms of phone number fraud by requiring static data about the customer that is no longer secret and has been exposed in a variety of places already &#8212; such as date of birth and Social Security number. By way of example, the commission pointed to <a href="https://krebsonsecurity.com/2021/08/t-mobile-breach-exposed-ssn-dob-of-40m-people/" target="_blank" rel="noopener">the recent breach at T-Mobile that exposed this data on 40 million current, past and prospective customers</a>.</p>
<p>What&#8217;s more, victims of SIM swapping and number port-out fraud are often the last to know about their victimization. The FCC said it plans to prohibit wireless carriers from allowing a SIM swap unless the carrier uses a secure method of authenticating its customer. Specifically, the commission proposes that carriers be required to verify a &#8220;pre-established password&#8221; with customers before making any changes to their accounts.</p>
<p>According to the FCC, several examples of pre-established passwords include:</p>
<p>-a one-time passcode sent via text message to the account phone number or a pre-registered backup number<br />
-a one-time passcode sent via email to the email address associated with the account<br />
-a passcode sent using a voice call to the account phone number or pre-registered back-up telephone number.</p>
<p>The commission said it was also considering updating its rules to require wireless carriers to develop procedures for responding to failed authentication attempts and to notify customers immediately of any requests for SIM changes.<span id="more-57174"></span></p>
<p>Additionally, the FCC said it may impose additional customer service, training, and transparency requirements for the carriers, noting that too many customer service personnel at the wireless carriers lack training on how to assist customers who&#8217;ve had their phone numbers stolen.</p>
<p>The FCC said some of the consumer complaints it has received &#8220;describe wireless carrier customer service representatives and store employees who do not know how to address instances of fraudulent SIM swaps or port-outs, resulting in customers spending many hours on the phone and at retail stores trying to get resolution. Other consumers complain that their wireless carriers have refused to provide them with documentation related to the fraudulent SIM swaps, making it difficult for them to pursue claims with their financial institutions or law enforcement.&#8221;</p>
<p><img loading="lazy" class="aligncenter  wp-image-40415" src="media/618d5447.phonefraudsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="768" height="388" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 768px) 100vw, 768px" /></p>
<p>&#8220;Several consumer complaints filed with the Commission allege that the wireless carrier’s store employees are involved in the fraud, or that carriers completed SIM swaps despite the customer having previously set a PIN or password on the account,&#8221; the commission continued.</p>
<p>Allison Nixon, an expert on SIM swapping attacks chief research officer with New York City-based cyber intelligence firm <a href="https://unit221b.com" target="_blank" rel="noopener">Unit221B</a>, said any new authentication requirements will have to balance the legitimate use cases for customers requesting a new SIM card when their device is lost or stolen. A SIM card is the small, removable smart card that associates a mobile device to its carrier and phone number.</p>
<p>&#8220;Ultimately, any sort of static defense is only going to work in the short term,&#8221; Nixon said. &#8220;The use of SMS as a 2nd factor in itself is a static defense. And the criminals adapted and made the problem actually worse than the original problem it was designed to solve. The long term solution is that the system needs to be responsive to novel fraud schemes and adapt to it faster than the speed of legislation.&#8221;</p>
<p>Eager to weigh in on the FCC&#8217;s proposal? They want to hear from you. The electronic comment filing system is <a href="https://www.fcc.gov/ecfs/" target="_blank" rel="noopener">here</a>, and the docket number for this proceeding is WC Docket No. 21-341.</p>


feed_id: https://krebsonsecurity.com/?p=57196
title: What Happened to Facebook, Instagram, & WhatsApp?
uri: What-Happened-to-Facebook-Instagram-WhatsApp
url: https://krebsonsecurity.com/2021/10/what-happened-to-facebook-instagram-whatsapp/
content:
<p><strong>Facebook</strong> and its sister properties <strong>Instagram</strong> and <strong>WhatsApp</strong> are suffering from ongoing, global outages. We don&#8217;t yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to find these destinations online.</p>
<div id="attachment_57197" style="width: 773px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57197" loading="lazy" class=" wp-image-57197" src="media/48cf317e.kentik-fb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/kentik-fb.png" alt="" width="763" height="441" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/kentik-fb.png 1079w, https://krebsonsecurity.com/wp-content/uploads/2021/10/kentik-fb-768x444.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/kentik-fb-782x452.png 782w" sizes="(max-width: 763px) 100vw, 763px" /><p id="caption-attachment-57197" class="wp-caption-text">Kentik&#8217;s view of the Facebook, Instagram and WhatsApp outage.</p></div>
<p><strong>Doug Madory</strong> is director of internet analysis at <strong>Kentik</strong>, a San Francisco-based network monitoring company. Madory said at approximately 11:39 a.m. ET today (15:39 UTC), someone at Facebook caused an update to be made to the company&#8217;s Border Gateway Protocol (BGP) records. BGP is a mechanism by which Internet service providers of the world share information about which providers are responsible for routing Internet traffic to which specific groups of Internet addresses.</p>
<p>In simpler terms, sometime this morning Facebook took away the map telling the world&#8217;s computers how to find its various online properties. As a result, when one types Facebook.com into a web browser, the browser has no idea where to find Facebook.com, and so returns an error page.</p>
<p><img loading="lazy" class="aligncenter  wp-image-57200" src="media/5a8ad0c9.facebook404.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/facebook404.png" alt="" width="760" height="408" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/facebook404.png 984w, https://krebsonsecurity.com/wp-content/uploads/2021/10/facebook404-768x413.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/facebook404-782x420.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/10/facebook404-370x200.png 370w" sizes="(max-width: 760px) 100vw, 760px" /></p>
<p>In addition to stranding billions of users, the Facebook outage also has stranded its employees from communicating with one another using their internal Facebook tools. That&#8217;s because Facebook&#8217;s email and tools are all managed in house and via the same domains that are now stranded.</p>
<p>&#8220;Not only are Facebook&#8217;s services and apps down for the public, its internal tools and communications platforms, including Workplace, are out as well,&#8221; New York Times tech reporter <strong>Ryan Mac</strong> <a href="https://twitter.com/RMac18/status/1445069187664293895" target="_blank" rel="noopener">tweeted</a>. &#8220;No one can do any work. Several people I&#8217;ve talked to said this is the equivalent of a &#8216;snow day&#8217; at the company.&#8221;</p>
<p>The mass outage comes just hours after <strong>CBS&#8217;s 60 Minutes</strong> aired <a href="https://www.cbsnews.com/news/facebook-whistleblower-frances-haugen-misinformation-public-60-minutes-2021-10-03/" target="_blank" rel="noopener">a much-anticipated interview</a> with <strong>Frances Haugen</strong>, the Facebook whistleblower who recently leaked a number of internal Facebook investigations showing the company knew its products were causing mass harm, and that it prioritized profits over taking bolder steps to curtail abuse on its platform &#8212; including disinformation and hate speech.</p>
<p>We don&#8217;t know how or why the outages persist at Facebook and its other properties, but the changes had to have come from inside the company, as Facebook manages those records internally. Whether the changes were made maliciously or by accident is anyone&#8217;s guess at this point.</p>
<p>Madory said it could be that someone at Facebook just screwed up.</p>
<p>&#8220;In the past year or so, we&#8217;ve seen a lot of these big outages where they had some sort of update to their global network configuration that went awry,&#8221; Madory said. &#8220;We obviously can&#8217;t rule out someone hacking them, but they also could have done this to themselves.&#8221;</p>
<p>In the meantime, several different domain registration companies listed the domain Facebook.com as up for sale. There&#8217;s no reason to believe this domain will actually be sold as a result, but it&#8217;s fun to consider how many billions of dollars this domain could fetch on the open market.</p>
<p><img loading="lazy" class="aligncenter  wp-image-57201" src="media/568acb3b.fbforsale2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/fbforsale2.png" alt="" width="770" height="536" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/fbforsale2.png 1260w, https://krebsonsecurity.com/wp-content/uploads/2021/10/fbforsale2-768x535.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/fbforsale2-782x544.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/10/fbforsale2-100x70.png 100w" sizes="(max-width: 770px) 100vw, 770px" /></p>
<p>This is a developing story and will likely be updated throughout the day.</p>


feed_id: https://krebsonsecurity.com/?p=57264
title: Patch Tuesday, October 2021 Edition
uri: Patch-Tuesday-October-2021-Edition
url: https://krebsonsecurity.com/2021/10/patch-tuesday-october-2021-edition/
content:
<p><strong>Microsoft </strong>today issued updates to plug more than 70 security holes in its <strong>Windows </strong>operating systems and other software, including one vulnerability that is already being exploited. This month&#8217;s Patch Tuesday also includes security fixes for the newly released <strong>Windows 11</strong> operating system. Separately, <strong>Apple</strong> has released updates for <strong>iOS</strong> and <strong>iPadOS</strong> to address a flaw that is being actively attacked.</p>
<p><img loading="lazy" class="aligncenter wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="767" height="563" /></p>
<p>Firstly, Apple has released iOS 15.0.2 and iPadOS 15.0.2 to fix a zero-day vulnerability (CVE-2021-30883) that is being leveraged in active attacks targeting iPhone and iPad users. <strong>Lawrence Abrams</strong> of <em>Bleeping Computer</em> <a href="https://www.bleepingcomputer.com/news/security/emergency-apple-ios-1502-update-fixes-zero-day-used-in-attacks/" target="_blank" rel="noopener">writes</a> that the flaw could be used to steal data or install malware, and that soon after Apple patched the bug security researcher <a tabindex="-1" href="https://twitter.com/AmarSaar" target="_blank" rel="noopener noreferrer" data-remove-tab-index="true" data-sk="tooltip_parent" data-stringify-link="https://twitter.com/AmarSaar" data-ss1634067405="1">Saar Amar</a> published a <a tabindex="-1" href="https://saaramar.github.io/IOMFB_integer_overflow_poc/" target="_blank" rel="noopener noreferrer" data-remove-tab-index="true" data-sk="tooltip_parent" data-stringify-link="https://saaramar.github.io/IOMFB_integer_overflow_poc/" data-ss1634067405="1">technical writeup and proof-of-concept exploit</a> that was derived from reverse engineering Apple&#8217;s patch.</p>
<p>Abrams said the list of impacted Apple devices is quite extensive, affecting older and newer models. If you own an iPad or iPhone &#8212; or any other Apple device &#8212; please <a href="https://support.apple.com/en-ca/HT204204" target="_blank" rel="noopener">make sure it&#8217;s up to date with the latest security patches</a>.</p>
<p>Three of the weaknesses Microsoft addressed today tackle vulnerabilities rated &#8220;<strong>critical</strong>,&#8221; meaning that malware or miscreants could exploit them to gain complete, remote control over vulnerable systems &#8212; with little or no help from targets.</p>
<p>One of the critical bugs concerns <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40486" target="_blank" rel="noopener">Microsoft Word</a>, and two others are remote code execution flaws in <strong>Windows Hyper-V</strong>, the virtualization component built into Windows. <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38672" target="_blank" rel="noopener">CVE-2021-38672</a> affects Windows 11 and Windows Server 2022; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40461" target="_blank" rel="noopener">CVE-2021-40461</a> impacts both Windows 11 and Windows 10 systems, as well as Server versions.</p>
<p>But as usual, some of the more concerning security weaknesses addressed this month earned Microsoft&#8217;s slightly less dire &#8220;<strong>important</strong>&#8221; designation, which applies to a vulnerability &#8220;whose exploitation could result in compromise of the confidentiality, integrity, or availability of user data, or of the integrity or availability of processing resources.&#8221;</p>
<p>The flaw that&#8217;s under active assault &#8212; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-40449" target="_blank" rel="noopener">CVE-2021-40449</a> &#8212; is an important &#8220;<strong>elevation of privilege</strong>&#8221; vulnerability, meaning it can be leveraged in combination with another vulnerability to let attackers run code of their choice as administrator on a vulnerable system.</p>
<p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36970" target="_blank" rel="noopener">CVE-2021-36970</a> is an important spoofing vulnerability in Microsoft’s Windows Print Spooler. The flaw was discovered by the same researchers credited with the discovery of one of two vulnerabilities that became known as <strong>PrintNightmare</strong> &#8212; the widespread exploitation of a critical Print Spooler flaw that forced Microsoft <a href="https://krebsonsecurity.com/2021/07/microsoft-issues-emergency-patch-for-windows-flaw/" target="_blank" rel="noopener">to issue an emergency security update back in July</a>. Microsoft assesses CVE-2021-36970 as &#8220;exploitation more likely.&#8221;</p>
<p>&#8220;While no details have been shared publicly about the flaw, this is definitely one to watch for, as we saw a constant stream of Print Spooler-related vulnerabilities patched over the summer while ransomware groups began incorporating PrintNightmare into their affiliate playbook,&#8221; said <strong>Satnam Narang</strong>, staff research engineer at <strong>Tenable</strong>. &#8220;We strongly encourage organizations to apply these patches as soon as possible.&#8221;<span id="more-57264"></span></p>
<p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-26427" target="_blank" rel="noopener">CVE-2021-26427</a> is another important bug in <strong>Microsoft Exchange Server</strong>, which has been under siege lately from attackers. In March, threat actors pounced on four separate zero-day flaws in Exchange that allowed them to <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">siphon email from and install backdoors at hundreds of thousands of organizations</a>.</p>
<p>This month&#8217;s Exchange bug earned a CVSS score of 9.0 (10 is the most dangerous). <strong>Kevin Breen</strong> of I<strong>mmersive Labs</strong> points out that Microsoft has marked this flaw as less likely to be exploited, probably because an attacker would already need access to your network before using the vulnerability.</p>
<p>&#8220;Email servers will always be prime targets, simply due to the amount of data contained in emails and the range of possible ways attackers could use them for malicious purposes. While it’s not right at the top of my list of priorities to patch, it’s certainly one to be wary of.&#8221;</p>
<p>Also today, Adobe issued security updates for a range of products, including <a href="https://helpx.adobe.com/security/products/acrobat/apsb21-104.html" target="_blank" rel="noopener">Adobe Reader and Acrobat</a>, <strong>Adobe Commerce</strong>, and <strong>Adobe Connect</strong>.</p>
<p>For a complete rundown of all patches released today and indexed by severity, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+October+2021+Patch+Tuesday/27928/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>, and <a href="https://patchtuesdaydashboard.com/" target="_blank" rel="noopener">the Patch Tuesday data</a> put together by <strong>Morphus Labs</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/2021/defcon-2-august-updates-include-print-spooler-fixes/" target="_blank" rel="noopener">AskWoody.com</a> frequently has the lowdown on any patches that are causing problems for Windows users.</p>
<p>On that note, before you update <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.</p>


feed_id: https://krebsonsecurity.com/?p=57245
title: How Coinbase Phishers Steal One-Time Passwords
uri: How-Coinbase-Phishers-Steal-One-Time-Passwords
url: https://krebsonsecurity.com/2021/10/how-coinbase-phishers-steal-one-time-passwords/
content:
<p>A recent phishing campaign targeting <strong>Coinbase</strong> users shows thieves are getting cleverer about phishing one-time passwords (OTPs) needed to complete the login process. It also shows that phishers are attempting to sign up for new Coinbase accounts by the millions as part of an effort to identify email addresses that are already associated with active accounts.</p>
<div id="attachment_57249" style="width: 781px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57249" loading="lazy" class=" wp-image-57249" src="media/5ac24338.cbphish-reset.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/cbphish-reset.png" alt="" width="771" height="348" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/cbphish-reset.png 1230w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cbphish-reset-768x346.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cbphish-reset-782x352.png 782w" sizes="(max-width: 771px) 100vw, 771px" /><p id="caption-attachment-57249" class="wp-caption-text">A Google-translated version of the now-defunct Coinbase phishing site, coinbase.com.password-reset[.]com</p></div>
<p>Coinbase is the world&#8217;s second-largest cryptocurrency exchange, with roughly 68 million users from over 100 countries. The now-defunct phishing domain at issue &#8212; <strong>coinbase.com.password-reset[.]com</strong> &#8212; was targeting Italian Coinbase users (the site&#8217;s default language was Italian). And it was fairly successful, according to <strong>Alex Holden</strong>, founder of Milwaukee-based cybersecurity firm <a href="http://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>.</p>
<p>Holden&#8217;s team managed to peer inside some poorly hidden file directories associated with that phishing site, including its administration page. That panel, pictured in the redacted screenshot below, indicated the phishing attacks netted at least 870 sets of credentials before the site was taken offline.</p>
<div id="attachment_57248" style="width: 781px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57248" loading="lazy" class=" wp-image-57248" src="media/b41e6e2b.cbphish-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/cbphish-red.png" alt="" width="771" height="519" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/cbphish-red.png 1229w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cbphish-red-768x517.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cbphish-red-782x526.png 782w" sizes="(max-width: 771px) 100vw, 771px" /><p id="caption-attachment-57248" class="wp-caption-text">The Coinbase phishing panel.</p></div>
<p>Holden said each time a new victim submitted credentials at the Coinbase phishing site, the administrative panel would make a loud &#8220;ding&#8221; &#8212; presumably to alert whoever was at the keyboard on the other end of this phishing scam that they had a live one on the hook.</p>
<p>In each case, the phishers manually would push a button that caused the phishing site to ask visitors for more information, such as the one-time password from their mobile app.</p>
<p><img loading="lazy" class="aligncenter wp-image-57251" src="media/cb330cb2.cb-6digit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/cb-6digit.png" alt="" width="769" height="406" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/cb-6digit.png 1314w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cb-6digit-768x406.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cb-6digit-782x413.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cb-6digit-267x140.png 267w" sizes="(max-width: 769px) 100vw, 769px" /></p>
<p>&#8220;These guys have real-time capabilities of soliciting any input from the victim they need to get into their Coinbase account,&#8221; Holden said.</p>
<p>Pressing the &#8220;Send Info&#8221; button prompted visitors to supply additional personal information, including their name, date of birth, and street address. Armed with the target&#8217;s mobile number, they could also click &#8220;Send verification SMS&#8221; with a text message prompting them to text back a one-time code.</p>
<p><img loading="lazy" class="aligncenter wp-image-57250" src="media/65b23050.cbconfirmid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/cbconfirmid.png" alt="" width="768" height="479" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/cbconfirmid.png 1282w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cbconfirmid-768x479.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/cbconfirmid-782x487.png 782w" sizes="(max-width: 768px) 100vw, 768px" /></p>
<h2>SIFTING COINBASE FOR ACTIVE USERS</h2>
<p>Holden said the phishing group appears to have identified Italian Coinbase users by attempting to sign up new accounts under the email addresses of more than 2.5 million Italians. His team also managed to recover the username and password data that victims submitted to the site, and virtually all of the submitted email addresses ended in &#8220;.it&#8221;.</p>
<p>But the phishers in this case likely weren&#8217;t interested in registering any accounts. Rather, the bad guys understood that any attempts to sign up using an email address tied to an existing Coinbase account would fail. After doing that several million times, the phishers would then take the email addresses that failed new account signups and target them with Coinbase-themed phishing emails.</p>
<p>Holden&#8217;s data shows this phishing gang conducted hundreds of thousands of halfhearted account signup attempts daily. For example, on Oct. 10 the scammers checked more than 216,000 email addresses against Coinbase&#8217;s systems. The following day, they attempted to register 174,000 new Coinbase accounts.<span id="more-57245"></span></p>
<p>In an emailed statement shared with KrebsOnSecurity, Coinbase said it takes &#8220;extensive security measures to ensure our platform and customer accounts remain as safe as possible.&#8221; Here&#8217;s the rest of their statement:</p>
<blockquote><p>&#8220;Like all major online platforms, Coinbase sees attempted automated attacks performed on a regular basis. Coinbase is able to automatically neutralize the overwhelming majority of these attacks, using a mixture of in-house machine learning models and partnerships with industry-leading bot detection and abuse prevention vendors. We continuously tune these models to block new techniques as we discover them. Coinbase&#8217;s Threat Intelligence and Trust &amp; Safety teams also work to monitor new automated abuse techniques, develop and apply mitigations, and aggressively pursue takedowns against malicious infrastructure. We recognize that attackers (and attack techniques) will continue to evolve, which is why we take a multi-layered approach to combating automated abuse.&#8221;</p></blockquote>
<p>Last month, Coinbase <a href="https://blog.coinbase.com/phishing-attacks-are-on-the-rise-here-are-some-steps-you-can-take-to-protect-yourself-872833c7671b?gi=72d42505c9fd" target="_blank" rel="noopener">disclosed</a> that malicious hackers stole cryptocurrency from 6,000 customers after using a vulnerability to bypass the company&#8217;s SMS multi-factor authentication security feature.</p>
<p>&#8220;To conduct the attack, Coinbase says the attackers needed to know the customer&#8217;s email address, password, and phone number associated with their Coinbase account and have access to the victim&#8217;s email account,&#8221; Bleeping Computer&#8217;s <strong>Lawrence Abrams</strong> <a href="https://www.bleepingcomputer.com/news/security/hackers-rob-thousands-of-coinbase-customers-using-mfa-flaw/" target="_blank" rel="noopener">wrote</a>. &#8220;While it is unknown how the threat actors gained access to this information, Coinbase believes it was through phishing campaigns targeting Coinbase customers to steal account credentials, which have become common.&#8221;</p>
<p>This phishing scheme is another example of how crooks are coming up with increasingly ingenious methods for circumventing popular multi-factor authentication options, such as one-time passwords. Last month, KrebsOnSecurity <a href="https://krebsonsecurity.com/2021/09/the-rise-of-one-time-password-interception-bots/" target="_blank" rel="noopener">highlighted research</a> into several new services based on Telegram-based bots that make it relatively easy for crooks to phish OTPs from targets using automated phone calls and text messages.These OTP phishing services all assume the customer already has the target&#8217;s login credentials through some means &#8212; such as through a phishing site like the one examined in this story.</p>
<p>Savvy readers here no doubt already know this, but to find the true domain referenced in a link, look to the right of “http(s)://” until you encounter the first slash (/). The domain directly to the left of that first slash is the true destination; anything that precedes the second dot to the left of that first slash is a subdomain and should be ignored for the purposes of determining the true domain name.</p>
<p>In the phishing domain at issue here &#8212; <strong>coinbase.com.password-reset[.]com </strong>&#8212; password-reset[.]com is the destination domain, and the &#8220;coinbase.com&#8221; is just an arbitrary subdomain of password-reset[.]com. However, when viewed in a mobile device, many visitors to such a domain may only see the subdomain portion of the URL in their mobile browser&#8217;s address bar.</p>
<p>The best advice to sidestep phishing scams is to avoid clicking on links that arrive unbidden in emails, text messages or other media. Most phishing scams invoke a temporal element that warns of dire consequences should you fail to respond or act quickly. If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>
<p>Also, never provide any information in response to an unsolicited phone call. It doesn’t matter who claims to be calling: If you didn’t initiate the contact, hang up. Don’t put them on hold while you call your bank; <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">the scammers can get around that, too</a>. Just hang up. Then you can call your bank or wherever else you need.</p>
<p>By the way, when was the last time you reviewed your multi-factor settings and options at the various websites entrusted with your most precious personal and financial information? It might be worth paying a visit to <a href="https://2fa.directory/" target="_blank" rel="noopener">2fa.directory</a> (formerly twofactorauth[.]org) for a checkup.</p>


