# articles

feed_id: https://krebsonsecurity.com/?p=59439
title: Microsoft Patch Tuesday, April 2022 Edition
uri: Microsoft-Patch-Tuesday-April-2022-Edition
url: https://krebsonsecurity.com/2022/04/microsoft-patch-tuesday-april-2022-edition/
content:
<p><img class="aligncenter  wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="752" height="529" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 752px) 100vw, 752px" /></p>
<p><strong>Microsoft</strong> on Tuesday released updates to fix roughly 120 security vulnerabilities in its <strong>Windows</strong> operating systems and other software. Two of the flaws have been publicly detailed prior to this week, and one is already seeing active exploitation, according to a report from the <strong>U.S. National Security Agency</strong> (NSA).</p>
<p>Of particular concern this month is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24521" target="_blank" rel="noopener">CVE-2022-24521</a>, which is a &#8220;privilege escalation&#8221; vulnerability in the Windows common log file system driver. In its advisory, Microsoft said it received a report from the NSA that the flaw is under active attack.</p>
<p>“It’s not stated how widely the exploit is being used in the wild, but it’s likely still targeted at this point and not broadly available,&#8221; assessed <strong>Dustin Childs</strong> with Trend Micro&#8217;s Zero Day Initiative. &#8220;Go patch your systems before that situation changes.”</p>
<p>Nine of the updates pushed this week address problems Microsoft considers &#8220;critical,&#8221; meaning the flaws they fix could be abused by malware or malcontents to seize total, remote access to a Windows system without any help from the user.</p>
<p>Among the scariest critical bugs is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-26809" target="_blank" rel="noopener">CVE-2022-26809,</a> a potentially &#8220;wormable&#8221; weakness in a core Windows component (<strong>RPC</strong>) that earned a CVSS score of 9.8 (10 being the worst). Microsoft said it believes exploitation of this flaw is more likely than not.</p>
<p>Other potentially wormable threats this month include <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24491" target="_blank" rel="noopener">CVE-2022-24491</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24497" target="_blank" rel="noopener">CVE-2022-24497</a>, Windows <strong>Network File System</strong> (NFS) vulnerabilities that also clock in at 9.8 CVSS scores and are listed as &#8220;exploitation more likely by Microsoft.&#8221;</p>
<p>&#8220;These could be the kind of vulnerabilities which appeal to ransomware operators as they provide the potential to expose critical data,&#8221; said <strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>. &#8220;It is also important for security teams to note that NFS Role is not a default configuration for Windows devices.&#8221;<span id="more-59439"></span></p>
<p>Speaking of wormable flaws, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-24500" target="_blank" rel="noopener">CVE-2022-24500</a> is a critical bug in the <strong>Windows Server Message Block</strong> (SMB).</p>
<p>&#8220;This is especially poignant as we approach the anniversary of WannaCry, which famously used the EternalBlue SMB vulnerability to propagate at great pace,&#8221; Breen added. &#8220;Microsoft advises blocking TCP port 445 at the perimeter firewall, which is strong advice regardless of this specific vulnerability. While this won&#8217;t stop exploitation from attackers inside the local network, it will prevent new attacks originating from the Internet.&#8221;</p>
<p>In addition, this month&#8217;s patch batch from Redmond brings updates for <strong>Exchange Server</strong>, <strong>Office</strong>, <strong>SharePoint Server</strong>, <strong>Windows Hyper-V</strong>, <strong>DNS Server</strong>, <strong>Skype for Business</strong>, <strong>.NET</strong> and <strong>Visual Studio</strong>, <strong>Windows App Store</strong>, and <strong>Windows Print Spooler</strong> components.</p>
<p>As it generally does on the second Tuesday of each month, <strong>Adobe</strong> released four patches addressing 70 vulnerabilities in <strong>Acrobat</strong> and <strong>Reader,</strong> <strong>Photoshop</strong>, <strong>After Effects</strong>, and <strong>Adobe Commerce</strong>. More information on those updates is available <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">here</a>.</p>