feed_id: https://krebsonsecurity.com/?p=57293
title: Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability
uri: Missouri-Governor-Vows-to-Prosecute-St-Louis-Post-Dispatch-for-Report
url:
https://krebsonsecurity.com/2021/10/missouri-governor-vows-to-prosecute-st-louis-post-dispatch-for-reporting-security-vulnerability/

content:
<p>On Wednesday, the<em> St. Louis Post-Dispatch </em>ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, <strong>Missouri Gov. Mike Parson</strong> (R) said fixing the flaw could cost the state $50 million, and vowed his administration would seek to prosecute and investigate the &#8220;hackers&#8221; and anyone who aided the publication in its &#8220;attempt to embarrass the state and sell headlines for their news outlet.&#8221;</p>
<div id="attachment_57297" style="width: 742px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57297" loading="lazy" class=" wp-image-57297" src="media/f2f8b85a.parson.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/parson.png" alt="" width="732" height="403" /><p id="caption-attachment-57297" class="wp-caption-text">Missouri Gov. Mike Parson (R), vowing to prosecute the St. Louis Post-Dispatch for reporting a security vulnerability that exposed teacher SSNs.</p></div>
<p>The Post-Dispatch <a href="https://www.stltoday.com/news/local/education/missouri-teachers-social-security-numbers-at-risk-on-state-agencys-website/article_f3339700-ece0-54a1-9a45-f300321b7c82.html" target="_blank" rel="noopener">says it discovered the vulnerability</a> in a web application that allowed the public to search teacher certifications and credentials, and that more than 100,000 SSNs were available. The Missouri state <strong>Department of Elementary and Secondary Education</strong> (DESE) reportedly removed the affected pages from its website Tuesday after being notified of the problem by the publication (before the story on the flaw was published).</p>
<p>The newspaper said it found that teachers’ Social Security numbers were contained in the HTML source code of the pages involved. In other words, the information was available to anyone with a web browser who happened to also examine the site&#8217;s public code using Developer Tools or simply right-clicking on the page and viewing the source code.</p>
<p>The Post-Dispatch reported that it wasn’t immediately clear how long the Social Security numbers and other sensitive information had been vulnerable on the DESE website, nor was it known if anyone had exploited the flaw.</p>
<p>But in <a href="https://www.facebook.com/GovMikeParson/posts/423299439166539?__cft__[0]=AZXNI01wklrX2Oe-kp7o9pO2cBw3Q41HUh5-OvJQXcZIx4VnxVQqqwUf83qHu0QDdqjHgTOSnafkQszwbzL_K6iRLkzPQjNlxejwqndYMo6NIQj8r6XjA1vbHurTL8r_LEP0laetGnY23IXyCJQHLJE1&amp;__tn__=%2CO%2CP-R" target="_blank" rel="noopener">a press conference Thursday morning</a>, Gov. Parson said he would seek to prosecute and investigate the reporter and the region&#8217;s largest newspaper for &#8220;unlawfully&#8221; accessing teacher data.</p>
<p>&#8220;This administration is standing up against any and all perpetrators who attempt to steal personal information and harm Missourians,&#8221; Parson said. &#8220;It is unlawful to access encoded data and systems in order to examine other peoples&#8217; personal information. We are coordinating state resources to respond and utilize all legal methods available. My administration has notified the Cole County prosecutor of this matter, the Missouri State Highway Patrol&#8217;s Digital Forensics Unit will also be conducting an investigation of all of those involved. This incident alone may cost Missouri taxpayers as much as $50 million.&#8221;</p>
<p>While threatening to prosecute the reporters to the fullest extent of the law, Parson sought to downplay the severity of the security weakness, saying the reporter only unmasked three Social Security numbers, and that &#8220;there was no option to decode Social Security numbers for all educators in the system all at once.&#8221;</p>
<p>&#8220;The state is committed to bringing to justice anyone who hacked our systems or anyone who aided them to do so,&#8221; Parson continued. &#8220;A hacker is someone who gains unauthorized access to information or content. This individual did not have permission to do what they did. They had no authorization to convert or decode, so this was clearly a hack.&#8221;<span id="more-57293"></span></p>
<p><span class="pullquote pqright">Parson said the person who reported the weakness was &#8220;acting against a state agency to compromise teachers&#8217; personal information in an attempt to embarrass the state and sell headlines for their news outlet.&#8221;</span></p>
<p>&#8220;We will not let this crime against Missouri teachers go unpunished, and refuse to let them be a pawn in the news outlet&#8217;s political vendetta,&#8221; Parson said. &#8220;Not only are we going to hold this individual accountable, but we will also be holding accountable all those who aided this individual and the media corporation that employs them.&#8221;</p>
<p>In a statement shared with KrebsOnSecurity, an attorney for the St. Louis Post-Dispatch said the reporter did the responsible thing by reporting his findings to the DESE so that the state could act to prevent disclosure and misuse.</p>
<p>&#8220;A hacker is someone who subverts computer security with malicious or criminal intent,&#8221; the attorney Joe Martineau said. &#8220;Here, there was no breach of any firewall or security and certainly no malicious intent. For DESE to deflect its failures by referring to this as &#8216;hacking&#8217; is unfounded. Thankfully, these failures were discovered.&#8221;</p>
<p>Aaron Mackey is a senior staff attorney at the <a href="https://www.eff.org" target="_blank" rel="noopener">Electronic Frontier Foundation</a> (EFF), a non-profit digital rights group based in San Francisco. Mackey called the governor&#8217;s response &#8220;vindictive, retaliatory, and incredibly short-sighted.&#8221;</p>
<p>Mackey noted that Post-Dispatch did everything right, even holding its story until the state had fixed the vulnerability. He said the governor also is attacking the media &#8212; which serves a crucial role in helping give voice (and often anonymity) to security researchers who might otherwise remain silent under the threat of potential criminal prosecution for reporting their findings directly to the vulnerable organization.</p>
<p>&#8220;It&#8217;s dangerous and wrong to go after someone who behaved ethically and responsibly in the disclosure sense, but also in the journalistic sense,&#8221; he said. &#8220;The public had a right to know about their government&#8217;s own negligence in building secure systems and addressing well-known vulnerabilities.&#8221;</p>
<p>Mackey said Gov. Parson&#8217;s response to this incident also is unfortunate because it will almost certainly give pause to anyone who might otherwise find and report security vulnerabilities in state websites that unnecessarily expose sensitive information or access. Which also means such weaknesses are more likely to be eventually found and exploited by actual criminals.</p>
<p>&#8220;To characterize this as a hack is just wrong on the technical side, when it was the state agency&#8217;s own system pulling that SSN data and making it publicly available on their site,&#8221; Mackey said. &#8220;And then to react in this way where you don&#8217;t say &#8216;thank you&#8217; but actually turn on the reporter and researchers and go after them&#8230;it&#8217;s just weird.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=57318
title: Conti Ransom Gang Starts Selling Access to Victims
uri: Conti-Ransom-Gang-Starts-Selling-Access-to-Victims
url: https://krebsonsecurity.com/2021/10/conti-ransom-gang-starts-selling-access-to-victims/
content:
<p>The <strong>Conti</strong> ransomware affiliate program appears to have altered its business plan recently. Organizations infected with Conti&#8217;s malware who refuse to negotiate a ransom payment are added to Conti&#8217;s victim shaming blog, where confidential files stolen from victims may be published or sold. But sometime over the past 48 hours, the cybercriminal syndicate updated its victim shaming blog to indicate that it is now selling access to many of the organizations it has hacked.</p>
<div id="attachment_57321" style="width: 791px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57321" loading="lazy" class=" wp-image-57321" src="media/188a4624.continews.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/continews.png" alt="" width="781" height="462" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/continews.png 1100w, https://krebsonsecurity.com/wp-content/uploads/2021/10/continews-768x455.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/continews-782x463.png 782w" sizes="(max-width: 781px) 100vw, 781px" /><p id="caption-attachment-57321" class="wp-caption-text">A redacted screenshot of the Conti News victim shaming blog.</p></div>
<p>&#8220;We are looking for a buyer to access the network of this organization and sell data from their network,&#8221; reads the confusingly worded message inserted into multiple recent victim listings on Conti&#8217;s shaming blog.</p>
<p>It&#8217;s unclear what prompted the changes, or what Conti hopes to gain from the move. It&#8217;s also not obvious why they would advertise having hacked into companies if they plan on selling that access to extract sensitive data going forward. Conti did not respond to requests for comment.</p>
<p>&#8220;I wonder if they are about to close down their operation and want to sell data or access from an in-progress breach before they do,&#8221; said <strong>Fabian Wosar</strong>, chief technology officer at computer security firm <strong>Emsisoft</strong>. &#8220;But it&#8217;s somewhat stupid to do it that way as you will alert the companies that they have a breach going on.&#8221;</p>
<p>The unexplained shift comes as policymakers in the United States and Europe are moving forward on efforts to disrupt some of the top ransomware gangs. <em>Reuters</em> recently <a href="https://www.reuters.com/technology/exclusive-governments-turn-tables-ransomware-gang-revil-by-pushing-it-offline-2021-10-21/" target="_blank" rel="noopener">reported</a> that the U.S. government was behind an ongoing hacking operation that penetrated the computer systems of <a href="https://krebsonsecurity.com/?s=REvil" target="_blank" rel="noopener">REvil</a>, a ransomware affiliate group that experts say is about as aggressive and ruthless as Conti in dealing with victims. What&#8217;s more, REvil was among the first ransomware groups to start selling its victims&#8217; data.</p>
<p>REvil&#8217;s darknet victim shaming site remains offline. In response, a representative for the Conti gang posted a long screed on Oct. 22 to a Russian language hacking forum denouncing the attack on REvil as the &#8220;unilateral, extraterritorial, and bandit-mugging behavior of the United States in world affairs.&#8221;<span id="more-57318"></span></p>
<p>&#8220;Is there a law, even an American one, even a local one in any county of any of the 50 states, that legitimize such indiscriminate offensive action?&#8221; reads the Conti diatribe. &#8220;Is server hacking suddenly legal in the United States or in any of the US jurisdictions? Suppose there is such an outrageous law that allows you to hack servers in a foreign country. How legal is this from the point of view of the country whose servers were attacked? Infrastructure is not flying there in space or floating in neutral waters. It is a part of someone&#8217;s sovereignty.&#8221;</p>
<p>Conti&#8217;s apparent new direction may be little more than another ploy to bring victim companies to the negotiating table, as in &#8220;pay up or someone will pay for your data or long-term misery if you don&#8217;t.&#8221;</p>
<p>Or maybe something just got lost in the translation from Russian (Conti&#8217;s blog is published in English). But by shifting from the deployment of ransomware malware toward the sale of stolen data and network access, Conti could be aligning its operations with many competing ransomware affiliate programs that have recently focused on extorting companies <a href="https://krebsonsecurity.com/2020/11/why-paying-to-delete-stolen-data-is-bonkers/" target="_blank" rel="noopener">in exchange for a promise not to publish or sell stolen data</a>.</p>
<p>However, as <strong>Digital Shadows</strong> points out in <a href="https://www.digitalshadows.com/blog-and-research/ransomware-q3-2021-roll-up/" target="_blank" rel="noopener">a recent ransomware roundup</a>, many ransomware groups are finding it difficult to manage data-leak sites, or hosting stolen data on the dark web for download.</p>
<p>After all, when it takes weeks to download one victim&#8217;s data via Tor &#8212; if indeed the download succeeds at all &#8212; the threat of leaking sensitive data as a negotiation tactic loses some of its menace. It&#8217;s also a crappy user experience. This has resulted in some ransomware groups exposing data using public file-sharing websites, which are faster and more reliable but can be taken down through legal means quite quickly.</p>
<p>Data leak sites also can offer investigators a potential way to infiltrate ransomware gangs, as evidenced by the recent reported compromise of the REvil gang by U.S. authorities.</p>
<p>&#8220;On 17 Oct 2021, a representative of the REvil ransomware gang took it to a Russian-speaking criminal forum to reveal that their data-leak sites had been &#8216;hijacked&#8217;,&#8221; Digital Shadows&#8217; <strong>Ivan Righi</strong> wrote. &#8220;The REvil member explained that an unknown individual accessed the hidden services of REvil’s website’s landing page and blog using the same key owned by the developers. The user believed that the ransomware gang’s servers had been compromised and the individual responsible for the compromise was &#8216;looking for&#8217; him.&#8221;</p>
<p><a href="https://www.mandiant.com/resources/fin12-ransomware-intrusion-actor-pursuing-healthcare-targets" target="_blank" rel="noopener">A recent report by Mandiant</a> revealed that <strong>FIN12</strong> &#8212; the group believed to be responsible for both Conti and the <a href="https://krebsonsecurity.com/?s=ryuk" target="_blank" rel="noopener"><strong>Ryuk ransomware operation</strong></a> &#8212; has managed to conduct ransomware attacks in less than 3 days, compared to more than 12 days for attacks involving data exfiltration.</p>
<p>Seen through those figures, perhaps Conti is merely seeking to outsource more of the data exfiltration side of the business (for a fee, of course) so that it can focus on the less time-intensive but equally profitable racket of deploying ransomware.</p>
<p>&#8220;As Q4 comes near, it will be interesting to see if issues relating to managing data leak sites will discourage new ransomware groups [from pursuing] the path of data-leak sites, or what creative solutions they will create to work around these issues,&#8221; Righi concluded. &#8220;The Ryuk ransomware group has proven itself to remain effective and a top player in the ransomware threat landscape without the need for a data-leak site. In fact, Ryuk has thrived by not needing a data leak site and data exfiltration.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=57313
title: FBI Raids Chinese Point-of-Sale Giant PAX Technology
uri: FBI-Raids-Chinese-Point-of-Sale-Giant-PAX-Technology
url: https://krebsonsecurity.com/2021/10/fbi-raids-chinese-point-of-sale-giant-pax-technology/
content:
<p>U.S. federal investigators today raided the Florida offices of <strong>PAX Technology</strong>, a Chinese provider of point-of-sale devices used by millions of businesses and retailers globally. KrebsOnSecurity has learned the raid is tied to reports that PAX&#8217;s systems may have been involved in cyberattacks on U.S. and E.U. organizations.</p>
<div id="attachment_57339" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57339" loading="lazy" class="wp-image-57339" src="media/8d854fc3.wokv.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/wokv.png" alt="" width="764" height="403" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/10/wokv.png 904w, https://krebsonsecurity.com/wp-content/uploads/2021/10/wokv-768x405.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/10/wokv-782x413.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/10/wokv-267x140.png 267w" sizes="(max-width: 764px) 100vw, 764px" /><p id="caption-attachment-57339" class="wp-caption-text">FBI agents entering PAX Technology offices in Jacksonville today. Source: WOKV.com.</p></div>
<p>Headquartered in Shenzhen, China, <a href="https://www.pax.us/" target="_blank" rel="noopener">PAX Technology Inc.</a> has more than 60 million point-of-sale terminals in use throughout 120 countries. Earlier today, Jacksonville, Fla. based <strong>WOKV.com</strong> <a href="https://www.wokv.com/news/local/fbi-jacksonville-homeland-security-agents-investigating-outside-southside-business/BVFSPMUVUJHWRJTX56PSQDXAZ4/" target="_blank" rel="noopener">reported</a> that agents with the FBI and <strong>Department of Homeland Security</strong> (DHS) had raided a local PAX Technology warehouse.</p>
<p>In an official statement, investigators told WOKV only that they were executing a court-authorized search at the warehouse as a part of a federal investigation, and that the inquiry included the <strong>Department of Customs and Border Protection</strong> and the <strong>Naval Criminal Investigative Services</strong> (NCIS). The FBI has not responded to requests for comment.</p>
<p>Several days ago, KrebsOnSecurity heard from a trusted source that the FBI began investigating PAX after a major U.S. payment processor started asking questions about unusual network packets originating from the company&#8217;s payment terminals.</p>
<p>According to that source, the payment processor found that the PAX terminals were being used both as a malware &#8220;dropper&#8221; &#8212; a repository for malicious files &#8212; and as &#8220;command-and-control&#8221; locations for staging attacks and collecting information.</p>
<p>&#8220;FBI and MI5 are conducting an intensive investigation into PAX,&#8221; the source said. &#8220;A major US payment processor began asking questions about network packets originating from PAX terminals and were not given any good answers.&#8221;</p>
<p>KrebsOnSecurity reached out to PAX Technology&#8217;s CEO on Sunday. The company has not yet responded to requests for comment.</p>
<p>The source said two major financial providers &#8212; one in the United States and one in the United Kingdom &#8212; had already begun pulling PAX terminals from their payment infrastructure, a claim that was verified by two different sources.<span id="more-57313"></span></p>
<p>&#8220;My sources say that there is tech proof of the way that the terminals were used in attack ops,&#8221; the source said. &#8220;The packet sizes don&#8217;t match the payment data they should be sending, nor does it correlate with telemetry these devices might display if they were updating their software. PAX is now claiming that the investigation is racially and politically motivated.&#8221;</p>
<p>The source was unable to share specific details about the strange network activity that prompted the FBI&#8217;s investigation. But it should be noted that point-of-sale terminals and the technology that supports them are perennial targets of cybercriminals.</p>
<p>It is not uncommon for payment terminals to be compromised remotely by malicious software and made to collect and transmit stolen information. Indeed, some of history&#8217;s largest cyberheists involved point-of-sale malware, including the 2008 breach at Heartland Payment Systems that exposed 100 million payment cards, and the 2013-2014 string of breaches at <a href="https://krebsonsecurity.com/?s=target+breach" target="_blank" rel="noopener">Target</a>, <a href="https://krebsonsecurity.com/?s=home+depot+breach" target="_blank" rel="noopener">Home Depot</a> and elsewhere that led to theft of roughly another 100 million cards.</p>
<p>Even if it were publicly proven today that the company&#8217;s technology was in fact a security risk, my guess is few retailers would be quick to do much about it in the short run. The investigation into PAX Technology comes at a dicey time for retailers, many of whom are gearing up for the busy holiday shopping season. What&#8217;s more, global computer chip shortages are causing lengthy delays in procuring new electronics.</p>


feed_id: https://krebsonsecurity.com/?p=57314
title: Zales.com Leaked Customer Data, Just Like Sister Firms Jared, Kay Jewelers Did in 2018
uri: Zales-com-Leaked-Customer-Data-Just-Like-Sister-Firms-Jared-Kay-Jewe
url:
https://krebsonsecurity.com/2021/10/zales-com-leaked-customer-data-just-like-sister-firms-jared-kay-jewelers-did-in-2018/

content:
<p>In December 2018, bling vendor <strong>Signet Jewelers</strong> fixed a weakness in their<strong> Kay Jewelers</strong> and <strong>Jared</strong> websites that exposed the order information for all of their online customers. This week, Signet subsidiary <strong>Zales.com</strong> updated its website to remediate a nearly identical customer data exposure.</p>
<p><img loading="lazy" class="aligncenter wp-image-45854" src="media/0f80e08a.signet.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/signet.jpg" alt="" width="769" height="513" /></p>
<p>Last week, KrebsOnSecurity heard from a reader who was browsing Zales.com and suddenly found they were looking at someone else&#8217;s order information on the website, including their name, billing address, shipping address, phone number, email address, items and total amount purchased, delivery date, tracking link, and the last four digits of the customer&#8217;s credit card number.</p>
<p>The reader noticed that the link for the order information she&#8217;d stumbled on included a lengthy numeric combination that &#8212; when altered &#8212; would produce yet another customer&#8217;s order information.</p>
<p>When the reader failed to get an immediate response from Signet, KrebsOnSecurity contacted the company. In a written response, Signet said, &#8220;A concern was brought to our attention by an IT professional. We addressed it swiftly, and upon review we found no misuse or negative impact to any systems or customer data.&#8221;</p>
<p>Their statement continues:</p>
<blockquote><p>&#8220;As a business principle we make consumer information protection the highest priority, and proactively initiate independent and industry-leading security testing. As a result, we exceed industry benchmarks on data protection maturity. We always appreciate it when consumers reach out to us with feedback, and have committed to further our efforts on data protection maturity.&#8221;</p></blockquote>
<p>When Signet <a href="https://krebsonsecurity.com/2018/12/jared-kay-jewelers-parent-fixes-data-leak/" target="_blank" rel="noopener">fixed similar weaknesses with its Jared and Kay websites back in 2018</a>, the reader who found and reported that data exposure said his mind quickly turned to the various ways crooks might exploit access to customer order information.</p>
<p>&#8220;My first thought was they could track a package of jewelry to someone’s door and swipe it off their doorstep,&#8221; said <strong>Brandon Sheehy</strong>, a Dallas-based Web developer. &#8220;My second thought was that someone could call Jared’s customers and pretend to be Jared, reading the last four digits of the customer’s card and saying there’d been a problem with the order, and if they could get a different card for the customer they could run it right away and get the order out quickly. That would be a pretty convincing scam. Or just targeted phishing attacks.&#8221;<span id="more-57314"></span></p>
<p>In the grand scheme of many other, far more horrible things going on in information security right now, this Zales customer data exposure is small potatoes. And this type of data exposure is unbelievably common today: KrebsOnSecurity could probably run one story each day for several months just based on examples I&#8217;ve seen at dozens of other places online.</p>
<p>But I do think one key reason we continue to see companies make these easily avoidable mistakes with their customer data is that there are hardly ever any real consequences for organizations that fail to take more care. Meanwhile, their customers&#8217; data is free to be hoovered up by anyone or anything that cares to look for it.</p>
<p>&#8220;Being a Web developer, the only thing I can chalk this up to is complete incompetence, and being very lazy and indifferent to your customers&#8217; data,&#8221; Sheehy said. &#8220;This isn&#8217;t novel stuff, it&#8217;s basic Web site security.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=57367
title: ‘Trojan Source’ Bug Threatens the Security of All Code
uri: Trojan-Source-Bug-Threatens-the-Security-of-All-Code
url: https://krebsonsecurity.com/2021/11/trojan-source-bug-threatens-the-security-of-all-code/
content:
<p>Virtually all compilers &#8212; programs that transform human-readable source code into computer-executable machine code &#8212; are vulnerable to an insidious attack in which an adversary can introduce targeted vulnerabilities into any software without being detected, new research released today warns. The vulnerability disclosure was coordinated with multiple organizations, some of whom are now releasing updates to address the security weakness.</p>
<p><img loading="lazy" class="aligncenter  wp-image-57405" src="media/435c19d0.trojansource.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/trojansource.png" alt="" width="758" height="500" /></p>
<p>Researchers with the <strong>University of Cambridge</strong> discovered a bug that affects most computer code compilers and many software development environments. At issue is a component of the digital text encoding standard <a href="https://home.unicode.org/" target="_blank" rel="noopener">Unicode</a>, which allows computers to exchange information regardless of the language used. Unicode currently defines more than 143,000 characters across 154 different language scripts (in addition to many non-script character sets, such as emojis).</p>
<p>Specifically, the weakness involves Unicode&#8217;s bi-directional or &#8220;<a href="https://www.w3.org/International/articles/inline-bidi-markup/uba-basics" target="_blank" rel="noopener">Bidi&#8221; algorithm</a>, which handles displaying text that includes mixed scripts with different display orders, such as Arabic &#8212; which is read right to left &#8212; and English (left to right).</p>
<p>But computer systems need to have a deterministic way of resolving conflicting directionality in text. Enter the &#8220;Bidi override,&#8221; which can be used to make left-to-right text read right-to-left, and vice versa.</p>
<p>&#8220;In some scenarios, the default ordering set by the Bidi Algorithm may not be sufficient,&#8221; the Cambridge researchers wrote. &#8220;For these cases, Bidi override control characters enable switching the display ordering of groups of characters.&#8221;</p>
<p>Bidi overrides enable even single-script characters to be displayed in an order different from their logical encoding. As the researchers point out, this fact has previously been exploited <a href="https://krebsonsecurity.com/2011/09/right-to-left-override-aids-email-attacks/" target="_blank" rel="noopener">to disguise the file extensions of malware disseminated via email</a>.</p>
<p>Here&#8217;s the problem: Most programming languages let you put these Bidi overrides in comments and strings. This is bad because most programming languages allow comments within which all text &#8212; including <a href="https://en.wikipedia.org/wiki/Control_character" target="_blank" rel="noopener">control characters</a> &#8212; is ignored by compilers and interpreters. Also, it&#8217;s bad because most programming languages allow <a href="https://www.ibm.com/docs/en/zos/2.3.0?topic=literals-string" target="_blank" rel="noopener">string literals</a> that may contain arbitrary characters, including control characters.</p>
<p>&#8220;So you can use them in source code that appears innocuous to a human reviewer [that] can actually do something nasty,&#8221; said <strong>Ross Anderson</strong>, a professor of computer security at Cambridge and co-author of the research. &#8220;That&#8217;s bad news for projects like Linux and Webkit that accept contributions from random people, subject them to manual review, then incorporate them into critical code. <span class="pullquote pqright">This vulnerability is, as far as I know, the first one to affect almost everything.&#8221;</span></p>
<p>The research paper, which dubbed the vulnerability &#8220;<a href="https://www.trojansource.codes/" target="_blank" rel="noopener"><strong>Trojan Source</strong></a>,&#8221; notes that while both comments and strings will have syntax-specific semantics indicating their start and end, <em>these bounds are not respected by Bidi overrides</em>. From the paper:</p>
<blockquote><p>&#8220;Therefore, by placing Bidi override characters exclusively within comments and strings, we can smuggle them into source code in a manner that most compilers will accept. Our key insight is that we can reorder source code characters in such a way that the resulting display order also represents syntactically valid source code.&#8221;</p>
<p>&#8220;Bringing all this together, we arrive at a novel supply-chain attack on source code. By injecting Unicode Bidi override characters into comments and strings, an adversary can produce syntactically-valid source code in most modern languages for which the display order of characters presents logic that diverges from the real logic. In effect, we anagram program A into program B.&#8221;</p></blockquote>
<p>Anderson said such an attack could be challenging for a human code reviewer to detect, as the rendered source code looks perfectly acceptable.</p>
<p>&#8220;If the change in logic is subtle enough to go undetected in subsequent testing, an adversary could introduce targeted vulnerabilities without being detected,&#8221; he said.</p>
<p>Equally concerning is that Bidi override characters <em>persist through the copy-and-paste functions on most modern browsers, editors, and operating systems.</em></p>
<p>&#8220;Any developer who copies code from an untrusted source into a protected code base may inadvertently introduce an invisible vulnerability,&#8221; Anderson told KrebsOnSecurity. &#8220;Such code copying is a significant source of real-world security exploits.&#8221;</p>
<div id="attachment_57381" style="width: 315px" class="wp-caption alignright"><img aria-describedby="caption-attachment-57381" loading="lazy" class=" wp-image-57381" src="media/9f9964fb.xkcd-moderninfrastructure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/10/xkcd-moderninfrastructure.png" alt="" width="305" height="384" /><p id="caption-attachment-57381" class="wp-caption-text">Image: XKCD.com/2347/</p></div>
<p><a href="https://isi.jhu.edu/~mgreen/" target="_blank" rel="noopener">Matthew Green</a>, an associate professor at the <strong>Johns Hopkins Information Security Institute</strong>, said the Cambridge research clearly shows that most compilers can be tricked with Unicode into processing code in a different way than a reader would expect it to be processed.</p>
<p>&#8220;Before reading this paper, the idea that Unicode could be exploited in some way wouldn’t have surprised me,&#8221; Green told KrebsOnSecurity. &#8220;What does surprise me is how many compilers will happily parse Unicode without any defenses, and how effective their right-to-left encoding technique is at sneaking code into codebases. That’s a really clever trick I didn’t even know was possible. Yikes.&#8221;</p>
<p>Green said the good news is that the researchers conducted a widespread vulnerability scan, but were unable to find evidence that anyone was exploiting this. Yet.</p>
<p>&#8220;The bad news is that there were no defenses to it, and now that people know about it they might start exploiting it,&#8221; Green said. &#8220;Hopefully compiler and code editor developers will patch this quickly! But since some people don’t update their development tools regularly there will be some risk for a while at least.&#8221;<span id="more-57367"></span></p>
<p><strong>Nicholas Weaver</strong>, a lecturer at the computer science department at <strong>University of California, Berkeley</strong>, said the Cambridge research presents &#8220;a very simple, elegant set of attacks that could make supply chain attacks much, much worse.&#8221;</p>
<p>&#8220;It is already hard for humans to tell &#8216;this is OK&#8217; from &#8216;this is evil&#8217; in source code,&#8221; Weaver said. &#8220;With this attack, you can use the shift in directionality to change how things render with comments and strings so that, for example &#8216;This is okay&#8221; is how it renders, but &#8216;This is&#8217; okay is how it exists in the code. This fortunately has a very easy signature to scan for, so compilers can [detect] it if they encounter it in the future.&#8221;</p>
<p>The latter half of the Cambridge paper is a fascinating case study on the complexities of orchestrating vulnerability disclosure with so many affected programming languages and software firms. The researchers said they offered a 99-day embargo period following their initial disclosure to allow affected products to be repaired with software updates.</p>
<p>&#8220;We met a variety of responses ranging from patching commitments and bug bounties to quick dismissal and references to legal policies,&#8221; the researchers wrote. &#8220;Of the nineteen software suppliers with whom we engaged, seven used an outsourced platform for receiving vulnerability disclosures, six had dedicated web portals for vulnerability disclosures, four accepted disclosures via PGP-encrypted email, and two accepted disclosures only via non-PGP email. They all confirmed receipt of our disclosure, and ultimately nine of them committed to releasing a patch.&#8221;</p>
<p>Eleven of the recipients had bug bounty programs offering payment for vulnerability disclosures. But of these, only five paid bounties, with an average payment of $2,246 and a range of $4,475, the researchers reported.</p>
<p><img loading="lazy" class="aligncenter  wp-image-51669" src="media/3c7e6f05.codereview.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/05/codereview.jpg" alt="" width="755" height="498" /></p>
<p>Anderson said so far about half of the organizations maintaining the affected computer programming languages contacted have promised patches. Others are dragging their feet.</p>
<p>&#8220;We&#8217;ll monitor their deployment over the next few days,&#8221; Anderson said. &#8220;We also expect action from Github, Gitlab and Atlassian, so their tools should detect attacks on code in languages that still lack bidi character filtering.&#8221;</p>
<p>As for what needs to be done about Trojan Source, the researchers urge governments and firms that rely on critical software to identify their suppliers’ posture, exert pressure on them to implement adequate defenses, and ensure that any gaps are covered by controls elsewhere in their toolchain.</p>
<p>&#8220;The fact that the Trojan Source vulnerability affects almost all computer languages makes it a rare opportunity for a system-wide and ecologically valid cross-platform and cross-vendor comparison of responses,&#8221; the paper concludes. &#8220;As powerful supply-chain attacks can be launched easily using these techniques, it is essential for organizations that participate in a software supply chain to implement defenses.&#8221;</p>
<p>Weaver called the research &#8220;really good work at stopping something before it becomes a problem.&#8221;</p>
<p>&#8220;The coordinated disclosure lessons are an excellent study in what it takes to fix these problems,&#8221; he said. &#8220;The vulnerability is real but also highlights the even larger vulnerability of the shifting stand of dependencies and packages that our modern code relies on.&#8221;</p>
<p>Rust has released <a href="https://blog.rust-lang.org/2021/11/01/cve-2021-42574.html" target="_blank" rel="noopener">a security advisory</a> for this security weakness, which is being tracked as CVE-2021-42574 and CVE-2021-42694. Additional security advisories from other affected languages will be added as updates here.</p>
<p>The Trojan Source research paper is available <a href="media/ec943e18.trojan-source.pdf" data-original-source="https://www.trojansource.codes/trojan-source.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=57364
title: The ‘Groove’ Ransomware Gang Was a Hoax
uri: The-Groove-Ransomware-Gang-Was-a-Hoax
url: https://krebsonsecurity.com/2021/11/the-groove-ransomware-gang-was-a-hoax/
content:
<p>A number of publications in September warned about the emergence of &#8220;<strong>Groove</strong>,&#8221; a new ransomware group that called on competing extortion gangs to unite in attacking U.S. government interests online. It now appears that Groove was all a big hoax designed to toy with security firms and journalists.</p>
<div id="attachment_57413" style="width: 770px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57413" loading="lazy" class=" wp-image-57413" src="media/89f47fc3.grooveappeal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/grooveappeal.png" alt="" width="760" height="324" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/grooveappeal.png 1201w, https://krebsonsecurity.com/wp-content/uploads/2021/11/grooveappeal-768x327.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/grooveappeal-782x333.png 782w" sizes="(max-width: 760px) 100vw, 760px" /><p id="caption-attachment-57413" class="wp-caption-text">&#8220;An appeal to business brothers!&#8221; reads the Oct. 22 post from Groove calling for attacks on the United States government sector.</p></div>
<p>Groove was first announced Aug. 22 on <strong>RAMP</strong>, a new and fairly exclusive Russian-language darknet cybercrime forum.</p>
<p>&#8220;GROOVE is first and foremost an aggressive financially motivated criminal organization dealing in industrial espionage for about two years,&#8221; wrote RAMP&#8217;s administrator &#8220;Orange&#8221; in a post asking forum members to compete in a contest for designing a website for the new group. &#8220;Let’s make it clear that we don&#8217;t do anything without a reason, so at the end of the day, it’s us who will benefit most from this contest.&#8221;</p>
<p>According to <a href="https://www.mcafee.com/blogs/enterprise/mcafee-enterprise-atr/how-groove-gang-is-shaking-up-the-ransomware-as-a-service-market-to-empower-affiliates/" target="_blank" rel="noopener">a report</a> jointly published by <strong>McAfee</strong>,<strong> Intel 471</strong> and <strong>Coveware</strong>, Orange launched RAMP to appeal to ransomware-related threat actors who were were ousted from major cybercrime forums for being too toxic, or to cybercriminals who complained of being short-changed or stiffed altogether by different ransomware affiliate programs.</p>
<p>The report said RAMP was the product of a dispute between members of the<strong> Babuk</strong> ransomware gang, and that its members likely had connections to another ransomware group called <strong>BlackMatter</strong>.</p>
<p>&#8220;[McAfee] believes, with high confidence, that the Groove gang is a former affiliate or subgroup of the Babuk gang, who are willing to collaborate with other parties, as long as there is financial gain for them,&#8221; the joint report said. &#8220;Thus, an affiliation with the BlackMatter gang is likely.&#8221;</p>
<p>In the first week of September, Groove posted on its darknet blog nearly 500,000 login credentials for customers of <strong>Fortinet VPN</strong> products, usernames and passwords that could be used to remotely connect to vulnerable systems. Fortinet <a href="https://www.fortinet.com/blog/psirt-blogs/malicious-actor-discloses-fortigate-ssl-vpn-credentials" target="_blank" rel="noopener">said</a> the credentials were collected from systems that hadn&#8217;t yet implemented a patch issued in May 2019.</p>
<p>Some security experts said the post of the Fortinet VPN usernames and passwords was aimed at drawing new affiliates to Groove. But it seems more likely the credentials were posted to garner the attention of security researchers and journalists.</p>
<p>Sometime in the last week, Groove&#8217;s darknet blog disappeared. In a post on the Russian cybercrime forum <strong>XSS</strong>, an established cybercrook using the handle &#8220;<strong>Boriselcin</strong>&#8221; explained that Groove was little more than a pet project to screw with the media and security industry.</p>
<p>&#8220;For those who don&#8217;t understand what&#8217;s going on: I set up a fake Groove Gang and named myself a gang,&#8221; Boriselcin wrote. The rest of the post reads:</p>
<blockquote><p>&#8220;They ate it up, I dumped 500k old Fortinet [access credentials] that no one needed and they ate it up. I say that I am going to target the U.S. government sector and they eat it up. Few journalists realized that this was all a show, a fake, and a scam! And my respect goes out to those who figured it out. I don&#8217;t even know what to do now with this blog with a ton of traffic. Maybe sell it? Now I just need to start writing [the article], but I can&#8217;t start writing it without checking everything.&#8221;</p></blockquote>
<p>A review of Boriselcin&#8217;s recent postings on XSS indicate he has been planning this scheme for several months. On Sept. 13, Boriselcin posted that &#8220;several topics are ripening,&#8221; and that he intended to publish an article about duping the media and security firms.</p>
<p>&#8220;Manipulation of large information security companies and the media through a ransom blog,&#8221; he wrote. &#8220;It&#8217;s so funny to read Twitter and the news these days <img src="media/7d7d5e26.1f642.png" data-original-source="https://s.w.org/images/core/emoji/13.1.0/72x72/1f642.png" alt="🙂" class="wp-smiley" style="height: 1em; max-height: 1em;" /> But the result is great so far. Triggering the directors of information security companies. We fuck the supply chain of the information security office.&#8221;</p>
<div id="attachment_57420" style="width: 778px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57420" loading="lazy" class=" wp-image-57420" src="media/7e5cf460.grooveleaks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/grooveleaks.png" alt="" width="768" height="639" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/grooveleaks.png 995w, https://krebsonsecurity.com/wp-content/uploads/2021/11/grooveleaks-768x639.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/grooveleaks-782x651.png 782w" sizes="(max-width: 768px) 100vw, 768px" /><p id="caption-attachment-57420" class="wp-caption-text">Image: @nokae8</p></div>
<p><span id="more-57364"></span></p>
<p>Throughout its short existence, Groove listed only a handful of victims on its darknet victim shaming blog, leading some to conclude the group wasn&#8217;t much of a threat.</p>
<p>&#8220;I wouldn&#8217;t take this call too seriously,&#8221; <a href="https://twitter.com/campuscodi/status/1451601687941193731" target="_blank" rel="noopener">tweeted</a> The Record&#8217;s <strong>Catalin Cimpanu</strong> in response to tweets about Groove&#8217;s rallying cry to attack U.S. government interests. &#8220;Groove are low-tier actors with few skills.&#8221;</p>
<p>Normally, when a cybercriminal forum or enterprise turns out to be fake or a scam, we learn the whole thing was a sting operation by federal investigators from the United States and/or other countries. Perhaps the main reason we don&#8217;t see more scams like Boricelcin&#8217;s is because there&#8217;s not really any money in it.</p>
<p>But that&#8217;s not to say his cynical ploy fails to serve a larger purpose. Over the past few years, we&#8217;ve seen <a href="https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/" target="_blank" rel="noopener">multiple ransomware gangs reinvent themselves and rebrand to evade prosecution or economic sanctions</a>. From that vantage point, anything which sows confusion and diverts the media and security industry&#8217;s time and attention away from real threats is a net plus for the cybercriminal community.</p>
<p><strong>Tom Hoffman</strong>, senior vice president of intelligence at <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, said mocking Western media outlets and reporters is a constant fixture of the conversation on top-tier cybercrime forums. &#8221;</p>
<p>&#8220;It is clear the criminal actors read all the press releases and Twitter claims about them,&#8221; Hoffman said. &#8220;We know some of them just want to inflict pain on the West, so this type of trolling is likely to continue. With the high level of attention this one got, I would assume we will see some other copycats pretty soon.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=57437
title: ‘Tis the Season for the Wayward Package Phish
uri: Tis-the-Season-for-the-Wayward-Package-Phish
url: https://krebsonsecurity.com/2021/11/tis-the-season-for-the-wayward-package-phish/
content:
<p>The holiday shopping season always means big business for phishers, who tend to find increased success this time of year with a time-honored lure about a wayward package that needs redelivery. Here&#8217;s a look at a fairly elaborate SMS-based phishing scam that spoofs <strong>FedEx</strong> in a bid to extract personal and financial information from unwary recipients.</p>
<div id="attachment_57453" style="width: 307px" class="wp-caption alignright"><img aria-describedby="caption-attachment-57453" loading="lazy" class=" wp-image-57453" src="media/cc493b7d.fedexscam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/fedexscam.png" alt="" width="297" height="485" /><p id="caption-attachment-57453" class="wp-caption-text">One of dozens of FedEx-themed phishing sites currently being advertised via SMS spam.</p></div>
<p><strong>Louis Morton</strong>, a security professional based in Fort Worth, Texas, forwarded an SMS phishing or &#8220;smishing&#8221; message sent to his wife&#8217;s mobile device that indicated a package couldn&#8217;t be delivered.</p>
<p>&#8220;It is a nearly perfect attack vector at this time of year,&#8221; Morton said. &#8220;A link was included, implying that the recipient could reschedule delivery.&#8221;</p>
<p>Attempting to visit the domain in the phishing link &#8212; <strong>o001cfedeex[.]com</strong> &#8212; from a desktop web browser redirects the visitor to a harmless page with ads for car insurance quotes. But by loading it in a mobile device (or by mimicking one using <a href="https://developer.mozilla.org/en-US/docs/Learn/Common_questions/What_are_browser_developer_tools" target="_blank" rel="noopener">developer tools</a>), we can see the intended landing page pictured in the screenshot to the right &#8212; <strong>returns-fedex[.]com</strong>.</p>
<p>Blocking non-mobile users from visiting the domain can help minimize scrutiny of the site from non-potential victims, such as security researchers, and thus potentially keep the scam site online longer.</p>
<p>Clicking &#8220;Schedule new delivery&#8221; brings up a page that requests your name, address, phone number and date of birth. Those who click &#8220;Next Step&#8221; after providing that information are asked to add a payment card to cover the $2.20 &#8220;redelivery fee.&#8221;<span id="more-57437"></span></p>
<p>After clicking &#8220;Pay Now,&#8221; the visitor is prompted to verify their identity by providing their Social Security number, driver&#8217;s license number, email address and email password. Scrolling down on the page revealed more than a half dozen working links to real fedex.com resources online, including the company&#8217;s security and privacy policies.</p>
<p><img loading="lazy" class="alignright  wp-image-57452" src="media/68e45cce.fedex-update.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/fedex-update.png" alt="" width="297" height="544" />While ever fiber of my being hopes that most people would freak out at this page and go away, scams like these would hardly exist if they didn&#8217;t work at least some of the time.</p>
<p>After clicking &#8220;Verify,&#8221; anyone anxious enough over a wayward package to provide all that information is redirected to the real FedEx at Fedex.com.</p>
<p>It appears that sometime in the past 12 hours, the domain that gets loaded when one clicks the link in the SMS phishing message &#8212; returns-fedex[.]com &#8212; stopped resolving. But I doubt we&#8217;ve seen the last of these phishers.</p>
<p>The true Internet address of the link included in the FedEx SMS phishing campaign is hidden behind content distribution network <strong>Cloudflare</strong>, but a review of its domain name system (DNS) records shows it resolves to 23.92.29[.]42. There are currently more than three dozen other newly-registered FedEx phishing domains tied to that address, all with a similar naming convention, e.g., f001bfedeex[.]com, g001bfedeex[.]com, and so on.</p>
<p>Now is a great time to remind family and friends about the best advice to sidestep phishing scams: Avoid clicking on links or attachments that arrive unbidden in emails, text messages and other mediums. Most phishing scams invoke a temporal element that warns of negative consequences should you fail to respond or act quickly.</p>
<p>If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>