<p>For a complete rundown of all patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+April+2022+Patch+Tuesday/28542/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/2022/march-madness-patching-begins/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these patches, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=59446
title: Conti’s Ransomware Toll on the Healthcare Industry
uri: Conti-s-Ransomware-Toll-on-the-Healthcare-Industry
url: https://krebsonsecurity.com/2022/04/contis-ransomware-toll-on-the-healthcare-industry/
content:
<p><strong>Conti</strong> &#8212; one of the most ruthless and successful Russian ransomware groups &#8212; publicly declared during the height of the COVID-19 pandemic that it would refrain from targeting healthcare providers. But new information confirms this pledge was always a lie, and that Conti has launched more than 200 attacks against hospitals and other healthcare facilities since first surfacing in 2018 under its earlier name, &#8220;<strong>Ryuk</strong>.&#8221;</p>
<p><img class="aligncenter wp-image-53477" src="media/3791c184.medsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/medsec.png" alt="" width="748" height="819" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/medsec.png 800w, https://krebsonsecurity.com/wp-content/uploads/2020/10/medsec-768x841.png 768w" sizes="(max-width: 748px) 100vw, 748px" /></p>
<p>On April 13, Microsoft said it executed <a href="https://blogs.microsoft.com/on-the-issues/2022/04/13/zloader-botnet-disrupted-malware-ukraine/" target="_blank" rel="noopener">a legal sneak attack</a> against <strong>Zloader</strong>, a remote access trojan and malware platform that multiple ransomware groups have used to deploy their malware inside victim networks. More specifically, Microsoft <a href="https://noticeofpleadings.com/Zloader/" target="_blank" rel="noopener">obtained a court order</a> that allowed it to seize 65 domain names that were used to maintain the Zloader botnet.</p>
<p>Microsoft&#8217;s civil lawsuit against Zloader names seven &#8220;John Does,&#8221; essentially seeking information to identify cybercriminals who used Zloader to conduct ransomware attacks. As the company&#8217;s complaint notes, some of these John Does were associated with lesser ransomware collectives such as <strong>Egregor</strong> and <strong>Netfilim</strong>.</p>
<p>But according to Microsoft and <a href="https://www.cisa.gov/uscert/ncas/alerts/aa21-265a" target="_blank" rel="noopener">an advisory</a> from the <strong>U.S. Cybersecurity &amp; Infrastructure Security Agency</strong> (CISA), Zloader had a special relationship with Ryuk/Conti, acting as <a href="https://threatpost.com/malsmoke-microsoft-e-signature-verification/177363/" target="_blank" rel="noopener">a preferred distribution platform for deploying Ryuk/Conti ransomware</a>.</p>
<p>Several parties backed Microsoft in its legal efforts against Zloader by filing supporting declarations, including <strong>Errol Weiss</strong>, a former penetration tester for the <strong>U.S. National Security Agency</strong> (NSA). Weiss now serves as the chief security officer of the <a href="https://www.h-isac.org" target="_blank" rel="noopener">Health Information Sharing &amp; Analysis Center</a> (H-ISAC), an industry group that shares information about cyberattacks against healthcare providers.</p>
<p>Weiss said ransomware attacks from Ryuk/Conti have impacted hundreds of healthcare facilities across the United States, including facilities located in 192 cities and 41 states and the District of Columbia.</p>
<p>&#8220;The attacks resulted in the temporary or permanent loss of IT systems that support many of the provider delivery functions in modern hospitals resulting in cancelled surgeries and delayed medical care,&#8221; Weiss said in <a href="media/e8074e68.TRO200820-20Weiss20Decl20with20Ex20120ISO20TRO20and20PI.pdf" data-original-source="https://noticeofpleadings.com/zloader/files/Application%20for%20TRO/TRO%2008%20-%20Weiss%20Decl%20with%20Ex%201%20ISO%20TRO%20and%20PI.pdf" target="_blank" rel="noopener">a declaration</a> (PDF) with the U.S. District Court for the Northern District of Georgia.</p>