feed_id: https://krebsonsecurity.com/?p=57474
title: REvil Ransom Arrest, $6M Seizure, and $10M Reward
uri: REvil-Ransom-Arrest-6M-Seizure-and-10M-Reward
url: https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/
content:
<p><strong>The U.S. Department of Justice</strong> today announced the arrest of Ukrainian man accused of deploying ransomware on behalf of the <strong>REvil</strong> ransomware gang, a Russian-speaking cybercriminal collective that has extorted hundreds of millions from victim organizations. The DOJ also said it had seized $6.1 million in cryptocurrency sent to another REvil affiliate, and that the <strong>U.S. Department of State</strong> is now offering up to $10 million for the name or location any key REvil leaders, and up to $5 million for information on REvil affiliates.</p>
<p>If it sounds unlikely that a normal Internet user could make millions of dollars unmasking the identities of REvil gang members, take heart and consider that the two men indicted as part <a href="https://www.justice.gov/opa/pr/ukrainian-arrested-and-charged-ransomware-attack-kaseya" target="_blank" rel="noopener">this law enforcement action</a> do not appear to have done much to separate their cybercriminal identities from their real-life selves.</p>
<p>Exhibit #1: <strong>Yaroslav Vasinskyi</strong>, the 22-year-old Ukrainian national accused of being REvil Affiliate #22. Vasinskyi was arrested Oct. 8 in Poland, which maintains an extradition treaty with the United States. Prosecutors say Vasinskyi was involved in a number of REvil ransomware attacks, including the <a href="https://www.washingtonpost.com/national-security/ransomware-fbi-revil-decryption-key/2021/09/21/4a9417d0-f15f-11eb-a452-4da5fe48582d_story.html" target="_blank" rel="noopener">July 2021 attack</a> against <strong>Kaseya</strong>, Miami-based company whose products help system administrators manage large networks remotely.</p>
<div id="attachment_57478" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57478" loading="lazy" class=" wp-image-57478" src="media/b3f67519.yaroslav-profile.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/yaroslav-profile.png" alt="" width="753" height="712" /><p id="caption-attachment-57478" class="wp-caption-text">Yaroslav Vasinksyi&#8217;s Vkontakte profile reads &#8220;If they tell you nasty things about me, believe every word.&#8221;</p></div>
<p>According to <a href="https://www.justice.gov/opa/press-release/file/1447126/download" target="_blank" rel="noopener">his indictment</a> (PDF), Vasinskyi used a variety of hacker handles, including &#8220;Profcomserv&#8221; &#8212; the nickname behind an online service that floods phone numbers with junk calls for a fee. Prosecutors say Vasinskyi also used the monikers  &#8220;<strong>Yarik45</strong>,&#8221; and &#8220;<strong>Yaroslav2468</strong>.&#8221;</p>
<p>These last two nicknames correspond to accounts on several top cybercrime forums way back in 2013, where a user named &#8220;Yaroslav2468&#8221; registered using the email address <strong>yarik45@gmail.com</strong>.</p>
<p>That email address was used to register an account at <strong>Vkontakte </strong>(the Russian version of Facebook/Meta) under the profile name of &#8220;Yaroslav &#8216;sell the blood of css&#8217; Vasinskyi.&#8221; Vasinskyi&#8217;s Vkontakte profile says his current city as of Oct. 3 was Lublin, Poland. Perhaps tauntingly, Vasinskyi&#8217;s profile page also lists the FBI&#8217;s 1-800 tip line as his contact phone number. He&#8217;s now in custody in Poland, awaiting extradition to the United States.</p>
<p>Exhibit #2: <strong>Yevgeniy Igorevich Polyanin</strong>, the 28-year-old Russian national who is alleged to be REvil Affiliate #23. The DOJ said it seized $6.1 million in funds traceable to alleged ransom payments received by Polyanin, and that the defendant had been involved in REvil ransomware attacks on multiple U.S. victim organizations.</p>
<div id="attachment_57479" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57479" loading="lazy" class=" wp-image-57479" src="media/dbaa6e8d.polyanin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/polyanin.png" alt="" width="748" height="688" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/polyanin.png 800w, https://krebsonsecurity.com/wp-content/uploads/2021/11/polyanin-768x707.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/polyanin-782x719.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-57479" class="wp-caption-text">The FBI&#8217;s wanted poster for Polyanin.</p></div>
<p><a href="https://www.justice.gov/opa/press-release/file/1447121/download" target="_blank" rel="noopener">Polyanin&#8217;s indictment</a> (PDF) says he also favored numerous hacker handles, including <strong>LK4D4</strong>, <strong>Damnating</strong>, <strong>Damn2life</strong>, <strong>Noolleds</strong>, and <strong>Antunpitre</strong>. Some of these nicknames go back more than a decade on Russian cybercrime forums, many of which have been hacked and relieved of their user databases over the years.</p>
<p>Among those was carder[.]su, and that forum&#8217;s database says a user by the name &#8220;Damnating&#8221; registered with the forum in 2008 using the email address<strong> damnating@yandex.ru</strong>. Sure enough, there is a Vkontakte profile tied to that email address under the name &#8220;Yevgeniy &#8216;damn&#8217; Polyanin&#8221; from Barnaul, a city in the southern Siberian region of Russia.<span id="more-57474"></span></p>
<p>The apparent lack of any real operational security by either of the accused here is so common that it is hardly remarkable. As exhibited by countless investigations in my <a href="https://krebsonsecurity.com/?s=breadcrumbs" target="_blank" rel="noopener">Breadcrumbs story series</a>, I have found that if a cybercriminal is active on multiple forums over more than 10 years, it is extremely likely that person has made multiple mistakes that make it relatively easy to connect his forum persona to his real-life identity.</p>
<p>As I explained earlier this year in <a href="https://krebsonsecurity.com/2021/05/the-wages-of-password-re-use-your-money-or-your-life/" target="_blank" rel="noopener">The Wages of Password Re-use: Your Money or Your Life</a>, it&#8217;s possible in many cases to make that connection thanks to two factors. The biggest is password re-use by cybercriminals (yes, crooks are lazy, too). The other is that cybercriminal forums, services, etc. get hacked just about as much as everyone else on the Internet, and when they do their user databases can reveal some very valuable secrets and connections.</p>
<p>In conjunction with today&#8217;s REvil action, the <strong>U.S. Department of State</strong> said it was <a href="https://www.state.gov/reward-offers-for-information-to-bring-sodinokibi-revil-ransomware-variant-co-conspirators-to-justice/" target="_blank" rel="noopener">offering a reward of up to $10 million</a> for information leading to the identification or location of any individual holding a key leadership position in the REvil ransomware group. The department said it was also offering a reward of up to $5 million for information leading to the arrest and/or conviction in any country of any individual conspiring to participate in or attempting to participate in a REvil ransomware incident.</p>
<p>I really like this bounty offer and I hope we see more just like it for other ransomware groups. Because as we can see from the prosecutions of both Polyanin and Vasinskyi a lot of these guys simply aren&#8217;t too hard to find. Let the games begin.</p>


feed_id: https://krebsonsecurity.com/?p=57502
title: Microsoft Patch Tuesday, November 2021 Edition
uri: Microsoft-Patch-Tuesday-November-2021-Edition
url: https://krebsonsecurity.com/2021/11/microsoft-patch-tuesday-november-2021-edition/
content:
<p><strong>Microsoft Corp.</strong> today released updates to quash at least 55 security bugs in its <strong>Windows</strong> operating systems and other software. Two of the patches address vulnerabilities that are already being used in active attacks online, and four of the flaws were disclosed publicly before today &#8212; potentially giving adversaries a head start in figuring out how to exploit them.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="841" height="592" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 841px) 100vw, 841px" /></p>
<p>Among the zero-day bugs is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42292" target="_blank" rel="noopener">CVE-2021-42292</a>, a &#8220;security feature bypass&#8221; problem with <strong>Microsoft Excel versions 2013-2021</strong> that could allow attackers to install malicious code just by convincing someone to open a booby-trapped Excel file (Microsoft says Mac versions of Office are also affected, but several places are reporting that Office for Mac security updates aren&#8217;t available yet).</p>
<p>Microsoft&#8217;s revised, more sparse security advisories don&#8217;t offer much detail on what exactly is being bypassed in Excel with this flaw. But <strong>Dustin Childs </strong>over at <strong>Trend Micro&#8217;s Zero Day Initiative</strong> <a href="https://www.zerodayinitiative.com/blog/2021/11/9/the-november-2021-security-update-review" target="_blank" rel="noopener">says</a> the vulnerability is likely due to loading code that should be limited by a user prompt &#8212; such as a warning about external content or scripts &#8212; but for whatever reason that prompt does not appear, thus bypassing the security feature.</p>
<p>The other critical flaw patched today that&#8217;s already being exploited in the wild is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42321" target="_blank" rel="noopener">CVE-2021-42321</a>, yet another zero-day in <strong>Microsoft Exchange Server</strong>. You may recall that earlier this year a majority of the world&#8217;s organizations running Microsoft Exchange Servers were <a href="https://krebsonsecurity.com/2021/03/at-least-30000-u-s-organizations-newly-hacked-via-holes-in-microsofts-email-software/" target="_blank" rel="noopener">hit with four zero-day attacks that let thieves install backdoors and siphon email</a>.<span id="more-57502"></span></p>
<p>As Exchange zero-days go, CVE-2021-42321 appears somewhat mild by comparison. Unlike the four zero-days involved in the mass compromise of Exchange Server systems earlier this year, CVE-2021-42321 requires the attacker to be already authenticated to the target&#8217;s system. Microsoft has published a blog post/FAQ about the Exchange zero-day <a href="https://techcommunity.microsoft.com/t5/exchange-team-blog/released-november-2021-exchange-server-security-updates/ba-p/2933169" target="_blank" rel="noopener">here</a>.</p>
<p>Two of the vulnerabilities that were disclosed prior to today&#8217;s patches are <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38631" target="_blank" rel="noopener">CVE-2021-38631</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41371" target="_blank" rel="noopener">CVE-2021-41371</a>. Both involve weaknesses in Microsoft&#8217;s <strong>Remote Desktop Protocol</strong> (RDP, Windows&#8217; built-in remote administration tool) running on Windows 7 through Windows 11 systems, and on Windows Server 2008-2019 systems. The flaws let an attacker view the RDP password for the vulnerable system.</p>
<p>&#8220;Given the interest that cybercriminals &#8212; especially ransomware initial access brokers &#8212; have in RDP, it is likely that it will be exploited at some point,&#8221; said <strong>Allan Liska</strong>, senior security architect at <strong>Recorded Future</strong>.</p>
<p>Liska notes this month&#8217;s patch batch also brings us <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38666" target="_blank" rel="noopener">CVE-2021-38666</a>, which is a Remote Code Execution vulnerability in the Windows RDP Client.</p>
<p>&#8220;This is a serious vulnerability, labeled critical by Microsoft,&#8221; Liska added. &#8220;In its Exploitability Assessment section Microsoft has labelled this vulnerability &#8216;Exploitation More Likely.&#8217; This vulnerability affects Windows 7 &#8211; 11 and Windows Server 2008 &#8211; 2019 and should be a high priority for patching.&#8221;</p>
<p>For most Windows home users, applying security updates is not a big deal. By default, Windows checks for available updates and is fairly persistent in asking you to install them and reboot, etc. It&#8217;s a good idea to get in the habit of patching on a monthly basis, ideally within a few days of patches being released.</p>
<p>But please do not neglect to backup your important files &#8212; before patching if possible. Windows 10 has some built-in tools to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once. There are also a number of excellent third-party products that make it easy to duplicate your entire hard drive on a regular basis, so that a recent, working image of the system is always available for restore.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, see <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener">this guide</a>.</p>
<p>If you experience any glitches or problems installing patches this month, please consider leaving a comment about it below; there’s a better-than-even  chance other readers have experienced the same and may offer useful tips or suggestions.</p>
<p>Further reading:</p>
<p><strong>SANS Internet Storm Center </strong>has a <a href="https://isc.sans.edu/forums/diary/Microsoft+November+2021+Patch+Tuesday/28018/" target="_blank" rel="noopener">rundown on each of the 55 patches released today</a>, indexed by exploitability and severity, with links to each advisory.</p>


feed_id: https://krebsonsecurity.com/?p=57518
title: SMS About Bank Fraud as a Pretext for Voice Phishing
uri: SMS-About-Bank-Fraud-as-a-Pretext-for-Voice-Phishing
url: https://krebsonsecurity.com/2021/11/sms-about-bank-fraud-as-a-pretext-for-voice-phishing/
content:
<p>Most of us have probably heard the term &#8220;smishing&#8221; &#8212; which is a portmanteau for traditional ph<strong>ishing</strong> scams sent through <strong>SMS</strong> text messages. Smishing messages usually include a link to a site that spoofs a popular bank and tries to siphon personal information. But increasingly, phishers are turning to a hybrid form of smishing &#8212; blasting out linkless text messages about suspicious bank transfers as a pretext for immediately calling and scamming anyone who responds via text.</p>
<p>KrebsOnSecurity recently heard from a reader who said his daughter received an SMS that said it was from her bank, and inquired whether she&#8217;d authorized a $5,000 payment from her account. The message said she should reply &#8220;Yes&#8221; or &#8220;No,&#8221; or 1 to decline future fraud alerts.</p>
<p>Since this seemed like a reasonable and simple request &#8212; and she indeed had an account at the bank in question &#8212; she responded, &#8220;NO.&#8221;</p>
<p><img loading="lazy" class="aligncenter wp-image-57519" src="media/7dbc5007.zelletext.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext.png" alt="" width="768" height="418" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext.png 1244w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-768x418.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-782x426.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-370x200.png 370w" sizes="(max-width: 768px) 100vw, 768px" /></p>
<p>Seconds later, her mobile phone rang.</p>
<p>&#8220;When she replied &#8216;no,&#8217; someone called immediately, and the caller ID said &#8216;JP Morgan Chase&#8217;,&#8221; reader Kris Stevens told KrebsOnSecurity. &#8220;The person on the phone said they were from the fraud department and they needed to help her secure her account but needed information from her to make sure they were talking to the account owner and not the scammer.&#8221;</p>
<p>Thankfully, Stevens said his daughter had honored the gold rule regarding incoming phone calls about fraud: <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">When In Doubt, Hang up, Look up, and Call Back</a>.</p>
<p>&#8220;She knows the drill so she hung up and called Chase, who confirmed they had not called her,&#8221; he said. &#8220;What was different about this was it was all very smooth. No foreign accents, the pairing of the call with the text message, and the fact that she does have a Chase account.&#8221;</p>
<p>The remarkable aspect of these phone-based phishing scams is typically the attackers never even try to log in to the victim&#8217;s bank account. The entirety of the scam takes place over the phone.</p>
<p>We don&#8217;t know what the fraudsters behind this clever hybrid SMS/voice phishing scam intended to do with the information they might have coaxed from Stevens&#8217; daughter. But in previous stories and reporting on voice phishing schemes, the fraudsters used the phished information to set up new financial accounts in the victim&#8217;s name, which they then used to receive and forward large wire transfers of stolen funds.</p>
<p>Even many security-conscious people tend to focus on protecting their online selves, while perhaps discounting the threat from less technically sophisticated phone-based scams. In 2020 I told the story of &#8220;Mitch&#8221; &#8212; the tech-savvy Silicon Valley executive <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">who got voice phished after he thought he&#8217;d turned the tables on the scammers</a>.</p>
<p>Unlike Stevens&#8217; daughter, Mitch didn&#8217;t hang up with the suspected scammers. Rather, he put them on hold. Then Mitch called his bank on the other line and asked if their customer support people were in fact engaged in a separate conversation with him over the phone.</p>
<p>The bank replied that they were indeed speaking to the same customer on a different line at that very moment. Feeling better, Mitch got back on the line with the scammers. What Mitch couldn&#8217;t have known at that point was that a member of the fraudster&#8217;s team simultaneously was impersonating him on the phone with the bank&#8217;s customer service people.</p>
<p>So don&#8217;t be Mitch. Don&#8217;t try to outsmart the crooks. Just remember this anti-fraud mantra, and maybe repeat it a few times in front of your friends and family: When in doubt, hang up, look up, and call back. If you believe the call might be legitimate, look up the number of the organization supposedly calling you, and call them back.</p>
<p>And I suppose the same time-honored advice about not replying to spam email goes doubly for unsolicited text messages: When in doubt, it&#8217;s best not to respond.</p>


feed_id: https://krebsonsecurity.com/?p=57551
title: Hoax Email Blast Abused Poor Coding in FBI Website
uri: Hoax-Email-Blast-Abused-Poor-Coding-in-FBI-Website
url: https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/
content:
<p>The <strong>Federal Bureau of Investigation</strong> (FBI) confirmed today that its fbi.gov domain name and Internet address were used to blast out thousands of fake emails about a cybercrime investigation. According to an interview with the person who claimed responsibility for the hoax, the spam messages were sent by abusing insecure code in an FBI online portal designed to share information with state and local law enforcement authorities.</p>
<div id="attachment_57554" style="width: 775px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57554" loading="lazy" class=" wp-image-57554" src="media/41fdae0e.fakefbiemail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/fakefbiemail.png" alt="" width="765" height="190" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/fakefbiemail.png 1132w, https://krebsonsecurity.com/wp-content/uploads/2021/11/fakefbiemail-768x191.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/fakefbiemail-782x194.png 782w" sizes="(max-width: 765px) 100vw, 765px" /><p id="caption-attachment-57554" class="wp-caption-text">The phony message sent late Thursday evening via the FBI&#8217;s email system. Image: Spamhaus.org</p></div>
<p>Late in the evening of Nov. 12 ET, tens of thousands of emails <a href="https://twitter.com/spamhaus/status/1459450061696417792" target="_blank" rel="noopener">began flooding out</a> from the FBI address <strong>eims@ic.fbi.gov</strong>, warning about fake cyberattacks. Around that time, KrebsOnSecurity received an email from the same email address.</p>
<p>&#8220;Hi its <a href="https://mobile.twitter.com/pompompur_in" target="_blank" rel="noopener">pompompurin</a>,&#8221; read the message. &#8220;Check headers of this email it&#8217;s actually coming from FBI server. I am contacting you today because we located a botnet being hosted on your forehead, please take immediate action thanks.&#8221;</p>
<p>A review of the email&#8217;s message headers indicated it had indeed been sent by the FBI, and from the agency&#8217;s own Internet address. The domain in the &#8220;from:&#8221; portion of the email I received &#8212; eims@ic.fbi.gov &#8212; corresponds to the FBI&#8217;s <strong>Criminal Justice Information Services </strong>division (CJIS).</p>
<p>According to the <a href="https://www.justice.gov/tribal/national-crime-information-systems" target="_blank" rel="noopener">Department of Justice</a>, &#8220;CJIS manages and operates several national crime information systems used by the public safety community for both criminal and civil purposes. CJIS systems are available to the criminal justice community, including law enforcement, jails, prosecutors, courts, as well as probation and pretrial services.&#8221;</p>
<p>In response to a request for comment, the FBI confirmed the unauthorized messages, but declined to offer further information.</p>
<p>&#8220;The FBI and CISA [the <a href="https://www.cisa.gov/" target="_blank" rel="noopener">Cybersecurity and Infrastructure Security Agency</a>]  are aware of the incident this morning involving fake emails from an @ic.fbi.gov email account,&#8221; reads the FBI statement. &#8220;This is an ongoing situation and we are not able to provide any additional information at this time. The impacted hardware was taken offline quickly upon discovery of the issue. We continue to encourage the public to be cautious of unknown senders and urge you to report suspicious activity to www.ic3.gov or www.cisa.gov.&#8221;</p>
<p>In an interview with KrebsOnSecurity, Pompompurin said the hack was done to point out a glaring vulnerability in the FBI&#8217;s system.</p>
<p>&#8220;I could&#8217;ve 1000% used this to send more legit looking emails, trick companies into handing over data etc.,&#8221; Pompompurin said. &#8220;And this would&#8217;ve never been found by anyone who would responsibly disclose, due to the notice the feds have on their website.&#8221;</p>
<p>Pompompurin says the illicit access to the FBI&#8217;s email system began with an exploration of its <strong>Law Enforcement Enterprise Portal</strong> (LEEP), which the agency describes as &#8220;a gateway providing law enforcement agencies, intelligence groups, and criminal justice entities access to beneficial resources.&#8221;</p>
<div id="attachment_57565" style="width: 772px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57565" loading="lazy" class=" wp-image-57565" src="media/b815fb26.leepportal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/leepportal.png" alt="" width="762" height="823" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/leepportal.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/11/leepportal-768x830.png 768w" sizes="(max-width: 762px) 100vw, 762px" /><p id="caption-attachment-57565" class="wp-caption-text">The FBI&#8217;s Law Enforcement Enterprise Portal (LEEP).</p></div>
<p>&#8220;These resources will strengthen case development for investigators, enhance information sharing between agencies, and be accessible in one centralized location!,&#8221; the FBI&#8217;s site enthuses.</p>
<p>Until sometime this morning, the LEEP portal allowed anyone to apply for an account. Helpfully, step-by-step instructions for registering a new account on the LEEP portal also <a href="https://www.justice.gov/tribal/page/file/1260671/download" target="_blank" rel="noopener">are available from the DOJ&#8217;s website</a>. [It should be noted that &#8220;Step 1&#8221; in those instructions is to visit the site in Microsoft&#8217;s Internet Explorer, an outdated web browser that even Microsoft no longer encourages people to use for security reasons.]</p>
<p>Much of that process involves filling out forms with the applicant&#8217;s personal and contact information, and that of their organization. A critical step in that process says applicants will receive an email confirmation from eims@ic.fbi.gov with a one-time passcode &#8212; ostensibly to validate that the applicant can receive email at the domain in question.</p>
<p>But according to Pompompurin, the FBI&#8217;s own website leaked that one-time passcode in the HTML code of the web page.</p>
<div id="attachment_57552" style="width: 774px" class="wp-caption aligncenter"><a href="media/6f0e5e76.formscjis.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/formscjis.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-57552" loading="lazy" class="wp-image-57552" src="media/6f0e5e76.formscjis.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/formscjis.png" alt="" width="764" height="315" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/formscjis.png 1887w, https://krebsonsecurity.com/wp-content/uploads/2021/11/formscjis-768x317.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/formscjis-1536x633.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/11/formscjis-782x322.png 782w" sizes="(max-width: 764px) 100vw, 764px" /></a><p id="caption-attachment-57552" class="wp-caption-text">A screenshot shared by Pompompurin. Image: KrebOnSecurity.com</p></div>
<p><span id="more-57551"></span>Pompompurin said they were able to send themselves an email from eims@ic.fbi.gov by editing the request sent to their browser and changing the text in the message&#8217;s &#8220;Subject&#8221; field and &#8220;Text Content&#8221; fields.</p>
<div id="attachment_57559" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57559" loading="lazy" class=" wp-image-57559" src="media/bfd1a9c8.adhocemail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/adhocemail.png" alt="" width="752" height="425" /><p id="caption-attachment-57559" class="wp-caption-text">A test email using the FBI&#8217;s communications system that Pompompurin said they sent to a disposable address.</p></div>
<p>&#8220;Basically, when you requested the confirmation code [it] was generated client-side, then sent to you via a POST Request,&#8221; Pompompurin said. &#8220;This post request includes the parameters for the email subject and body content.&#8221;</p>
<p>Pompompurin said a simple script replaced those parameters with his own message subject and body, and automated the sending of the hoax message to thousands of email addresses.</p>
<div id="attachment_57555" style="width: 772px" class="wp-caption aligncenter"><a class="lightbox" href="media/e49cb13a.cjis-form.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/cjis-form.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-57555" loading="lazy" class="wp-image-57555" src="media/e49cb13a.cjis-form.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/cjis-form.png" alt="" width="762" height="320" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/cjis-form.png 1814w, https://krebsonsecurity.com/wp-content/uploads/2021/11/cjis-form-768x322.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/cjis-form-1536x644.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/11/cjis-form-782x328.png 782w" sizes="(max-width: 762px) 100vw, 762px" /></a><p id="caption-attachment-57555" class="wp-caption-text">A screenshot shared by Pompompurin, who says it shows how he was able to abuse the FBI&#8217;s email system to send a hoax message.</p></div>
<p>&#8220;Needless to say, this is a horrible thing to be seeing on any website,&#8221; Pompompurin said. &#8220;I&#8217;ve seen it a few times before, but never on a government website, let alone one managed by the FBI.&#8221;</p>
<p>As we can see from the first screenshot at the top of this story, Pompompurin&#8217;s hoax message is an attempt to smear the name of <strong>Vinny Troia</strong>, the founder of the dark web intelligence companies <strong>NightLion</strong> and <strong>Shadowbyte</strong>.</p>
<p>&#8220;Members of the RaidForums hacking community have a long standing feud with Troia, and commonly deface websites and perform minor hacks where they blame it on the security researcher,&#8221; <strong>Ionut Illascu</strong> <a href="https://www.bleepingcomputer.com/news/security/fbi-system-hacked-to-email-urgent-warning-about-fake-cyberattacks/" target="_blank" rel="noopener">wrote</a> for <em>BleepingComputer</em>. &#8220;Tweeting about this spam campaign, Vinny Troia <a href="https://twitter.com/vinnytroia/status/1459515619838251010" rel="noreferrer" data-ss1636833390="1">hinted</a> at someone known as &#8216;<a href="https://twitter.com/pompompur_in" rel="noreferrer" data-ss1636833390="1">pompompurin</a>,&#8217; as the likely author of the attack. Troia says the individual has been associated in the past with incidents aimed at damaging the security researcher’s reputation.&#8221;</p>
<p>Troia&#8217;s work as a security researcher was the subject of a 2018 article here titled, &#8220;<a href="https://krebsonsecurity.com/2018/10/when-security-researchers-pose-as-cybercrooks-who-can-tell-the-difference/" target="_blank" rel="noopener">When Security Researchers Pose as Cybercrooks, Who Can Tell the Difference?</a>&#8221; No doubt this hoax was another effort at blurring that distinction.</p>