<p>&#8220;Hospitals reported revenue losses due to Ryuk infections of nearly $100 million from data I obtained through interviews with hospital staff, public statements, and media articles,&#8221; Weiss wrote. &#8220;The Ryuk attacks also caused an estimated $500 million in costs to respond to the attacks – costs that include ransomware payments, digital forensic services, security improvements and upgrading impacted systems plus other expenses.&#8221;<span id="more-59446"></span></p>
<p>The figures cited by Weiss appear highly conservative. A single attack by Ryuk/Conti in May 2021 against Ireland&#8217;s Health Service Executive, which operates the country’s public health system, resulted in <a href="https://krebsonsecurity.com/2021/12/inside-irelands-public-healthcare-ransomware-scare/" target="_blank" rel="noopener">massive disruptions to healthcare in Ireland</a>. In June 2021, the HSE’s director general said the recovery costs for that attack were likely to exceed USD $600 million.</p>
<p>Conti ravaged the healthcare sector throughout 2020, and <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">leaked internal chats from the Conti ransomware group</a> show the gang had access to more than 400 healthcare facilities in the U.S. alone by October 2020.</p>
<p>On Oct. 28, 2020, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/10/fbi-dhs-hhs-warn-of-imminent-credible-ransomware-threat-against-u-s-hospitals/" target="_blank" rel="noopener">broke the news</a> that FBI and DHS officials had seen reliable intelligence indicating the group planned to ransom many of these care facilities simultaneously. Hours after that October 2020 piece ran, I heard from a respected H-ISAC security professional who questioned whether it was worth getting the public so riled up. The story had been updated multiple times throughout the day, and there were at least five healthcare organizations hit with ransomware within the span of 24 hours.</p>
<p>“I guess it would help if I understood what the baseline is, like how many healthcare organizations get hit with ransomware on average in one week?” I asked the source.</p>
<p>“It’s more like one a day,” the source confided.</p>
<p>A <a href="https://news.sophos.com/en-us/2022/02/28/conti-and-karma-actors-attack-healthcare-provider-at-same-time-through-proxyshell-exploits/" target="_blank" rel="noopener">report in February 2022</a> from <strong>Sophos</strong> found Conti orchestrated a cyberattack against a Canadian healthcare provider in late 2021. Security software firm <strong>Emsisoft</strong> <a href="https://blog.emsisoft.com/en/40813/the-state-of-ransomware-in-the-us-report-and-statistics-2021/" target="_blank" rel="noopener">found</a> that at least 68 healthcare providers suffered ransomware attacks last year.</p>
<p>While Conti is just one of many ransomware groups threatening the healthcare industry, it seems likely that ransomware attacks on the healthcare sector are underreported. Perhaps this is because a large percentage of victims are paying a ransom demand to keep their data (and news of their breach) confidential. A <a href="https://www.proofpoint.com/us/newsroom/press-releases/proofpoints-2022-state-phish-report-reveals-email-based-attacks-dominated" target="_blank" rel="noopener">survey</a> published in February by email security provider <strong>Proofpoint</strong> found almost 60 percent of victims hit by ransomware paid their extortionists.</p>
<p>Or perhaps it&#8217;s because many crime groups have shifted focus away from deploying ransomware and toward stealing data and demanding payment not to publish the information. Conti shames victims who refuse to pay a ransom by posting their internal data on their darkweb blog.</p>
<p>Since the beginning of 2022, Conti has claimed responsibility for hacking a cancer testing lab, a medical prescription service online, a biomedical testing facility, a pharmaceutical company, and a spinal surgery center.</p>
<p>The <strong>Healthcare Information and Management Systems Society</strong> recently released its <a href="media/22e91fd5.2021_himss_cybersecurity_survey.pdf" data-original-source="https://www.himss.org/sites/hde/files/media/file/2022/01/28/2021_himss_cybersecurity_survey.pdf" target="_blank" rel="noopener">2021 HIMSS Healthcare Cybersecurity Survey</a> (PDF), which interviewed 167 healthcare cybersecurity professionals and found 67 percent had experienced a &#8220;significant security incident&#8221; in the past year.</p>
<p>The survey also found that just six percent or less of respondent&#8217;s information technology budgets were devoted to cybersecurity, although roughly 60 percent of respondents said their cybersecurity budgets would increase in 2022. Last year, just 79 percent of respondents said they&#8217;d fully implemented antivirus or other anti-malware systems; only 43 percent reported they&#8217;d fully implemented intrusion detection and prevention technologies.</p>
<p>The FBI <a href="media/32c9298d.210521.pdf" data-original-source="https://www.ic3.gov/Media/News/2021/210521.pdf" target="_blank" rel="noopener">says</a> Conti typically gains access to victim networks through weaponized malicious email links, attachments, or stolen Remote Desktop Protocol (RDP) credentials, and that it weaponizes Microsoft Office documents with embedded Powershell scripts &#8212; initially staging Cobalt Strike via the Office documents and then dropping <a href="https://krebsonsecurity.com/2021/01/international-action-targets-emotet-crimeware/" target="_blank" rel="noopener">Emotet</a> onto the network &#8212; giving them the ability to deploy ransomware. The FBI said Conti has been observed inside victim networks between four days and three weeks on average before deploying Conti ransomware.</p>


feed_id: https://krebsonsecurity.com/?p=59472
title: Leaked Chats Show LAPSUS$ Stole T-Mobile Source Code
uri: Leaked-Chats-Show-LAPSUS-Stole-T-Mobile-Source-Code
url: https://krebsonsecurity.com/2022/04/leaked-chats-show-lapsus-stole-t-mobile-source-code/
content:
<p>KrebsOnSecurity recently reviewed a copy of the private chat messages between members of the <strong>LAPSUS$</strong> cybercrime group in the week leading up to the arrest of its most active members last month. The logs show LAPSUS$ breached <strong>T-Mobile</strong> multiple times in March, stealing source code for a range of company projects. T-Mobile says no customer or government information was stolen in the intrusion.</p>
<p>LAPSUS$ is known for stealing data and then demanding a ransom not to publish or sell it. But the leaked chats indicate this mercenary activity was of little interest to the tyrannical teenage leader of LAPSUS$, whose obsession with stealing and leaking proprietary computer source code from the world&#8217;s largest tech companies ultimately led to the group&#8217;s undoing.</p>
<p>From its inception in December 2021 until its implosion late last month, LAPSUS$ operated openly on its <strong>Telegram</strong> chat channel, which quickly grew to more than 40,000 followers after the group started using it to leak huge volumes of sensitive data stolen from victim corporations.</p>
<p>But LAPSUS$ also used private Telegram channels that were restricted to the core seven members of the group. KrebsOnSecurity recently received a week&#8217;s worth of these private conversations between LAPSUS$ members as they plotted their final attacks late last month.</p>
<p><a href="media/3d6f3eed.lapsus-school.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/lapsus-school.png" target="_blank" rel="noopener"><img class="aligncenter wp-image-59501 size-full" src="media/3d6f3eed.lapsus-school.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/lapsus-school.png" alt="" width="635" height="527" /></a></p>
<p>The candid conversations show LAPSUS$ frequently obtained the initial access to targeted organizations by purchasing it from sites like <strong>Russian Market</strong>, which sell access to remotely compromised systems, as well as any credentials stored on those systems.</p>
<p>The logs indicate LAPSUS$ had exactly zero problems buying, stealing or sweet-talking their way into employee accounts at companies they wanted to hack. The bigger challenge for LAPSUS$ was the subject mentioned by &#8220;Lapsus Jobs&#8221; in the screenshot above: Device enrollment. In most cases, this involved social engineering employees at the targeted firm into adding one of their computers or mobiles to the list of devices allowed to authenticate with the company&#8217;s virtual private network (VPN).</p>
<p>The messages show LAPSUS$ members continuously targeted <strong>T-Mobile</strong> employees, whose access to internal company tools could give them everything they needed to conduct hassle-free &#8220;<a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">SIM swaps</a>&#8221; &#8212; reassigning a target&#8217;s mobile phone number to a device they controlled. These unauthorized sim swaps allow an attacker to intercept a target&#8217;s text messages and phone calls, including any links sent via SMS for password resets, or one-time codes sent for multi-factor authentication.</p>