feed_id: https://krebsonsecurity.com/?p=57598
title: Tech CEO Pleads to Wire Fraud in IP Address Scheme
uri: Tech-CEO-Pleads-to-Wire-Fraud-in-IP-Address-Scheme
url: https://krebsonsecurity.com/2021/11/tech-ceo-pleads-to-wire-fraud-in-ip-address-scheme/
content:
<p>The CEO of a South Carolina technology firm has pleaded guilty to 20 counts of wire fraud in connection with an elaborate network of phony companies set up to obtain more than 735,000 Internet Protocol (IP) addresses from the nonprofit organization that leases the digital real estate to entities in North America.</p>
<p><img loading="lazy" class="aligncenter wp-image-47720" src="media/c1899999.ips.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/ips.jpg" alt="" width="764" height="525" /></p>
<p>In 2018, the <strong>American Registry for Internet Numbers</strong> (ARIN), which oversees IP addresses assigned to entities in the U.S., Canada, and parts of the Caribbean, notified Charleston, S.C. based <strong>Micfo LLC</strong> that it intended to revoke 735,000 addresses.</p>
<p>ARIN said they wanted the addresses back because the company and its owner &#8212; 38-year-old <strong>Amir Golestan</strong> &#8212; had obtained them under false pretenses. A global <a href="https://en.wikipedia.org/wiki/IPv4_address_exhaustion" rel="noopener" target="_blank">shortage of IPv4 addresses</a> has massively driven up the price of these resources over the years: At the time of this dispute, a single IP address could fetch between $15 and $25 on the open market.</p>
<p>Micfo responded by suing ARIN to try to stop the IP address seizure. Ultimately, ARIN and Micfo settled the dispute in arbitration, with Micfo returning most of the addresses that it hadn&#8217;t already sold.</p>
<p>But the legal tussle caught the attention of <strong>South Carolina U.S. Attorney Sherri Lydon</strong>, who in May 2019 <a href="https://krebsonsecurity.com/2019/05/a-tough-week-for-ip-address-scammers/" target="_blank" rel="noopener">filed criminal wire fraud charges against Golestan</a>, alleging he&#8217;d orchestrated a network of shell companies and fake identities to prevent ARIN from knowing the addresses were all going to the same buyer.</p>
<p>Each of those shell companies involved the production of notarized affidavits in the names of people who didn&#8217;t exist. As a result, Lydon was able to charge Golestan with 20 counts of wire fraud &#8212; one for each payment made by the phony companies that bought the IP addresses from ARIN.</p>
<div id="attachment_48758" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-48758" loading="lazy" class=" wp-image-48758" src="media/b7b0003e.amirgolestan-image.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/amirgolestan-image.png" alt="" width="750" height="477" /><p id="caption-attachment-48758" class="wp-caption-text">Amir Golestan, CEO of Micfo.</p></div>
<p>On Nov. 16, just two days into his trial, Golestan changed his &#8220;not guilty&#8221; plea, agreeing to plead guilty to all 20 wire fraud charges. KrebsOnSecurity interviewed Golestan at length earlier this year, but he has not responded to requests for comment on his plea change.</p>
<p>By 2013, a number of Micfo&#8217;s customers had landed on the radar of <strong>Spamhaus</strong>, a group that many network operators rely upon to help block junk email. But shortly after Spamhaus began blocking many of Micfo&#8217;s IP address ranges, Micfo shifted gears and began reselling IP addresses mainly to companies marketing &#8220;virtual private networking&#8221; or VPN services that help customers hide their real IP addresses online.</p>
<p>In a 2020 interview, Golestan told KrebsOnSecurity that Micfo was at one point responsible for brokering roughly 40 percent of the IP addresses used by the world&#8217;s largest VPN providers. Throughout that conversation, Golestan maintained his innocence, even as he explained that the creation of the phony companies was necessary to prevent entities like Spamhaus from interfering with its business going forward.</p>
<p><strong>Stephen Ryan</strong>, an attorney representing ARIN, said Golestan changed his plea after the court heard from a former Micfo employee and public notary who described being instructed by Golestan to knowingly certify false documents.</p>
<p>&#8220;Her testimony made him appear bullying and unsavory,&#8221; Ryan said. &#8220;Because it turned out he had also sued her to try to prevent her from disclosing the actions he&#8217;d directed.&#8221;</p>
<p>Golestan&#8217;s <a href="media/0b29ebfe.golestanplea.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/golestanplea.pdf" target="_blank" rel="noopener">rather sparse plea agreement</a> (<a href="https://www.wsj.com/articles/executive-pleads-guilty-in-internet-address-fraud-case-11637101781" rel="noopener" target="_blank">first reported by The Wall Street Journal</a>) does not specify any sort of leniency he might gain from prosecutors for agreeing to end the trial prematurely. But it&#8217;s worth noting that a conviction on a single act of wire fraud can result in fines and up to 20 years in prison.<span id="more-57598"></span></p>
<p>The courtroom drama comes as ARIN&#8217;s counterpart in Africa is embroiled in a similar, albeit much larger dispute over millions of wayward African IP addresses. In July 2021, the <strong>African Network Information Centre</strong> (AFRINIC) <a href="https://mybroadband.co.za/news/internet/405640-internet-addresses-worth-r1-8-billion-seized.html" target="_blank" rel="noopener">confiscated more than six million IP addresses</a> from <strong>Cloud Innovation</strong>, a company incorporated in the African offshore entity haven of Seychelles (pronounced, quite aptly &#8212; &#8220;say shells&#8221;).</p>
<p><img loading="lazy" class="aligncenter wp-image-49907" src="media/866e714b.africa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/africa.png" alt="" width="764" height="422" /></p>
<p>AFRINIC revoked the addresses &#8212; valued at around USD $120 million &#8212; after an internal review found that most of them were being used outside of Africa by various entities in China and Hong Kong. Like ARIN, AFRINIC&#8217;s policies require those who are leasing IP addresses to demonstrate that the addresses are being used by entities within their geographic region.</p>
<p>But just weeks later, Cloud Innovation convinced a judge in AFRINIC&#8217;s home country of Mauritius <a href="https://mybroadband.co.za/news/internet/407770-afrinic-bank-accounts-frozen-after-r740-million-damages-claim.html" target="_blank" rel="noopener">to freeze $50 million in AFRINIC bank accounts</a>, <a href="https://cloudinnovation.org/press-release.html" target="_blank" rel="noopener">arguing</a> that AFRINIC had &#8220;acted in bad faith and upon frivolous grounds to tarnish the reputation of Cloud Innovation,&#8221; and that it was obligated to protect its customers from disruption of service.</p>
<p>That financial freeze has since been partially lifted, but the legal and financial wrangling between AFRINIC and Cloud Innovation continues. The company&#8217;s CEO is also suing the CEO and board chair of AFRINIC in an $80 million defamation case.</p>
<p><strong>Ron Guilmette </strong>is a security researcher who spent several years tracing how tens of millions of dollars worth of AFRINIC IP addresses were <a href="https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/" target="_blank" rel="noopener">privately sold to address brokers by a former AFRINIC executive</a>. Guilmette said Golestan&#8217;s guilty plea is a positive sign for AFRINIC, ARIN and the three other <a href="https://www.nro.net/about/rirs/" target="_blank" rel="noopener">Regional Internet Registries</a> (RIRs).</p>
<p>&#8220;It&#8217;s good news for the rule of law,&#8221; Guilmette said. &#8220;It has implications for the AFRINIC case because it reaffirms the authority of all RIRs, including AFRINIC and ARIN.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=57594
title: The ‘Zelle Fraud’ Scam: How it Works, How to Fight Back
uri: The-Zelle-Fraud-Scam-How-it-Works-How-to-Fight-Back
url: https://krebsonsecurity.com/2021/11/the-zelle-fraud-scam-how-it-works-how-to-fight-back/
content:
<p>One of the more common ways cybercriminals cash out access to bank accounts involves draining the victim&#8217;s funds via<strong> Zelle</strong>, a &#8220;peer-to-peer&#8221; (P2P) payment service used by many financial institutions that allows customers to quickly send cash to friends and family. Naturally, a great deal of phishing schemes that precede these bank account takeovers begin with a spoofed text message from the target&#8217;s bank warning about a suspicious Zelle transfer. What follows is a deep dive into how this increasingly clever Zelle fraud scam typically works, and what victims can do about it.</p>
<p><a href="https://krebsonsecurity.com/2021/11/sms-about-bank-fraud-as-a-pretext-for-voice-phishing/" target="_blank" rel="noopener">Last week&#8217;s story</a> warned that scammers are blasting out text messages about suspicious bank transfers as a pretext for immediately calling and scamming anyone who responds via text. Here&#8217;s what one of those scam messages looks like:</p>
<p><img loading="lazy" class="aligncenter wp-image-57519" src="media/7dbc5007.zelletext.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext.png" alt="" width="761" height="414" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext.png 1244w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-768x418.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-782x426.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/11/zelletext-370x200.png 370w" sizes="(max-width: 761px) 100vw, 761px" /></p>
<p>Anyone who responds &#8220;yes,&#8221; &#8220;no&#8221; or at all will very soon after receive a phone call from a scammer pretending to be from the financial institution&#8217;s fraud department. The caller&#8217;s number will be spoofed so that it appears to be coming from the victim&#8217;s bank.</p>
<p>To verify the identity of the customer, the fraudster asks for their online banking username, and then tells the customer to read back a passcode sent via text or email. In reality, the fraudster initiates a transaction &#8212; such as the &#8220;forgot password&#8221; feature on the financial institution&#8217;s site &#8212; which is what generates the 2-step authentication passcode delivered to the member.</p>
<p><strong>Ken Otsuka </strong>is a senior risk consultant at <strong>CUNA Mutual Group</strong>, an insurance company that provides financial services to credit unions. Otsuka said a phone fraudster typically will say something like, &#8220;Before I get into the details, I need to verify that I&#8217;m speaking to the right person. What&#8217;s your username?&#8221;</p>
<p>&#8220;In the background, they&#8217;re using the username with the forgot password feature, and that&#8217;s going to generate one of these two-factor authentication passcodes,&#8221; Otsuka said. &#8220;Then the fraudster will say, &#8216;I&#8217;m going to send you the password and you&#8217;re going to read it back to me over the phone.'&#8221;</p>
<p><img loading="lazy" class="alignright size-full wp-image-16248" src="media/9836de0f.phonefraud.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2012/08/phonefraud.jpg" alt="" width="283" height="424" srcset="https://krebsonsecurity.com/wp-content/uploads/2012/08/phonefraud.jpg 283w, https://krebsonsecurity.com/wp-content/uploads/2012/08/phonefraud-266x400.jpg 266w" sizes="(max-width: 283px) 100vw, 283px" />The fraudster then uses the code to complete the password reset process, and then changes the victim&#8217;s online banking password. The fraudster then uses Zelle to transfer the victim&#8217;s funds to others.</p>
<p>An important aspect of this scam is that <em>the fraudsters never even need to know or phish the victim&#8217;s password</em>. By sharing their username and reading back the one-time code sent to them via email, the victim is allowing the fraudster to reset their online banking password.</p>
<p>Otsuka said in far too many account takeover cases, the victim has never even heard of Zelle, nor did they realize they could move money that way.</p>
<p>&#8220;The thing is, many credit unions offer it by default as part of online banking,&#8221; Otsuka said. &#8220;Members don&#8217;t have to request to use Zelle. It&#8217;s just there, and with a lot of members targeted in these scams, although they&#8217;d legitimately enrolled in online banking, they&#8217;d never used Zelle before.&#8221; [Curious if your financial institution uses Zelle? Check out their partner list <a href="https://www.zellepay.com/get-started" target="_blank" rel="noopener">here</a>].</p>
<p>Otsuka said credit unions offering other peer-to-peer banking products have also been targeted, but that fraudsters prefer to target Zelle due to the speed of the payments.</p>
<p>&#8220;The fraud losses can escalate quickly due to the sheer number of members that can be targeted on a single day over the course of consecutive days,&#8221; Otsuka said.</p>
<p>To combat this scam Zelle introduced out-of-band authentication with transaction details. This involves sending the member a text containing the details of a Zelle transfer &#8211; payee and dollar amount – that is initiated by the member. The member must authorize the transfer by replying to the text.</p>
<p>Unfortunately, Otsuka said, the scammers are defeating this layered security control as well.<span id="more-57594"></span></p>
<p>&#8220;The fraudsters follow the same tactics except they may keep the members on the phone after getting their username and 2-step authentication passcode to login to the accounts,&#8221; he said. &#8220;The fraudster tells the member they will receive a text containing details of a Zelle transfer and the member must authorize the transaction under the guise that it is for reversing the fraudulent debit card transaction(s).&#8221;</p>
<p>In this scenario, the fraudster actually enters a Zelle transfer that triggers the following text to the member, which the member is asked to authorize: For example:</p>
<blockquote><p>&#8220;Send $200 Zelle payment to Boris Badenov? Reply YES to send, NO to cancel. ABC Credit Union . STOP to end all messages.&#8221;</p></blockquote>
<p>&#8220;My team has consulted with several credit unions that rolled Zelle out or our planning to introduce Zelle,&#8221; Otsuka said. &#8220;We found that several credit unions were hit with the scam the same month they rolled it out.&#8221;</p>
<p>The upshot of all this is that many financial institutions will claim they&#8217;re not required to reimburse the customer for financial losses related to these voice phishing schemes. <strong>Bob Sullivan</strong>, a veteran journalist who writes about fraud and consumer issues, says in many cases banks are giving customers incorrect and self-serving opinions after the thefts.</p>
<p>&#8220;Consumers &#8212; many who never ever realized they had a Zelle account &#8211; then call their banks, expecting they&#8217;ll be covered by credit-card-like protections, only to face disappointment and in some cases, financial ruin,&#8221; Sullivan <a href="https://bobsullivan.net/cybercrime/zelle-hackers-improve-their-scam-banks-wont-help-but-victim-have-new-place-to-complain/" target="_blank" rel="noopener">wrote</a> in a recent Substack post. &#8220;Consumers who suffer unauthorized transactions are entitled to Regulation E protection, and banks are required to refund the stolen money. This isn’t a controversial opinion, and it was <a href="https://www.consumerfinance.gov/compliance/compliance-resources/deposit-accounts-resources/electronic-fund-transfers/electronic-fund-transfers-faqs/" target="_blank" rel="noopener">recently affirmed by the CFPB here</a>. If you are reading this story and fighting with your bank, start by providing that link to the financial institution.&#8221;</p>
<p>&#8220;If a criminal initiates a Zelle transfer — even if the criminal manipulates a victim into sharing login credentials — that fraud is covered by Regulation E, and banks should restore the stolen funds,&#8221; Sullivan said. &#8220;If a consumer initiates the transfer under false pretenses, the case for redress is more weak.&#8221;</p>
<p>Sullivan notes that the <strong>Consumer Financial Protection Bureau</strong> (CFPB) recently announced it was <a href="https://www.consumerfinance.gov/about-us/newsroom/cfpb-orders-tech-giants-to-turn-over-information-on-their-payment-system-plans/" target="_blank" rel="noopener">conducting a probe</a> into companies operating payments systems in the United States, with a special focus on platforms that offer fast, person-to-person payments.</p>
<p>&#8220;Consumers expect certain assurances when dealing with companies that move their money,&#8221; the CFPB said in its Oct. 21 notice. &#8220;They expect to be protected from fraud and payments made in error, for their data and privacy to be protected and not shared without their consent, to have responsive customer service, and to be treated equally under relevant law. The orders seek to understand the robustness with which payment platforms prioritize consumer protection under law.&#8221;</p>
<p>Anyone interested in letting the CFPB know about a fraud scam that abused a P2P payment platform like Zelle, Cashapp, or Venmo, for example, should send an email describing the incident to BigTechPaymentsInquiry@cfpb.gov. Be sure to include Docket No. CFPB-2021-0017 in the subject line of the message.</p>
<p>In the meantime, remember the mantra: <a href="https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/" target="_blank" rel="noopener">Hang up, Look Up, and Call Back</a>. If you receive a call from someone warning about fraud, hang up. If you believe the call might be legitimate, look up the number of the organization supposedly calling you, and call them back.</p>


feed_id: https://krebsonsecurity.com/?p=57657
title: Arrest in ‘Ransom Your Employer’ Email Scheme
uri: Arrest-in-Ransom-Your-Employer-Email-Scheme
url: https://krebsonsecurity.com/2021/11/arrest-in-ransom-your-employer-email-scheme/
content:
<p>In August, KrebsOnSecurity <a href="https://krebsonsecurity.com/2021/08/wanted-disgruntled-employees-to-deploy-ransomware/" target="_blank" rel="noopener">warned</a> that scammers were contacting people and asking them to unleash ransomware inside their employer&#8217;s network, in exchange for a percentage of any ransom amount paid by the victim company. This week, authorities in Nigeria arrested a suspect in connection with the scheme &#8212; a young man who said he was trying to save up money to help fund a new social network.</p>
<div id="attachment_56671" style="width: 766px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56671" loading="lazy" class=" wp-image-56671" src="media/5fad735b.madalin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/madalin.png" alt="" width="756" height="302" /><p id="caption-attachment-56671" class="wp-caption-text">Image: Abnormal Security.</p></div>
<p>The brazen approach targeting disgruntled employees was first spotted by threat intelligence firm <strong>Abnormal Security</strong>, which <a href="https://abnormalsecurity.com/blog/nigerian-ransomware-soliciting-employees-demonware/" target="_blank" rel="noopener">described</a> what happened after they adopted a fake persona and responded to the proposal in the screenshot above.</p>
<p>&#8220;According to this actor, he had originally intended to send his targets—all senior-level executives—phishing emails to compromise their accounts, but after that was unsuccessful, he pivoted to this ransomware pretext,&#8221; Abnormal&#8217;s <strong>Crane Hassold</strong> wrote.</p>
<p>Abnormal Security documented how it tied the email back to a Nigerian man who acknowledged he was trying to save up money to help fund a new social network he is building called <strong>Sociogram</strong>. In June 2021, the Nigerian government officially <a href="https://www.washingtonpost.com/world/2021/06/04/nigeria-suspends-twitter-buhari/" target="_blank" rel="noopener">placed an indefinite ban on Twitter</a>, restricting it from operating in Nigeria after the social media platform deleted tweets by the Nigerian president.</p>
<p>Reached via LinkedIn, Sociogram founder <a href="https://www.linkedin.com/in/oluwameda/" target="_blank" rel="noopener">Oluwaseun Medayedupin</a> asked to have his startup’s name removed from the story, although he did not respond to questions about whether there were any inaccuracies in Hassold’s report.</p>
<p>“Please don’t harm Sociogram’s reputation,” Medayedupin pleaded. “I beg you as a promising young man.”</p>
<p>After he deleted his LinkedIn profile, I received the following message through the &#8220;contact this domain holder&#8221; link at KrebsOnSecurity&#8217;s domain registrar [curiously, the date of that missive reads &#8220;Dec. 31, 1969.&#8221;]. Apparently, Mr. Krebson is a clout-chasing monger.</p>
<div id="attachment_57663" style="width: 766px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57663" loading="lazy" class=" wp-image-57663" src="media/5737a0d5.sociogramgram.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/sociogramgram.png" alt="" width="756" height="484" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/sociogramgram.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/11/sociogramgram-768x492.png 768w" sizes="(max-width: 756px) 100vw, 756px" /><p id="caption-attachment-57663" class="wp-caption-text">A love letter from the founder of the ill-fated Sociogram.</p></div>
<p>Mr. Krebson also heard from an investigator representing the Nigeria Finance CERT on behalf of the Central Bank Of Nigeria. While the Sociogram founder&#8217;s approach might seem amateurish to some, the financial community in Nigeria did not consider it a laughing matter.</p>
<p>On Friday, police in Lagos arrested Medayedupin. The investigator says formal charges will be levied against the defendant sometime this week.</p>

<a href='https://krebsonsecurity.com/nigfincert/'><img width="64" height="96" src="media/94172a46.nigfincert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/nigfincert.png" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /></a>
<a href='https://krebsonsecurity.com/2021/11/arrest-in-ransom-your-employer-email-scheme/medayepupin/'><img width="79" height="96" src="media/c87a7ce4.medayepupin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/medayepupin.png" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" /></a>
<a href='https://krebsonsecurity.com/2021/11/arrest-in-ransom-your-employer-email-scheme/mdell/'><img width="121" height="96" src="media/764196e5.mdell.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/mdell.png" class="attachment-thumbnail size-thumbnail" alt="" loading="lazy" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/mdell.png 896w, https://krebsonsecurity.com/wp-content/uploads/2021/11/mdell-768x607.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/mdell-782x618.png 782w" sizes="(max-width: 121px) 100vw, 121px" /></a>

<p>KrebsOnSecurity spoke with a fraud investigator who is performing the forensic analysis of the devices seized from Medayedupin&#8217;s home. The investigator spoke on condition of anonymity out of concern for his physical safety.</p>
<p>The investigator &#8212; we&#8217;ll call him &#8220;George&#8221; &#8212; said the 23-year-old Medayedupin lives with his extended family in an extremely impoverished home, and that the young man told investigators he&#8217;d just graduated from college but turned to cybercrime at first with ambitions of merely scamming the scammers.</p>
<p>George&#8217;s team confirmed that Medayedupin had around USD $2,000 to his name, which he&#8217;d recently stolen from a group of Nigerian fraudsters who were scamming people for gift cards. Apparently, he admitted to creating a phishing website that tricked a member of this group into providing access to the money they&#8217;d made from their scams.</p>
<p>Medayedupin reportedly told investigators that for almost a week after he started emailing his ransom-your-employer scheme, nobody took him up on the offer. But after his name appeared in the news media, <em>he received thousands of inquiries from people interested in his idea</em>.<span id="more-57657"></span></p>
<p>George described Medayedupin as smart, a quick learner, and fairly dedicated to his work.</p>
<p>&#8220;He seems like he could be a fantastic [employee] for a company,&#8221; George said. &#8220;But there is no employment here, so he chose to do this.&#8221;</p>
<p>What&#8217;s interesting about this case &#8212; and indeed likely why anyone thought this guy worthy of arrest &#8212; is that the Nigerian authorities were fairly swift to take action when a domestic cybercriminal raised the specter of causing financial losses for its own banks.</p>
<p>After all, the majority of the cybercrime that originates from Africa &#8212; think romance scams, <a href="https://krebsonsecurity.com/tag/bec-scams/" target="_blank" rel="noopener">BEC fraud</a>, and <a href="https://krebsonsecurity.com/tag/unemployment-insurance-fraud/" target="_blank" rel="noopener">unemployment/pandemic loan fraud</a> &#8212; does not target Nigerian citizens, nor does it harm African banks. On the contrary: This activity pumps a great deal of Western money into Nigeria.</p>
<p>How much money are we talking about? The financial losses from these scams dwarf other fraud categories &#8212; such as identity theft or credit card fraud. According to the FBI&#8217;s Internet Crime Complaint Center (<a href="https://www.ic3.gov" target="_blank" rel="noopener">IC3</a>), consumers and businesses <a href="media/18ed2453.2020_IC3Report.pdf" data-original-source="https://www.ic3.gov/Media/PDF/AnnualReport/2020_IC3Report.pdf" target="_blank" rel="noopener">reported</a> more than $4.2 billion in losses tied to cybercrime in 2020, and BEC fraud and romance scams alone accounted for nearly 60 percent of those losses.</p>
<div id="attachment_57679" style="width: 687px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57679" loading="lazy" class="size-full wp-image-57679" src="media/378fba05.fbi-ic3-losses2020.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/fbi-ic3-losses2020.png" alt="" width="677" height="446" /><p id="caption-attachment-57679" class="wp-caption-text">Source: FBI/IC3 2020 Internet Crime Report.</p></div>
<p>If the influx of a few billion US dollars into the Nigerian economy each year from cybercrime seems somehow insignificant, consider that (according to George) the average police officer in the country makes the equivalent of less than USD $100 a month.</p>
<p><strong>Ronnie Tokazowski </strong>is a threat researcher at <strong>Agari</strong>, a security firm that has closely tracked many of the groups behind BEC scams. Tokazowski maintains he has been one of the more vocal proponents of the idea that trying to fight these problems by arresting those involved is something of a Sisyphean task, and that it makes way more sense to focus on changing the economic realities in places like Nigeria.</p>
<p>Nigeria has the world’s second-highest unemployment rate — rising from 27.1 percent in 2019 to 33 percent in 2020, according to the <strong>National Bureau of Statistics</strong>. The nation also is among the world’s most corrupt, according to 2020 findings from<strong> Transparency International</strong>.</p>
<p>&#8220;Education is definitely one piece, as raising awareness is hands down the best way to get ahead of this,” Tokazowski said, in <a href="https://krebsonsecurity.com/2021/06/we-infiltrated-a-counterfeit-check-ring-now-what/" target="_blank" rel="noopener">a June 2021 interview</a>. &#8220;But we also need to think about ways to create more business opportunities there so that people who are doing this to put food on the table have more legitimate opportunities. Unfortunately, thanks to the level of corruption of government officials, there are a lot of cultural reasons that fighting this type of crime at the source is going to be difficult.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=57596
title: The Internet is Held Together With Spit & Baling Wire
uri: The-Internet-is-Held-Together-With-Spit-Baling-Wire
url: https://krebsonsecurity.com/2021/11/the-internet-is-held-together-with-spit-baling-wire/
content:
<div id="attachment_57711" style="width: 925px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57711" loading="lazy" class="size-full wp-image-57711" src="media/801d4027.blyon-netmap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/blyon-netmap.png" alt="" width="915" height="704" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/blyon-netmap.png 915w, https://krebsonsecurity.com/wp-content/uploads/2021/11/blyon-netmap-768x591.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/blyon-netmap-782x602.png 782w" sizes="(max-width: 915px) 100vw, 915px" /><p id="caption-attachment-57711" class="wp-caption-text">A visualization of the Internet made using network routing data. Image: Barrett Lyon, opte.org.</p></div>
<p>Imagine being able to disconnect or redirect Internet traffic destined for some of the world&#8217;s biggest companies &#8212; just by spoofing an email. This is the nature of a threat vector recently removed by a Fortune 500 firm that operates one of the largest Internet backbones.</p>
<p>Based in Monroe, La., <strong>Lumen Technologies Inc.</strong> [<a href="https://www.google.com/finance/quote/LUMN:NYSE" target="_blank" rel="noopener">NYSE: LUMN</a>] (formerly <strong>CenturyLink</strong>) is one of more than two dozen entities that operate what&#8217;s known as an <a href="http://www.irr.net/docs/list.html" target="_blank" rel="noopener">Internet Routing Registry</a> (IRR). These IRRs maintain routing databases used by network operators to register their assigned network resources &#8212; i.e., the Internet addresses that have been allocated to their organization.</p>
<p>The data maintained by the IRRs help keep track of which organizations have the right to access what Internet address space in the global routing system. Collectively, the information voluntarily submitted to the IRRs forms a distributed database of Internet routing instructions that helps connect a vast array of individual networks.</p>
<p>There are about 70,000 distinct networks on the Internet today, ranging from huge broadband providers like <strong>AT&amp;T</strong>, <strong>Comcast</strong> and <strong>Verizon</strong> to many thousands of enterprises that connect to the edge of the Internet for access. Each of these so-called &#8220;Autonomous Systems&#8221; (ASes) make their own decisions about how and with whom they will connect to the larger Internet.</p>
<p>Regardless of how they get online, each AS uses the same language to specify which Internet IP address ranges they control: It&#8217;s called the <strong>Border Gateway Protocol</strong>, or BGP. Using BGP, an AS tells its directly connected neighbor AS(es) the addresses that it can reach. That neighbor in turn passes the information on to its neighbors, and so on, until the information has propagated everywhere [1].</p>
<p>A key function of the BGP data maintained by IRRs is preventing rogue network operators from claiming another network&#8217;s addresses and hijacking their traffic. In essence, an organization can use IRRs to declare to the rest of the Internet, &#8220;These specific Internet address ranges are ours, should only originate from our network, and you should ignore any other networks trying to lay claim to these address ranges.&#8221;</p>
<p>In the early days of the Internet, when organizations wanted to update their records with an IRR, the changes usually involved some amount of human interaction &#8212; often someone manually editing the new coordinates into an Internet backbone router. But over the years the various IRRs made it easier to automate this process via email.</p>
<p>For a long time, any changes to an organization&#8217;s routing information with an IRR could be processed via email as long as one of the following authentication methods was successfully used:</p>
<blockquote><p><strong>-CRYPT-PW:</strong> A password is added to the text of an email to the IRR containing the record they wish to add, change or delete (the IRR then compares that password to a hash of the password);</p>
<p><strong>-PGPKEY:</strong> The requestor signs the email containing the update with an encryption key the IRR recognizes;</p>
<p><strong>-MAIL-FROM:</strong> The requestor sends the record changes in an email to the IRR, and the authentication is based solely on the &#8220;From:&#8221; header of the email.</p></blockquote>
<p>Of these, MAIL-FROM has long been considered insecure, for the simple reason that it&#8217;s not difficult to spoof the return address of an email. And virtually all IRRs have disallowed its use since at least 2012, said <strong>Adam Korab</strong>, a network engineer and security researcher based in Houston.</p>
<p>All except <strong>Level3</strong>, a major Internet backbone provider acquired by Lumen/CenturyLink.</p>
<p>&#8220;LEVEL3 is the last IRR operator which allows the use of this method, although they have discouraged its use since at least 2012,&#8221; Korab told KrebsOnSecurity. &#8220;Other IRR operators have fully deprecated MAIL-FROM.&#8221;</p>
<p>Importantly, the name and email address of each Autonomous System&#8217;s official contact for making updates with the IRRs is public information.</p>
<p>Korab filed a vulnerability report with Lumen demonstrating how a simple spoofed email could be used to disrupt Internet service for banks, telecommunications firms and even government entities.</p>
<p><span class="pullquote pqright">&#8220;If such an attack were successful, it would result in customer IP address blocks being filtered and dropped, making them unreachable from some or all of the global Internet,&#8221; Korab said</span>, noting that he found more than 2,000 Lumen customers were potentially affected. &#8220;This would effectively cut off Internet access for the impacted IP address blocks.&#8221;</p>
<p>The recent outage that took <strong>Facebook</strong>, <strong>Instagram</strong> and <strong>WhatsApp</strong> offline for the better part of a day was caused by <a href="https://krebsonsecurity.com/2021/10/what-happened-to-facebook-instagram-whatsapp/" target="_blank" rel="noopener">an erroneous BGP update submitted by Facebook</a>. That update took away the map telling the world&#8217;s computers how to find its various online properties.</p>
<p>Now consider the mayhem that would ensue if someone spoofed IRR updates to remove or alter routing entries for multiple e-commerce providers, banks and telecommunications companies at the same time.</p>
<p>&#8220;Depending on the scope of an attack, this could impact individual customers, geographic market areas, or potentially the [Lumen] backbone,&#8221; Korab continued. &#8220;This attack is trivial to exploit, and has a difficult recovery. Our conjecture is that any impacted Lumen or customer IP address blocks would be offline for 24-48 hours. In the worst-case scenario, this could extend much longer.&#8221;</p>
<p>Lumen told KrebsOnSecurity that it continued offering MAIL-FROM: authentication because many of its customers still relied on it due to legacy systems. Nevertheless, after receiving Korab&#8217;s report the company decided the wisest course of action was to disable MAIL-FROM: authentication altogether.</p>
<p>&#8220;We recently received notice of a known insecure configuration with our Route Registry,&#8221; reads a statement Lumen shared with KrebsOnSecurity. &#8220;We already had mitigating controls in place and to date we have not identified any additional issues. As part of our normal cybersecurity protocol, we carefully considered this notice and took steps to further mitigate any potential risks the vulnerability may have created for our customers or systems.&#8221;</p>
<div id="attachment_57733" style="width: 773px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57733" loading="lazy" class=" wp-image-57733" src="media/09bc8de5.level3-mailfrom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/11/level3-mailfrom.png" alt="" width="763" height="315" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/11/level3-mailfrom.png 1306w, https://krebsonsecurity.com/wp-content/uploads/2021/11/level3-mailfrom-768x317.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/11/level3-mailfrom-782x323.png 782w" sizes="(max-width: 763px) 100vw, 763px" /><p id="caption-attachment-57733" class="wp-caption-text">Level3, now part of Lumen, has long urged customers to avoid using &#8220;Mail From&#8221; for authentication, but until very recently they still allowed it.</p></div>
<p><span id="more-57596"></span></p>
<p><strong>KC Claffy </strong>is the founder and director of the <a href="https://www.caida.org" target="_blank" rel="noopener">Center for Applied Internet Data Analysis</a> (CAIDA), and a resident research scientist of the San Diego Supercomputer Center at the University of California, San Diego. Claffy said there is scant public evidence of a threat actor using the weakness now fixed by Lumen to hijack Internet routes.</p>
<p>&#8220;People often don&#8217;t notice, and a malicious actor certainly works to achieve this,&#8221; Claffy said in an email to KrebsOnSecurity. &#8220;But also, if a victim does notice, they generally aren&#8217;t going to release details that they&#8217;ve been hijacked. This is why we need mandatory reporting of such breaches, as <a href="https://en.wikipedia.org/wiki/Dan_Geer" target="_blank" rel="noopener">Dan Geer</a> <a href="http://geer.tinho.net/geer.blackhat.6viii14.txt" target="_blank" rel="noopener">has been saying for years</a>.&#8221;</p>
<p>But there are <a href="https://krebsonsecurity.com/2018/07/notorious-hijack-factory-shunned-from-web/" target="_blank" rel="noopener">plenty of</a> <a href="https://krebsonsecurity.com/2011/02/spammers-hijack-internet-space-assigned-to-egyptian-presidents-wife/" target="_blank" rel="noopener">examples</a> of cybercriminals hijacking IP address blocks after a domain name associated with an email address in an IRR record has expired. In those cases, the thieves simply register the expired domain and then send email from it to an IRR specifying any route changes.</p>
<p>While it&#8217;s nice that Lumen is no longer the weakest link in the IRR chain, the remaining authentication mechanisms aren&#8217;t great. Claffy said after years of debate over approaches to improving routing security, the operator community deployed an alternative known as the <a href="https://en.wikipedia.org/wiki/Resource_Public_Key_Infrastructure" target="_blank" rel="noopener">Resource Public Key Infrastructure</a> (RPKI).</p>
<p>&#8220;The RPKI includes cryptographic attestation of records, including expiration dates, with each Regional Internet Registry (RIR) operating as a &#8216;root&#8217; of trust,&#8221; wrote Claffy and two other UC San Diego researchers in a paper that is still undergoing peer review. &#8220;Similar to the IRR, operators can use the RPKI to discard routing messages that do not pass origin validation checks.&#8221;</p>
<p>However, the additional integrity RPKI brings also comes with a fair amount of added complexity and cost, the researchers found.</p>
<p>&#8220;Operational and <a href="https://scholarship.law.upenn.edu/cgi/viewcontent.cgi?article=3037&amp;context=faculty_scholarship" target="_blank" rel="noopener">legal implications of potential malfunctions</a> have limited registration in and use of the RPKI,&#8221; the study observed (link added). &#8220;In response, some networks have redoubled their efforts to improve the accuracy of IRR registration data. These two technologies are now operating in parallel, along with the option of doing nothing at all to validate routes.&#8221;</p>
<p>[1]: I borrowed some descriptive text in the 5th and 6th paragraphs from a CAIDA/UCSD draft paper &#8212; <a href="media/d8b3a68f.irr_hygiene_rpki_era.pdf" data-original-source="https://www.caida.org/catalog/papers/2021_irr_hygiene_rpki_era/irr_hygiene_rpki_era.pdf" target="_blank" rel="noopener">IRR Hygiene in the RPKI Era</a> (PDF).</p>
<p>Further reading:</p>
<p><a href="media/707a8875.trust_zones_jip.pdf" data-original-source="https://www.caida.org/catalog/papers/2021_trust_zones_jip/trust_zones_jip.pdf" target="_blank" rel="noopener">Trust Zones: A Path to a More Secure Internet Infrastructure</a> (PDF).</p>
<p><a href="media/a3a52ce0.BGPhist.pdf" data-original-source="https://people.csail.mit.edu/ctestart/publications/BGPhist.pdf" target="_blank" rel="noopener">Reviewing a historical Internet vulnerability: Why isn’t BGP more secure and what can we do about it?</a> (PDF)</p>