<div id="attachment_59494" style="width: 772px" class="wp-caption aligncenter"><a href="media/34048223.samsungtmob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/samsungtmob.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59494" loading="lazy" class="wp-image-59494" src="media/34048223.samsungtmob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/samsungtmob.png" alt="" width="762" height="410" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/samsungtmob.png 1277w, https://krebsonsecurity.com/wp-content/uploads/2022/04/samsungtmob-768x413.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/samsungtmob-782x421.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/04/samsungtmob-370x200.png 370w" sizes="(max-width: 762px) 100vw, 762px" /></a><p id="caption-attachment-59494" class="wp-caption-text">The LAPSUS$ group had a laugh at this screenshot posted by their leader, White, which shows him reading a T-Mobile news alert about their hack into Samsung. White is viewing the page via a T-Mobile employee&#8217;s virtual machine.</p></div>
<p>In one chat, the LAPSUS$ leader &#8212; 17-year-old from the U.K. who goes by the nicknames &#8220;<strong>White</strong>,&#8221; &#8220;<strong>WhiteDoxbin</strong>&#8221; and &#8220;<strong>Oklaqq</strong>&#8221; &#8212; is sharing his screen with another LAPSUS$ member who used the handles &#8220;<strong>Amtrak</strong>&#8221; and &#8220;<strong>Asyntax</strong>.&#8221;</p>
<p>The two were exploring T-Mobile&#8217;s internal systems, and Amtrak asked White to obscure the T-Mobile logo on his screen. In these chats, the user &#8220;<strong>Lapsus Jobs</strong>&#8221; is White. Amtrak explains this odd request by saying his parents are aware he was previously involved in SIM swapping, and he doesn&#8217;t want to give them any cause for alarm if they happen to look over his shoulder while he&#8217;s hacking away at home.</p>
<p>&#8220;Parents know I simswap,&#8221; Amtrak <a href="media/7efd8cf9.parentsknowisimswap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/parentsknowisimswap.png" target="_blank" rel="noopener">said</a>. &#8220;So, if they see [that] they think I&#8217;m hacking.&#8221;</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-59485" src="media/7efd8cf9.parentsknowisimswap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/parentsknowisimswap.png" alt="" width="764" height="688" /></p>
<p>The messages reveal that each time LAPSUS$ was cut off from a T-Mobile employee&#8217;s account &#8212; either because the employee tried to log in or change their password &#8212; they would just <a href="media/815b9c47.anothertmob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/anothertmob.png" target="_blank" rel="noopener">find or buy another set of T-Mobile VPN credentials</a>. T-Mobile currently has approximately 75,000 employees worldwide.</p>
<p>On March 19, 2022, the logs and accompanying screenshots show LAPSUS$ had <a href="media/99f21bbf.hasatlas1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/hasatlas1.png" target="_blank" rel="noopener">gained access to <strong>Atlas</strong></a>, a powerful internal T-Mobile tool for managing customer accounts.</p>
<div id="attachment_59482" style="width: 773px" class="wp-caption aligncenter"><a href="media/90d442bb.atlas-dod.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/atlas-dod.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59482" loading="lazy" class="wp-image-59482" src="media/90d442bb.atlas-dod.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/atlas-dod.png" alt="" width="763" height="412" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/atlas-dod.png 1274w, https://krebsonsecurity.com/wp-content/uploads/2022/04/atlas-dod-768x415.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/atlas-dod-782x422.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/04/atlas-dod-370x200.png 370w" sizes="(max-width: 763px) 100vw, 763px" /></a><p id="caption-attachment-59482" class="wp-caption-text">LAPSUS$ leader White/Lapsus Jobs looking up the Department of Defense in T-Mobile&#8217;s internal Atlas system.</p></div>