feed_id: https://krebsonsecurity.com/?p=57755
title: Ubiquiti Developer Charged With Extortion, Causing 2020 “Breach”
uri: Ubiquiti-Developer-Charged-With-Extortion-Causing-2020-Breach
url: https://krebsonsecurity.com/2021/12/ubiquiti-developer-charged-with-extortion-causing-2020-breach/
content:
<p>In January 2021, technology vendor <strong><a href="https://www.ui.com/" target="_blank" rel="noopener">Ubiquiti Inc.</a></strong> [NYSE:UI] disclosed that a breach at a third party cloud provider had exposed customer account credentials. In March, a Ubiquiti employee <a href="https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-catastrophic/" target="_blank" rel="noopener">warned</a> that the company had drastically understated the scope of the incident, and that the third-party cloud provider claim was a fabrication. On Wednesday, a former Ubiquiti developer was arrested and charged with stealing data and trying to extort his employer while pretending to be a whistleblower.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-55018" src="media/0e5b7197.ubiquiti.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/03/ubiquiti.png" alt="" width="519" height="145" /></p>
<p>Federal prosecutors say <strong>Nickolas Sharp</strong>, a senior developer at Ubiquiti, actually caused the &#8220;breach&#8221; that forced Ubiquiti to disclose a cybersecurity incident in January. They allege that in late December 2020, Sharp applied for a job at another technology company, and then abused his privileged access to Ubiquiti&#8217;s systems at Amazon&#8217;s AWS cloud service and the company&#8217;s GitHub accounts to download large amounts of proprietary data.</p>
<p>Sharp&#8217;s indictment doesn&#8217;t specify how much data he allegedly downloaded, but it says some of the downloads took hours, and that he cloned approximately 155 Ubiquiti data repositories via multiple downloads over nearly two weeks.</p>
<p>On Dec. 28, other Ubiquiti employees spotted the unusual downloads, which had leveraged internal company credentials and a <strong>Surfshark VPN</strong> connection to hide the downloader&#8217;s true Internet address. Assuming an external attacker had breached its security, Ubiquiti quickly launched an investigation.</p>
<p>But Sharp was a member of the team doing the forensic investigation, the indictment alleges.</p>
<p>&#8220;At the time the defendant was part of a team working to assess the scope and damage caused by the incident and remediate its effects, all while concealing his role in committing the incident,&#8221; wrote prosecutors with the Southern District of New York.</p>
<p>According to the indictment, on January 7 a senior Ubiquiti employee received a ransom email. The message was sent through an IP address associated with the same Surfshark VPN. The ransom message warned that internal Ubiquiti data had been stolen, and that the information would not be used or published online as long as Ubiquiti agreed to pay 25 Bitcoin.</p>
<p>The ransom email also offered to identify a purportedly still unblocked &#8220;backdoor&#8221; used by the attacker for the sum of another 25 Bitcoin (the total amount requested was equivalent to approximately $1.9 million at the time). Ubiquiti did not pay the ransom demands.</p>
<p>Investigators say they were able to tie the downloads to Sharp and his work-issued laptop because his Internet connection briefly failed on several occasions while he was downloading the Ubiquiti data. Those outages were enough to prevent Sharp&#8217;s Surfshark VPN connection from functioning properly &#8212; thus exposing his Internet address as the source of the downloads. <span id="more-57755"></span></p>
<p>When FBI agents raided Sharp&#8217;s residence on Mar. 24, he reportedly maintained his innocence and told agents someone else must have used his Paypal account to purchase the Surfshark VPN subscription.</p>
<p>Several days after the FBI executed its search warrant, Sharp &#8220;caused false or misleading news stories to be published about the incident,&#8221; prosecutors say. Among the claims made in those news stories was that Ubiquiti had neglected to keep access logs that would allow the company to understand the full scope of the intrusion. In reality, the indictment alleges, Sharp had shortened to one day the amount of time Ubiquiti&#8217;s systems kept certain logs of user activity in AWS.</p>
<p>&#8220;Following the publication of these articles, between Tuesday, March 30, 2021 and Wednesday March 31, [Ubiquiti&#8217;s] stock price fell approximately 20 percent, losing over four billion dollars in market capitalization,&#8221; the indictment states.</p>
<p>Sharp faces four criminal counts, including wire fraud, intentionally damaging protected computers, transmission of interstate communications with intent to extort, and making false statements to the FBI.</p>
<p>News of Sharp&#8217;s arrest was first reported by <a href="https://www.bleepingcomputer.com/news/security/former-ubiquiti-dev-charged-for-trying-to-extort-his-employer/" target="_blank" rel="noopener">BleepingComputer</a>, which wrote that while the Justice Department didn&#8217;t name Sharp&#8217;s employer in its press release or indictment, all of the details align with previous reporting on the Ubiquiti incident and information presented in <a href="https://www.linkedin.com/in/nickolassharp" target="_blank" rel="noopener noreferrer" data-ss1638417087="1">Sharp&#8217;s LinkedIn account</a>. A link to the indictment is <a href="https://www.justice.gov/usao-sdny/press-release/file/1452706/download" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=57745
title: Who Is the Network Access Broker ‘Babam’?
uri: Who-Is-the-Network-Access-Broker-Babam
url: https://krebsonsecurity.com/2021/12/who-is-the-network-access-broker-babam/
content:
<p>Rarely do cybercriminal gangs that deploy ransomware gain the initial access to the target themselves. More commonly, that access is purchased from a cybercriminal broker who specializes in acquiring remote access credentials &#8212; such as usernames and passwords needed to remotely connect to the target&#8217;s network. In this post we&#8217;ll look at the clues left behind by &#8220;<strong>Babam</strong>,&#8221; the handle chosen by a cybercriminal who has sold such access to ransomware groups on many occasions over the past few years.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-53514" src="media/0df06f89.ransomware.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png" alt="" width="1016" height="761" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware.png 1016w, https://krebsonsecurity.com/wp-content/uploads/2020/11/ransomware-768x575.png 768w" sizes="(max-width: 1016px) 100vw, 1016px" /></p>
<p>Since the beginning of 2020, Babam has set up numerous auctions on the Russian-language cybercrime forum <strong>Exploit</strong>, mainly selling virtual private networking (VPN) credentials stolen from various companies. Babam has authored more than 270 posts since joining Exploit in 2015, including dozens of sales threads. However, none of Babam&#8217;s posts on Exploit include any personal information or clues about his identity.</p>
<p>But in February 2016, Babam joined <strong>Verified</strong>, another Russian-language crime forum. Verified was hacked at least twice in the past five years, and its user database posted online. That information shows that Babam joined Verified using the email address &#8220;<strong>operns@gmail.com</strong>.&#8221; The latest Verified leak also exposed private messages exchanged by forum members, including more than 800 private messages that Babam sent or received on the forum over the years.</p>
<p>In early 2017, Babam confided to another Verified user via private message that he is from Lithuania. In virtually all of his forum posts and private messages, Babam can be seen communicating in transliterated Russian rather than by using the Cyrillic alphabet. This is common among cybercriminal actors for whom Russian is not their native tongue.</p>
<p>Cyber intelligence platform <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> told KrebsOnSecurity that the operns@gmail.com address was used in 2016 to register an account at <strong>filmai.in</strong>, which is a movie streaming service catering to Lithuanian speakers. The username associated with that account was &#8220;<strong>bo3dom</strong>.&#8221;</p>
<p>A reverse WHOIS search via <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> says operns@gmail.com was used to register two domain names: bonnjoeder[.]com back in 2011, and sanjulianhotels[.]com (2017). It&#8217;s unclear whether these domains ever were online, but the street address on both records was &#8220;<strong>24 Brondeg St.</strong>&#8221; in the United Kingdom. [Full disclosure: DomainTools is a frequent advertiser on this website.]</p>
<p>A reverse search at DomainTools on &#8220;24 Brondeg St.&#8221; reveals one other domain: <strong>wwwecardone[.]com</strong>. The use of domains that begin with &#8220;www&#8221; is fairly common among phishers, and by passive &#8220;<a href="https://krebsonsecurity.com/2018/04/dot-cm-typosquatting-sites-visited-12m-times-so-far-in-2018/" target="_blank" rel="noopener">typosquatting</a>&#8221; sites that seek to siphon credentials from legitimate websites when people mistype a domain, such as accidentally omitting the &#8220;.&#8221; after typing &#8220;www&#8221;.</p>
<div id="attachment_49523" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-49523" loading="lazy" class=" wp-image-49523" src="media/6e9d7c46.verified.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/verified.png" alt="" width="761" height="125" /><p id="caption-attachment-49523" class="wp-caption-text">A banner from the homepage of the Russian language cybercrime forum Verified.</p></div>
<p>Searching DomainTools for the phone number in the WHOIS records for wwwecardone[.]com  &#8212; +44.0774829141 &#8212; leads to a handful of similar typosquatting domains, including <strong>wwwebuygold[.]com </strong>and<strong> wwwpexpay[.]com</strong>. A different UK phone number in a more recent record for the wwwebuygold[.]com domain &#8212; 44.0472882112 &#8212; is tied to two more domains &#8211; <strong>howtounlockiphonefree[.]com</strong>, and <strong>portalsagepay[.]com</strong>. All of these domains date back to between 2012 and 2013.</p>
<p>The original registration records for the iPhone, Sagepay and Gold domains share an email address: <strong>devrian26@gmail.com</strong>. A search on the username &#8220;bo3dom&#8221; using Constella&#8217;s service reveals an account at <strong>ipmart-forum.com</strong>, a now-defunct forum concerned with IT products, such as mobile devices, computers and online gaming. That search shows the user bo3dom registered at ipmart-forum.com with the email address <strong>devrian27@gmail.com</strong>, and from an Internet address in Vilnius, Lithuania.</p>
<p>Devrian27@gmail.com was used to register multiple domains, including <strong>wwwsuperchange.ru</strong> back in 2008 (notice again the suspect &#8220;www&#8221; as part of the domain name). Gmail&#8217;s password recovery function says the backup email address for devrian27@gmail.com is<strong> bo3*******@gmail.com</strong>. Gmail accepts the address <strong>bo3domster@gmail.com</strong> as the recovery email for that devrian27 account.</p>
<p>According to Constella, the bo3domster@gmail.com address was exposed in multiple data breaches over the years, and in each case it used one of two passwords: &#8220;<strong>lebeda1</strong>&#8221; and &#8220;<strong>a123456</strong>&#8220;.</p>
<p>Searching in Constella for accounts using those passwords reveals a slew of additional &#8220;bo3dom&#8221; email addresses, including <strong>bo3dom@gmail.com</strong>.  Pivoting on that address in Constella reveals that someone with the name <strong>Vytautas Mockus </strong>used it to register an account at mindjolt.com, a site featuring dozens of simple puzzle games that visitors can play online.</p>
<p>At some point, mindjolt.com apparently also was hacked, because a copy of its database at Constella says the bo3dom@gmail.com used two passwords at that site: <strong>lebeda1</strong> and <strong>a123456.</strong></p>
<p>A reverse WHOIS search on &#8220;Vytautas Mockus&#8221; at DomainTools shows the email address <strong>devrian25@gmail.com</strong> was used in 2010 to register the domain name <strong>perfectmoney[.]co</strong>. This is one character off of <a href="https://en.bitcoin.it/wiki/Perfect_Money" target="_blank" rel="noopener">perfectmoney[.]com</a>, which is an early virtual currency that was quite popular with cybercriminals at the time. The phone number tied to that domain registration was &#8220;<strong>86.7273687</strong>&#8220;.</p>
<p>A Google search for &#8220;Vytautas Mockus&#8221; says there&#8217;s a person by that name who runs a mobile food service company in Lithuania called &#8220;<strong>Palvisa</strong>.&#8221; A <a href="media/eca9f900.302610044-2559-e71f3.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/302610044-2559-e71f3.pdf" target="_blank" rel="noopener">report on Palvisa</a> (PDF) purchased from <strong>Rekvizitai.vz</strong> &#8212; an official online directory of Lithuanian companies &#8212; says Palvisa was established in 2011 by a Vytautaus Mockus, using the phone number <strong>86.7273687</strong>, and the email address bo3dom@gmail.com. The report states that Palvisa is active, but has had no employees other than its founder.</p>
<p>Reached via the bo3dom@gmail.com address, the 36-year-old Mr. Mockus expressed mystification as to how his personal information wound up in so many records. &#8220;I am not involved in any crime,&#8221; Mockus wrote in reply.</p>
<div id="attachment_57797" style="width: 769px" class="wp-caption aligncenter"><a href="media/ee9cd725.babam-simple.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/babam-simple.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-57797" loading="lazy" class="wp-image-57797" src="media/ee9cd725.babam-simple.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/babam-simple.png" alt="" width="759" height="453" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/12/babam-simple.png 1572w, https://krebsonsecurity.com/wp-content/uploads/2021/12/babam-simple-768x458.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/12/babam-simple-1536x917.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2021/12/babam-simple-782x467.png 782w" sizes="(max-width: 759px) 100vw, 759px" /></a><p id="caption-attachment-57797" class="wp-caption-text">A rough mind map of the connections mentioned in this story.</p></div>
<p><span id="more-57745"></span></p>
<p>The domains apparently registered by Babam over nearly 10 years suggest he started off mainly stealing from other cybercrooks. By 2015, Babam was heavily into &#8220;carding,&#8221; the sale and use of stolen payment card data. By 2020, he&#8217;d shifted his focus almost entirely to selling access to companies.</p>
<p>A profile produced by threat intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> says Babam has received at least four positive feedback reviews on the Exploit cybercrime forum from crooks associated with the <a href="https://www.cybereason.com/blog/rising-threat-from-lockbit-ransomware" target="_blank" rel="noopener">LockBit ransomware gang</a>.</p>
<div id="attachment_57751" style="width: 736px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57751" loading="lazy" class="size-full wp-image-57751" src="media/fa39e9b1.babamfeedback.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/babamfeedback.png" alt="" width="726" height="278" /><p id="caption-attachment-57751" class="wp-caption-text">The ransomware collective LockBit giving Babam positive feedback for selling access to different victim organizations. Image: Flashpoint</p></div>
<p>According to Flashpoint, in April 2021 Babam advertised the sale of Citrix credentials for an international company that is active in the field of laboratory testing, inspection and certification, and that has more than $5 billion in annual revenues and more than 78,000 employees.</p>
<p>Flashpoint says Babam initially announced he&#8217;d sold the access, but later reopened the auction because the prospective buyer backed out of the deal. Several days later, Babam reposted the auction, adding more information about the depth of the illicit access and lowering his asking price. The access sold less than 24 hours later.</p>
<p>&#8220;Based on the provided statistics and sensitive source reporting, Flashpoint analysts assess with high confidence that the compromised organization was likely <strong>Bureau Veritas</strong>, an organization headquartered in France that operates in a variety of sectors,&#8221; the company concluded.</p>
<p>In November, Bureau Veritas acknowledged that it <a href="https://www.maritime-executive.com/article/bureau-veritas-is-latest-target-of-cyber-attack" target="_blank" rel="noopener">shut down its network in response to a cyber attack</a>. The company hasn&#8217;t said whether the incident involved ransomware and if so what strain of ransomware, but its response to the incident is straight out of the playbook for responding to ransomware attacks. Bureau Veritas has not yet responded to requests for comment; its <a href="https://group.bureauveritas.com/newsroom/update-cyber-attack" target="_blank" rel="noopener">latest public statement on Dec. 2</a> provides no additional details about the cause of the incident.</p>
<p>Flashpoint notes that Babam&#8217;s use of transliterated Russian persists on both Exploit and Verified until around March 2020, when he switches over to using mostly Cyrillc in his forum comments and sales threads. Flashpoint said this could be an indication that a different person started using the Babam account since then, or more likely that Babam had only a tenuous grasp of Russian to begin with and that his language skills and confidence improved over time.</p>
<p>Lending credence to the latter theory is that Babam still makes linguistic errors in his postings that suggest Russian is not his original language, Flashpoint found.</p>
<p>&#8220;The use of double &#8220;n&#8221; in such words as &#8220;проданно&#8221; (correct &#8211; продано) and &#8220;сделанны&#8221; (correct &#8211; сделаны) by the threat actor proves that this style of writing is not possible when using machine translation since this would not be the correct spelling of the word,&#8221; Flashpoint analysts wrote.</p>
<p>&#8220;These types of grammatical errors are often found among people who did not receive sufficient education at school or if Russian is their second language,&#8221; the analysis continues. &#8220;In such cases, when someone tries to spell a word correctly, then by accident or unknowingly, they overdo the spelling and make these types of mistakes. At the same time, colloquial speech can be fluent or even native. This is often typical for a person who comes from the former Soviet Union states.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=57819
title: Canada Charges Its “Most Prolific Cybercriminal”
uri: Canada-Charges-Its-Most-Prolific-Cybercriminal
url: https://krebsonsecurity.com/2021/12/canada-charges-its-most-prolific-cybercriminal/
content:
<p>A 31-year-old Canadian man has been arrested and charged with fraud in connection with numerous ransomware attacks against businesses, government agencies and private citizens throughout Canada and the United States. Canadian authorities describe him as &#8220;the most prolific cybercriminal we&#8217;ve identified in Canada,&#8221; but so far they&#8217;ve released few other details about the investigation or the defendant. Helpfully, an email address and nickname apparently connected to the accused offer some additional clues.</p>
<div id="attachment_57827" style="width: 292px" class="wp-caption alignright"><img aria-describedby="caption-attachment-57827" loading="lazy" class="wp-image-57827" src="media/71a78567.philbertapril2016.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/philbertapril2016.png" alt="" width="282" height="284" /><p id="caption-attachment-57827" class="wp-caption-text">Matthew Filbert, in 2016.</p></div>
<p><strong>Matthew Philbert</strong> of Ottawa, Ontario was charged with fraud and conspiracy in a joint law enforcement action by Canadian and U.S. authorities dubbed &#8220;Project CODA.&#8221; The <strong>Ontario Provincial Police</strong> (OPP) on Tuesday <a href="https://twitter.com/OPP_News/status/1468294251867824129" target="_blank" rel="noopener">said</a> the investigation began in January 2020 when the <strong>U.S. Federal Bureau of Investigation</strong> (FBI) contacted them regarding ransomware attacks that were based in Canada.</p>
<p>&#8220;During the course of this investigation, OPP investigators determined an individual was responsible for numerous ransomware attacks affecting businesses, government agencies and private individuals throughout Canada as well as cyber-related offenses in the United States,&#8221; reads an OPP statement.</p>
<p>&#8220;A quantity of evidentiary materials was seized and held for investigation, including desktop and laptop computers, a tablet, several hard drives, cellphones, a Bitcoin seed phrase and a quantity of blank cards with magnetic stripes,&#8221; the statement continues.</p>
<p>The <a href="media/5d0507e3.PhilbertIndictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/PhilbertIndictment.pdf" target="_blank" rel="noopener">U.S. indictment of Philbert</a> (PDF) is unusually sparse, but it does charge him with conspiracy, suggesting the defendant was part of a group. In an interview with KrebsOnSecurity, <strong>OPP Detective Inspector Matt Watson</strong> declined to say whether other defendants were being sought in connection with the investigation, but said the inquiry is ongoing.</p>
<p>&#8220;I will say this, Philbert is the most prolific cybercriminal we&#8217;ve identified to date in Canada,&#8221; Watson said. &#8220;We&#8217;ve identified in excess of a thousand of his victims. And a lot of these were small businesses that were just holding on by their fingernails during COVID.&#8221;</p>
<h2>A DARK CLOUD</h2>
<p>There is a now-dormant <strong>Myspace</strong> account for a Matthew Philbert from Orleans, a suburb of Ottawa, Ontario. The information tied to the Myspace account matches the age and town of the defendant. The Myspace account was registered under the nickname &#8220;<strong>Darkcloudowner</strong>,&#8221; and to the email address <strong>dark_cl0ud6@hotmail.com</strong>.</p>
<p>A search in <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools</a> on that email address reveals multiple domains registered to a Matthew Philbert and to the Ottawa phone number <strong>6138999251</strong> [DomainTools is a frequent advertiser on this site]. That same phone number is tied to a Facebook account for a 31-year-old Matthew Philbert from Orleans, who describes himself as a self-employed &#8220;broke bitcoin baron.&#8221;</p>
<p>Mr. Filbert did not respond to multiple requests for comment.</p>
<p>According to cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, that dark_cl0ud6@hotmail.com address has been used in conjunction with the handle &#8220;<strong>DCReavers2</strong>&#8221; to register user accounts on a half-dozen English-language cybercrime forums since 2008, including <a href="https://krebsonsecurity.com/?s=hackforums" target="_blank" rel="noopener">Hackforums</a>, Blackhatworld, and Ghostmarket.</p>
<p>Perhaps the earliest and most important cybercrime forum DCReavers2 frequented was <strong>Darkode</strong>, where he was among the first two-dozen members. Darkode was <a href="https://krebsonsecurity.com/2015/07/the-darkode-cybercrime-forum-up-close/" target="_blank" rel="noopener">taken down in 2015 as part of an FBI investigation sting operation</a>, but screenshots of the community saved by this author show that DCReavers2 was already well known to the Darkode founders when his membership to the forum was accepted in May 2009.</p>
<div id="attachment_57823" style="width: 739px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57823" loading="lazy" class="size-full wp-image-57823" src="media/696dc1da.DCmemberlist.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/DCmemberlist.png" alt="" width="729" height="670" /><p id="caption-attachment-57823" class="wp-caption-text">DCReavers2 was just the 22nd account to register on the Darkode cybercrime forum.</p></div>
<p>Most of DCReavers&#8217;s posts on Darkode appear to have been removed by forum administrators early on (likely at DCReavers&#8217; request), but the handful of posts that survived the purge show that more than a decade ago DCReavers2 was involved in running botnets, or large collections of hacked computers.</p>
<p>&#8220;My exploit pack is hosted there with 0 problems,&#8221; DCReaver2 <a href="media/c545068f.dcreavers2-dk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/dcreavers2-dk.png" target="_blank" rel="noopener">says</a> of a shady online provider that another member asked about in May 2010.<span id="more-57819"></span></p>
<p>Searching the Web on &#8220;DCreavers2&#8221; brings up <a href="https://www.exposedbotnets.com/2012/05/remember-h1t3mlo.html" target="_blank" rel="noopener">a fascinating chat conversation</a> allegedly between DCReavers2 and an individual in Australia who was selling access to an &#8220;<a href="https://krebsonsecurity.com/2010/01/a-peek-inside-the-eleonore-browser-exploit-kit/" target="_blank" rel="noopener">exploit kit</a>,&#8221; commercial crimeware designed to be stitched into hacked or malicious sites and exploit a variety of Web-browser vulnerabilities for the purposes of installing malware of the customer’s choosing.</p>
<p>In that 2009 chat, indexed by the researchers behind the website <strong>exposedbotnets.com</strong>, DCReavers2 uses the Dark_Cl0ud6 email address and actually shares his real name as Matthew Philbert. DCReavers2 also says his partner uses the nickname &#8220;<strong>The Rogue</strong>,&#8221; which corresponds to a former Darkode administrator who was the second user ever registered on the forum (see screenshot above).</p>
<p>In that same conversation, DCReavers2 discusses managing a botnet built on <strong>ButterFly Bot</strong>. Also known as &#8220;<strong>Mariposa</strong>,&#8221; ButterFly was a plug-and-play malware strain that allowed even the most novice of would-be cybercriminals to set up a global operation capable of harvesting data from thousands of infected PCs, and using the enslaved systems for crippling attacks on Web sites. The ButterFly Bot kit sold for prices ranging from $500 to $2,000.</p>
<div id="attachment_1451" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-1451" loading="lazy" class=" wp-image-1451" src="media/93b3e31f.Screen-shot-2010-03-03-at-7.08.09-PM.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png" alt="" width="761" height="419" srcset="https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM.png 962w, https://krebsonsecurity.com/wp-content/uploads/2010/03/Screen-shot-2010-03-03-at-7.08.09-PM-300x165.png 300w" sizes="(max-width: 761px) 100vw, 761px" /><p id="caption-attachment-1451" class="wp-caption-text">An advertisement for the ButterFly Bot.</p></div>
<p>The author of ButterFly Bot &#8212; Slovenian hacker <strong>Matjaz &#8220;Iserdo&#8221; Skorjanc</strong> &#8212; was Darkode&#8217;s original founder back in 2008. Arrested in 2010, Skorjanc was sentenced to nearly five years in prison for selling and supporting Mariposa, which was used to compromise millions of Microsoft Windows computers.</p>
<p>Upon release from prison, Skorjanc became chief technology officer for <strong>NiceHash</strong>, a cryptocurrency mining service. In December 2017, $52 million worth of Bitcoin <a href="https://krebsonsecurity.com/2017/12/former-botmaster-darkode-founder-is-cto-of-hacked-bitcoin-mining-firm-nicehash/" target="_blank" rel="noopener">mysteriously disappeared from NiceHash coffers</a>. In October 2019, Skorjanc was <a href="https://krebsonsecurity.com/2019/10/mariposa-botnet-author-darkcode-crime-forum-admin-arrested-in-germany/" target="_blank" rel="noopener">arrested in Germany</a> in response to a U.S.-issued international arrest warrant for his extradition.</p>
<p>The <a href="media/9482fce7.skorjanc2018indict.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/skorjanc2018indict.pdf" target="_blank" rel="noopener">indictment</a> (PDF) tied to Skorjanc&#8217;s 2019 arrest also names several other alleged founding members of Darkode, including <strong>Thomas &#8220;Fubar&#8221; McCormick</strong>, a Massachusetts man who was allegedly one of the last administrators of Darkode. Prosecutors say McCormick also was a reseller of the Mariposa botnet, the <a href="https://krebsonsecurity.com/?s=zeus+trojan" target="_blank" rel="noopener">ZeuS banking trojan</a>, and a bot malware he allegedly helped create called &#8220;Ngrbot.&#8221; The U.S. federal prosecution against Skorjanc and McCormick is ongoing.</p>
<p>At the time the FBI dismantled Darkode in 2015, the Justice Department said that out of 800 or so crime forums worldwide, Darkode was the most sophisticated English-language forum, and that it represented &#8220;<em>one of the gravest threats to the integrity of data on computers in the United States and around the world</em>.&#8221;</p>
<p>Some of Darkode&#8217;s core members were either customers or sellers of various &#8220;locker&#8221; kits, which were basically web-based exploits that would lock the victim&#8217;s screen into a webpage spoofing the FBI or Justice Department and warning that victims had been caught accessing child sexual abuse material. Victims who agreed to pay a &#8220;fine&#8221; of several hundred dollars worth of GreenDot prepaid cards could then be rid of the PC locker program.</p>
<div id="attachment_57824" style="width: 768px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57824" loading="lazy" class=" wp-image-57824" src="media/f8095c1e.dk-locker.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/dk-locker.png" alt="" width="758" height="544" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/12/dk-locker.png 1198w, https://krebsonsecurity.com/wp-content/uploads/2021/12/dk-locker-768x551.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/12/dk-locker-782x561.png 782w" sizes="(max-width: 758px) 100vw, 758px" /><p id="caption-attachment-57824" class="wp-caption-text">A 2012 sales thread on Darkode for Rev Locker.</p></div>
<p>In many ways, lockers were the precursors to the modern cybercrime scourge we now know as ransomware. The main reason lockers never took off as an existential threat to organizations worldwide was that there is only so much money locker users could reasonably demand via GreenDot cards.</p>
<p>But with the ascendance and broader acceptance of virtual currencies like Bitcoin, suddenly criminal hackers could start demanding millions of dollars from victims. And it stands to reason that a great many Darkode members who were never caught have since transitioned from lockers, exploit kits and GreenDot cards to doing what every other self-respecting cybercrook seems to be involved with these days: Locking entire companies and industries for ransomware payments.</p>
<p>One final observation about the Philbert indictment: It&#8217;s good to see the Canadian authorities working closely with the FBI on important cybercrime cases. Indeed, this investigation is remarkable for that fact alone. For years I&#8217;ve been wondering aloud why more American cybercriminals don&#8217;t just move to Canada, because historically there has been almost no probability that they will ever get caught &#8212; let alone prosecuted there. With any luck, this case will be the start of something new.</p>


feed_id: https://krebsonsecurity.com/?p=57854
title: Inside Ireland’s Public Healthcare Ransomware Scare
uri: Inside-Ireland-s-Public-Healthcare-Ransomware-Scare
url: https://krebsonsecurity.com/2021/12/inside-irelands-public-healthcare-ransomware-scare/
content:
<p>The consulting firm <strong>PricewaterhouseCoopers</strong> recently published lessons learned from the disruptive and costly ransomware attack in May 2021 on Ireland&#8217;s public health system. The unusually candid post-mortem found that nearly two months elapsed between the initial intrusion and the launching of the ransomware. It also found affected hospitals had tens of thousands of outdated <strong>Windows 7</strong> systems, and that the health system&#8217;s IT administrators failed to respond to multiple warning signs that a massive attack was imminent.</p>
<div id="attachment_57865" style="width: 767px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57865" loading="lazy" class=" wp-image-57865" src="media/a648738f.hsetimeline.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/hsetimeline.png" alt="" width="757" height="518" /><p id="caption-attachment-57865" class="wp-caption-text">PWC&#8217;s timeline of the days leading up to the deployment of Conti ransomware on May 14.</p></div>
<p>Ireland&#8217;s <strong>Health Service Executive</strong> (HSE), which operates the country&#8217;s public health system, got hit with <a href="https://www.cisa.gov/uscert/ncas/alerts/aa21-265a" target="_blank" rel="noopener">Conti ransomware</a> on May 14, 2021. A timeline in the report (above) says the initial infection of the &#8220;patient zero&#8221; workstation happened on Mar. 18, 2021, when an employee on a Windows computer opened a booby-trapped Microsoft Excel document in a phishing email that had been sent two days earlier.</p>
<p>Less than a week later, the attacker had established a reliable backdoor connection to the employee&#8217;s infected workstation. After infecting the system, &#8220;the attacker continued to operate in the environment over an eight week period until the detonation of the Conti ransomware on May 14, 2021,&#8221; the report states.</p>
<p>According to <a href="media/c266e67f.conti-cyber-attack-on-the-hse-full-report.pdf" data-original-source="https://www.hse.ie/eng/services/publications/conti-cyber-attack-on-the-hse-full-report.pdf" target="_blank" rel="noopener">PWC&#8217;s report</a> (PDF), there were multiple warning signs about a serious network intrusion, but those red flags were either misidentified or not acted on quickly enough:</p>
<ul>
<li>On Mar. 31, 2021, the HSE&#8217;s antivirus software detected the execution of two software tools commonly used by ransomware groups &#8212; <a href="https://www.secureworks.com/blog/detecting-cobalt-strike-cybercrime-attacks" target="_blank" rel="noopener">Cobalt Strike</a> and <a href="https://www.secureworks.com/blog/detecting-cobalt-strike-cybercrime-attacks" target="_blank" rel="noopener">Mimikatz</a> &#8212; on the Patient Zero Workstation. But the antivirus software was set to monitor mode, so it did not block the malicious commands.&#8221;</li>
<li>On May 7, the attacker compromised the HSE&#8217;s servers for the first time, and over the next five days the intruder would compromise six HSE hospitals. On May 10, one of the hospitals detected malicious activity on its Microsoft Windows Domain Controller, a critical &#8220;keys to the kingdom&#8221; component of any Windows enterprise network that manages user authentication and network access.</li>
<li>On 10 May 2021, security auditors first identified evidence of the attacker compromising systems within Hospital C and Hospital L. Hospital C’s antivirus software detected Cobalt Strike on two systems but failed to quarantine the malicious files.</li>
<li>On May 13, the HSE&#8217;s antivirus security provider emailed the HSE&#8217;s security operations team, highlighting unhandled threat events dating back to May 7 on at least 16 systems. The HSE Security Operations team requested that the Server team restart servers.</li>
</ul>
<p>By then it was too late. At just after midnight Ireland time on May 14, the attacker executed the Conti ransomware within the HSE. The attack <a href="https://cyberlaw.ccdcoe.org/wiki/Health_Service_Executive_ransomware_attack_(2021)" target="_blank" rel="noopener">disrupted services at several Irish hospitals</a> and resulted in the near complete shutdown of the HSE&#8217;s national and local networks, forcing the cancellation of many outpatient clinics and healthcare services. The number of appointments in some areas dropped by up to 80 percent.&#8221;</p>
<p>Conti initially demanded USD $20 million worth of virtual currency in exchange for a digital key to unlock HSE servers compromised by the group. But perhaps in response to the public outcry over the HSE disruption, Conti reversed course and gave the HSE the decryption keys without requiring payment.</p>
<p>Still, the work to restore infected systems would take months. The HSE ultimately enlisted members of the Irish military to bring in laptops and PCs to help restore computer systems by hand. It wasn&#8217;t until September 21, 2021 that the HSE declared 100 percent of its servers were decrypted.</p>
<p>As bad as the HSE ransomware attack was, the PWC report emphasizes that it could have been far worse. For example, it is unclear how much data would have been unrecoverable if a decryption key had not become available as the HSE’s backup infrastructure was only periodically backed up to offline tape.</p>
<p>The attack also could have been worse, the report found:</p>
<ul>
<li>if there had been intent by the Attacker to target specific devices within the HSE environment (e.g. medical devices);</li>
<li>if the ransomware took actions to destroy data at scale;</li>
<li>if the ransomware had auto-propagation and persistence capabilities, for example by using an exploit to propagate across domains and trust-boundaries to medical devices (e.g. the EternalBlue exploit used by the WannaCry and NotPetya15 attacks);</li>
<li>if cloud systems had also been encrypted such as the COVID-19 vaccination system</li>
</ul>
<p>The PWC report contains numerous recommendations, most of which center around hiring new personnel to lead the organization&#8217;s redoubled security efforts. But it is clear that the HSE has an enormous amount of work ahead <a href="https://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/" target="_blank" rel="noopener">to grow in security maturity</a>. For example, the report notes the HSE&#8217;s hospital network had over 30,000 Windows 7 workstations that were deemed end of life by the vendor.</p>
<p>&#8220;The HSE assessed its cybersecurity maturity rating as low,&#8221; PWC wrote. &#8220;For example, they do not have a CISO or a Security Operations Center established.&#8221;<span id="more-57854"></span></p>
<p>PWC also estimates that efforts to build up the HSE&#8217;s cybersecurity program to the point where it can rapidly detect and respond to intrusions are likely to cost &#8220;a multiple of the HSE&#8217;s current capital and operation expenditure in these areas over several years.&#8221;</p>
<div id="attachment_29580" style="width: 1081px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-29580" loading="lazy" class="size-full wp-image-29580" src="media/5b3d8118.SecurityMaturity.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png" alt="" width="1071" height="743" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png 1071w, https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-285x198.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-600x416.png 600w" sizes="(max-width: 1071px) 100vw, 1071px" /><p id="caption-attachment-29580" class="wp-caption-text">One idea of a &#8220;security maturity&#8221; model.</p></div>
<p>In June 2021, the HSE&#8217;s director general said the recovery costs for the May ransomware attack <a href="https://www.bankinfosecurity.com/irish-ransomware-attack-recovery-cost-estimate-600-million-a-16931" target="_blank" rel="noopener">were likely to exceed USD $600 million</a>.</p>
<p>What&#8217;s remarkable about this incident is that the HSE is publicly funded by the Irish government, and so in theory it has the money to spend (or raise) to pay for all these ambitious recommendations for increasing their security maturity.</p>
<p>That stands in stark contrast to the healthcare system here in the United States, where the single biggest impediment to doing security well continues to be lack of making it a real budget priority. Also, most healthcare organizations in the United States are private companies that operate on razor-thin profit margins.</p>
<p>I know this because in 2018 I was asked to give the keynote at an annual gathering of the <strong>Healthcare Information Sharing and Analysis Group</strong> (H-ISAC), an industry group centered on sharing information about cybersecurity threats. I almost didn&#8217;t accept the invitation: I&#8217;d written very little about healthcare security, which seemed to be dominated by coverage of whether healthcare organizations complied with the letter of the law in the United States. That compliance centered on the <a href="https://www.cdc.gov/phlp/publications/topic/hipaa.html#:~:text=The%20Health%20Insurance%20Portability%20and,the%20patient's%20consent%20or%20knowledge." target="_blank" rel="noopener">Health Insurance Portability and Accountability Act</a> (HIPPA), which prioritizes protecting the integrity and privacy of patient data.</p>
<p>To get up to speed, I interviewed over a dozen of the healthcare security industry&#8217;s best and brightest minds. A common refrain I heard from those interviewed was that if it was security-related but didn&#8217;t have to do with compliance, there probably wasn&#8217;t much chance it would get any budget.</p>
<p>Those sources unanimously said that however well-intentioned, it&#8217;s not clear that the &#8220;protect the data&#8221; regulatory approach of HIPPA was working from an overall threat perspective. According to <a href="https://www.healthcareitnews.com/news/biggest-healthcare-data-breaches-2021" target="_blank" rel="noopener">HealthcareIT News</a>, more than 40 million patient records have been compromised in incidents reported to the federal government in 2021 so far alone.</p>
<p>During my 2018 talk, I tried to emphasize the primary importance of being able to respond quickly to intrusions. Here&#8217;s a snippet of what I told that H-ISAC audience:</p>
<blockquote><p>&#8220;The term &#8216;Security Maturity&#8217; refers to the street smarts of an individual or organization, and this maturity generally comes from making plenty of mistakes, getting hacked a lot, and hopefully learning from each incident, measuring response times, and improving.</p>
<p>Let me say up front that all organizations get hacked. Even ones that are doing everything right from a security perspective get hacked probably every day if they’re big enough. By hacked I mean someone within the organization falls for a phishing scam, or clicks a malicious link and downloads malware. Because let’s face it, it only takes one screw up for the hackers to get a foothold in the network.</p>
<p>Now this is in itself isn’t bad. Unless you don&#8217;t have the capability to detect it and respond quickly. And if you can&#8217;t do that, you run the serious risk of having a small incident metastasize into a much larger problem.</p>
<p>Think of it like the medical concept of the &#8216;Golden Hour:&#8217; That short window of time directly following a traumatic injury like a stroke or heart attack in which life-saving medicine and attention is likely to be most effective. The same concept holds true in cybersecurity, and it&#8217;s exactly why so many organizations these days are placing more of their resources into incident response, instead of just prevention.&#8221;</p></blockquote>
<p>The United States&#8217; somewhat decentralized healthcare system means that many ransomware outbreaks tend to be limited to regional or local healthcare facilities. But a well-placed ransomware attack or series of attacks could inflict serious damage on the sector: A <a href="https://www2.deloitte.com/us/en/insights/industry/health-care/hospital-mergers-acquisition-trends.html" target="_blank" rel="noopener">December 2020 report from Deloitte</a> says the top 10 health systems now control 24 market share and their revenue grew at twice the rate of the rest of the market.</p>
<p>In October 2020, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/10/fbi-dhs-hhs-warn-of-imminent-credible-ransomware-threat-against-u-s-hospitals/" target="_blank" rel="noopener">broke the story</a> that the <strong>FBI</strong> and <strong>U.S. Department of Homeland Security</strong> had obtained chatter from a top ransomware group which warned of an &#8220;imminent cybercrime threat to U.S. hospitals and healthcare providers.&#8221; Members associated with the Russian-speaking ransomware group known as Ryuk had discussed plans to deploy ransomware at more than 400 healthcare facilities in the United States.</p>
<p>Hours after that piece ran, I head from a respected H-ISAC security professional who questioned whether it was worth getting the public so riled up. The story had been updated multiple times throughout the day, and there were at least five healthcare organizations hit with ransomware within the span of 24 hours.</p>
<p>&#8220;I guess it would help if I understood what the baseline is, like how many healthcare organizations get hit with ransomware on average in one week?&#8221; I asked the source.</p>
<p>&#8220;It&#8217;s more like one a day,&#8221; the source confided.</p>
<p>In all likelihood, the HSE will get the money it needs to implement the programs recommended by PWC, however long that takes. I wonder how many U.S.-based healthcare organizations could say the same.</p>


feed_id: https://krebsonsecurity.com/?p=57908
title: Microsoft Patch Tuesday, December 2021 Edition
uri: Microsoft-Patch-Tuesday-December-2021-Edition
url: https://krebsonsecurity.com/2021/12/microsoft-patch-tuesday-december-2021-edition/
content:
<p><strong>Microsoft</strong>, <strong>Adobe</strong>, and <strong>Google</strong> all issued security updates to their products today. The Microsoft patches include six previously disclosed security flaws, and one that that is already being actively exploited. But this month&#8217;s Patch Tuesday is overshadowed by the &#8220;<strong>Log4Shell</strong>&#8221; 0-day exploit in a popular <strong>Java</strong> library that web server administrators are now racing to find and patch amid widespread exploitation of the flaw.</p>
<p><img loading="lazy" class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="764" height="538" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 764px) 100vw, 764px" /></p>
<p>Log4Shell is the name picked for a critical flaw disclosed Dec. 9 in the popular logging library for Java called &#8220;<strong>log4j</strong>,&#8221; which is included in a huge number of Java applications. Publicly released exploit code allows an attacker to force a server running a vulnerable log4j library to execute commands, such as downloading malicious software or opening a backdoor connection to the server.</p>
<p>According to researchers at <strong>Lunasec</strong>, many, many services are vulnerable to this exploit.</p>
<p>&#8220;Cloud services like Steam, Apple iCloud, and apps like Minecraft have already been found to be vulnerable,&#8221; Lunasec <a href="https://www.lunasec.io/docs/blog/log4j-zero-day/" target="_blank" rel="noopener">wrote</a>. &#8220;Anybody using Apache Struts is likely vulnerable. We&#8217;ve seen similar vulnerabilities exploited before in breaches like the 2017 Equifax data breach. An extensive list of responses from impacted organizations has been compiled <a href="https://gist.github.com/SwitHak/b66db3a06c2955a9cb71a8718970c592" target="_blank" rel="noopener">here</a>.&#8221;</p>
<p>&#8220;If you run a server built on open-source software, there’s a good chance you are impacted by this vulnerability,&#8221; said <strong>Dustin Childs</strong> of Trend Micro&#8217;s Zero Day Initiative. &#8220;Check with all the vendors in your enterprise to see if they are impacted and what patches are available.&#8221;</p>
<p>Part of the difficulty in patching against the Log4Shell attack is identifying all of the vulnerable web applications, said <strong>Johannes Ullrich</strong>, an incident handler and blogger for the <strong>SANS Internet Storm Center</strong>. &#8220;Log4Shell will continue to haunt us for years to come. Dealing with log4shell will be a marathon,&#8221; Ullrich said. &#8220;Treat it as such.&#8221; SANS has <a href="https://isc.sans.edu/forums/diary/RCE+in+log4j+Log4Shell+or+how+things+can+get+bad+quickly/28120/" target="_blank" rel="noopener">a good walk-through</a> of how simple yet powerful the exploit can be.</p>
<p>&#8220;Basically the perfect ending to cybersecurity in 2021 is a 90s style Java vulnerability in an open source module, written by two volunteers with no funding, used by large cybersecurity vendors, undetected until Minecraft chat got pwned, where nobody knows how to respond properly,&#8221; researcher <strong>Kevin Beaumont</strong> <a href="https://twitter.com/GossiTheDog/status/1470787395805192199" target="_blank" rel="noopener">quipped</a> on Twitter.<span id="more-57908"></span></p>
<p>A half-dozen of the vulnerabilities addressed by Microsoft today earned its most dire &#8220;critical&#8221; rating, meaning malware or miscreants could exploit the flaws to gain complete, remote control over a vulnerable Windows system with little or no help from users.</p>
<p>The Windows flaw already seeing active exploitation is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43890" target="_blank" rel="noopener">CVE-2021-43890</a>, which is a &#8220;spoofing&#8221; bug in the <strong>Windows AppX installer</strong> on <strong>Windows 10.</strong> Microsoft says it is aware of attempts to exploit this flaw using specially crafted packages to implant malware families like <a href="https://krebsonsecurity.com/?s=Emotet" target="_blank" rel="noopener">Emotet</a>, <a href="https://krebsonsecurity.com/?s=trickbot" target="_blank" rel="noopener">Trickbot</a>, and <a href="https://www.proofpoint.com/us/blog/threat-insight/bazaflix-bazaloader-fakes-movie-streaming-service" target="_blank" rel="noopener">BazaLoader</a>.</p>
<p><strong>Kevin Breen</strong>, director of threat research for Immersive Labs, said <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43905" target="_blank" rel="noopener">CVE-2021-43905</a> stands out of this month&#8217;s patch batch.</p>
<p>&#8220;Not only for its high <a href="https://www.techtarget.com/searchsecurity/definition/CVSS-Common-Vulnerability-Scoring-System" target="_blank" rel="noopener">CVSS score</a> of 9.6, but also because it’s noted as &#8216;exploitation more likely&#8217;,&#8221; Breen observed.</p>
<p>Microsoft also patched <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43883" target="_blank" rel="noopener">CVE-2021-43883</a>, an elevation of privilege vulnerability in Windows Installer.</p>
<p>&#8220;This appears to be a fix for a patch bypass of <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-41379" target="_blank" rel="noopener">CVE-2021-41379</a>, another elevation of privilege vulnerability in Windows Installer that was reportedly fixed in November,&#8221; <strong>Satnam Narang</strong> of Tenable points out. &#8220;However, researchers discovered that fix was incomplete, and a proof-of-concept was made public late last month.&#8221;</p>
<p>Google issued five security fixes for <strong>Chrome</strong>, including one rated critical and three others with high severity. If you’re browsing with Chrome, keep a lookout for when you see an “Update” tab appear to the right of the address bar. If it’s been a while since you closed the browser, you might see the Update button turn from green to orange and then red. Green means an update has been available for two days; orange means four days have elapsed, and red means your browser is a week or more behind on important updates. Completely close and restart the browser to install any pending updates.</p>
<p>Also, Adobe issued patches to correct more than 60 security flaws in <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">a slew of products,</a> including Adobe Audition, Lightroom, Media Encoder, Premiere Pro, Prelude, Dimension, After Effects, Photoshop, Connect, Experience Manager and Premiere Rush.</p>
<p>Standard disclaimer: Before you update Windows, <em>please</em> make sure you have backed up your system and/or important files. It’s not uncommon for a Windows update package to hose one’s system or prevent it from booting properly, and some updates have been known to erase or corrupt files.</p>
<p>So do yourself a favor and backup before installing any patches. Windows 10 even has some <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener noreferrer">built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>And if you wish to ensure Windows has been set to pause updating so you can back up your files and/or system before the operating system decides to reboot and install patches on its own schedule, <a href="https://www.computerworld.com/article/3543189/check-to-make-sure-you-have-windows-updates-paused.html" target="_blank" rel="noopener noreferrer">see this guide</a>.</p>
<p>If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a decent chance other readers have experienced the same and may chime in here with useful tips.</p>
<p>Additional reading:</p>
<p><a href="https://isc.sans.edu/forums/diary/Microsoft+December+2021+Patch+Tuesday/28132/" target="_blank" rel="noopener">SANS ISC listing</a> of each Microsoft vulnerability patched today, indexed by severity and affected component.</p>


feed_id: https://krebsonsecurity.com/?p=57917
title: NY Man Pleads Guilty in $20 Million SIM Swap Theft
uri: NY-Man-Pleads-Guilty-in-20-Million-SIM-Swap-Theft
url: https://krebsonsecurity.com/2021/12/ny-man-pleads-guilty-in-20-million-sim-swap-theft/
content:
<p>A 24-year-old New York man who bragged about helping to steal more than $20 million worth of cryptocurrency from a technology executive has pleaded guilty to conspiracy to commit wire fraud. <strong>Nicholas Truglia</strong> was part of a group alleged to have stolen more than $100 million from cryptocurrency investors using fraudulent &#8220;SIM swaps,&#8221; scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identities.</p>
<p><img loading="lazy" class="aligncenter wp-image-40415" src="media/618d5447.phonefraudsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="759" height="383" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 759px) 100vw, 759px" /></p>
<p><strong>Truglia</strong> <a href="media/a240bc0a.trugliaadmission.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/trugliaadmission.png" target="_blank" rel="noopener">admitted</a> to a New York federal court that he let a friend use his account at crypto-trading platform <strong>Binance</strong> in 2018 to launder more than $20 million worth of virtual currency stolen from <strong>Michael Terpin</strong>, a cryptocurrency investor who co-founded the first angel investor group for bitcoin enthusiasts.</p>
<p>Following the theft, Terpin filed a civil lawsuit against Truglia with the Los Angeles Superior court. In May 2019, the jury awarded Terpin a $75.8 million judgment against Truglia. In January 2020, a New York grand jury <a href="media/fd60d96d.trugliaIndictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/trugliaIndictment.pdf" target="_blank" rel="noopener">criminally indicted Truglia</a> (PDF) for his part in the crypto theft from Terpin.</p>
<p>A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their mobile device has been damaged or lost, or when they are switching to a different phone that requires a SIM card of another size.</p>
<div id="attachment_57927" style="width: 308px" class="wp-caption alignright"><img aria-describedby="caption-attachment-57927" loading="lazy" class=" wp-image-57927" src="media/af426a8d.truglia.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/truglia.png" alt="" width="298" height="249" /><p id="caption-attachment-57927" class="wp-caption-text">Nicholas Truglia, holding bottle. Image: twitter.com/erupts</p></div>
<p>But fraudulent SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target’s service to a new SIM card and mobile phone controlled by the scammers. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many financial institutions and online services rely on text messages to send users a one-time code for multi-factor authentication.</p>
<p>Compounding the threat, many websites let customers reset their passwords merely by clicking a link sent via SMS to the mobile phone number tied to the account, meaning anyone who controls that phone number can reset the passwords for those accounts.</p>
<p>Reached for comment, Terpin said his assailant got off easy.</p>
<p>&#8220;I am outraged that after nearly four years and hundreds of pages of evidence that the best the prosecutors could recommend was a plea bargain for a single, relatively minor count of the unauthorized use of a Binance exchange account, when all the evidence points toward Truglia being one of two masterminds of a wide-ranging criminal conspiracy to steal crypto from me and others,&#8221; Terpin told KrebsOnSecurity.</p>
<p>Terpin said public court records already show Truglia bragging about stealing his funds and using it to finance a lavish lifestyle.</p>
<p>&#8220;He at the very least withdrew 100 bitcoin (worth $1.6 million at the time and nearly $5 million today) from my theft into his wallet at a separate, US-based exchange, and then moved or spent it,&#8221; Terpin said. &#8220;The fact is that the intentional theft of $24 million, whether taken at the point of a gun in a bank or through a SIM card swap, is a major felony. Truglia should be prosecuted to the fullest extent of the law.&#8221;</p>
<div id="attachment_57938" style="width: 755px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57938" loading="lazy" class=" wp-image-57938" src="media/b1df4193.trugliaplane.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/trugliaplane.png" alt="" width="745" height="686" /><p id="caption-attachment-57938" class="wp-caption-text">Nicholas Truglia, showing off a diamond-studded Piaget watch while aboard a private jet. Image: twitter.com/erupts.</p></div>
<p><span id="more-57917"></span>Terpin also is waging an ongoing civil lawsuit against 18-year-old <strong>Ellis Pinsky</strong>, who&#8217;s accused of working with Truglia as part of a SIM swapping crew that has stolen more than $100 million in cryptocurrency. According to Terpin, Pinsky was 15 when he took part in the $24 million 2018 SIM swap, but he returned $2 million worth of cryptocurrency after being confronted by Terpin&#8217;s investigators.</p>
<p>&#8220;On the surface, Pinsky is an &#8216;All American Boy,'&#8221; Terpin&#8217;s civil suit charges. &#8220;The son of privilege, he is active in extracurricular activities and lives a suburban life with a doting mother who is a prominent doctor.&#8221;</p>
<p>&#8220;Despite their wholesome appearances, Pinsky and his other cohorts are in fact evil computer geniuses with sociopathic traits who heartlessly ruin their innocent victims’ lives and gleefully boast of their multi-million-dollar heists,&#8221; the lawsuit continues. &#8220;Pinsky is reputed to have used his ill-gotten gains to purchase multi-million-dollar watches and is known to go on nightclub sprees at high end clubs in New York City, and Truglia rented private jets and played the part of a dashing playboy with young women pampering him.&#8221;</p>
<p>Pinksy could not be immediately reached for comment. But a review of the latest filings in the lawsuit show that Pinsky&#8217;s attorneys stopped representing him because he no longer had the funds to pay for their services. The most recent entry in the New York Southern District&#8217;s docket asks the court to give Pinsky additional time to seek counsel, and hints that barring that he may end up representing himself.</p>
<div id="attachment_57929" style="width: 756px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-57929" loading="lazy" class=" wp-image-57929" src="media/a4619ab1.pinsky.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/12/pinsky.png" alt="" width="746" height="448" /><p id="caption-attachment-57929" class="wp-caption-text">Ellis Pinsky, in a photo uploaded to his social media profile.</p></div>
<p>Truglia is still being criminally prosecuted in Santa Clara, Calif., the home of the <a href="https://krebsonsecurity.com/2018/11/busting-sim-swappers-and-sim-swap-myths/" target="_blank" rel="noopener">REACT task force</a>, which pursues SIM-swapping cases nationwide. In November 2018, REACT investigators and New York authorities <a href="https://nypost.com/2018/11/20/man-hacked-into-silicon-valley-execs-phones-to-steal-cryptocurrency-cops/" target="_blank" rel="noopener">arrested Truglia</a> on suspicion of using SIM swaps to steal approximately $1 million worth of cryptocurrencies from <strong>Robert Ross</strong>, a San Francisco father of two who later went on to found the victim advocacy website <a href="https://www.stopsimcrime.org" target="_blank" rel="noopener">stopsimcrime.org</a>.</p>
<p>According to <a href="https://nypost.com/2018/11/20/man-hacked-into-silicon-valley-execs-phones-to-steal-cryptocurrency-cops/" target="_blank" rel="noopener">published reports</a>, Truglia and his accomplices also perpetrated SIM swaps against the CEO of the blockchain storage service 0Chain; hedge-funder Myles Danielson, vice president of Hall Capital Partners; and Gabrielle Katsnelson, the co-founder of the startup SMBX.</p>
<p>Truglia is currently slated to be sentenced in April 2022 for his guilty plea in New York. He faces a maximum sentence of up to 20 years in prison.</p>
<p><strong>Erin West</strong>, deputy district attorney for Santa Clara County, told KrebsOnSecurity that SIM swapping remains a major problem. But she said many of the victims they&#8217;re now assisting are relatively new cryptocurrency investors for whom a SIM swapping attack can be financially devastating.</p>
<p>&#8220;Originally, the SIM swap targets were the early adopters of crypto,&#8221; West said. &#8220;Now we&#8217;re seeing a lot more of what I would call normal people trying their hand at crypto, and that makes a lot more people a target. It makes people who are unfamiliar with their personal security online vulnerable to hackers whose entire job is to figure out how to part people from their money.&#8221;</p>
<p>West said REACT continues to train state and local law enforcement officials across the country on how to successfully investigate and prosecute SIM swapping cases.</p>
<p>&#8220;The good news is our partners across the nation are learning how to conduct these cases,&#8221; she said. &#8220;Where this was a relatively new phenomenon three years ago, other smaller jurisdictions around the country are now learning how to prosecute this crime.&#8221;</p>
<p>All of the major wireless carriers let customers add security against SIM swaps and related schemes by setting a PIN that needs to be provided over the phone or in person at a store before account changes should be made. But these security features can be bypassed by incompetent or <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">corrupt</a> <a href="https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/" target="_blank" rel="noopener">mobile store employees</a>.</p>
<p>For some tips on how to minimize your chances of becoming the next SIM swapping victim, check out the “What Can You Do?” section at <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">the conclusion of this story</a>.</p>