<p>After gaining access to Atlas, White proceeded to look up T-Mobile accounts associated with the <strong>FBI</strong> and <strong>Department of Defense</strong> (see image above). Fortunately, those accounts were listed as requiring additional verification procedures before any changes could be processed.</p>
<p>Faced with increasingly vocal pleadings from other LAPSUS$ members <a href="media/6f267929.killatlasin1second.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/killatlasin1second.png" target="_blank" rel="noopener">not to burn their access to Atlas and other tools</a> by trying to SIM swap government accounts, White unilaterally decided to <a href="media/815b9c47.anothertmob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/anothertmob.png" target="_blank" rel="noopener">terminate the VPN connection permitting access to T-Mobile&#8217;s network.</a></p>
<p>The other LAPSUS$ members desperately wanted to SIM swap some wealthy targets for money. Amtrak <a href="media/d422531e.whyyyyyyy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/whyyyyyyy.png" target="_blank" rel="noopener">throws a fit</a>, saying &#8220;<a href="media/5f74be92.workedreallyhardforthis.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/workedreallyhardforthis.png" target="_blank" rel="noopener">I worked really hard for this!</a>&#8221; White calls the Atlas access trash and then kills the VPN connection anyway, saying he wanted to focus on using their illicit T-Mobile access to steal source code.</p>
<div id="attachment_59483" style="width: 777px" class="wp-caption aligncenter"><a href="media/d482b646.t-mob-bitbucket.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mob-bitbucket.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59483" loading="lazy" class="wp-image-59483" src="media/d482b646.t-mob-bitbucket.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mob-bitbucket.png" alt="" width="767" height="414" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mob-bitbucket.png 1274w, https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mob-bitbucket-768x415.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mob-bitbucket-782x422.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mob-bitbucket-370x200.png 370w" sizes="(max-width: 767px) 100vw, 767px" /></a><p id="caption-attachment-59483" class="wp-caption-text">A screenshot taken by LAPSUS$ inside T-Mobile&#8217;s source code repository at Bitbucket.</p></div>
<p>Perhaps to mollify his furious teammates, White changed the subject and told them he&#8217;d gained access to T-Mobile&#8217;s <strong>Slack</strong> and <strong>Bitbucket</strong> accounts. He said he&#8217;d figured out how to upload files to the virtual machine he had access to at T-Mobile.<span id="more-59472"></span></p>
<p>Roughly 12 hours later, White posts a screenshot in their private chat showing his automated script had downloaded more than 30,000 source code repositories from T-Mobile over a 12-hour period:</p>
<div id="attachment_59484" style="width: 773px" class="wp-caption aligncenter"><a href="media/c62f5a11.t-mobsourcedl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mobsourcedl.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59484" loading="lazy" class="wp-image-59484" src="media/c62f5a11.t-mobsourcedl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mobsourcedl.png" alt="" width="763" height="423" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mobsourcedl.png 1315w, https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mobsourcedl-768x426.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/t-mobsourcedl-782x434.png 782w" sizes="(max-width: 763px) 100vw, 763px" /></a><p id="caption-attachment-59484" class="wp-caption-text">White showing a screenshot of a script that he said downloaded all available T-Mobile source code.</p></div>
<p>In response to questions from KrebsOnSecurity, T-Mobile issued the following statement:</p>
<p>&#8220;Several weeks ago, our monitoring tools detected a bad actor using stolen credentials to access internal systems that house operational tools software. The systems accessed contained no customer or government information or other similarly sensitive information, and we have no evidence that the intruder was able to obtain anything of value. Our systems and processes worked as designed, the intrusion was rapidly shut down and closed off, and the compromised credentials used were rendered obsolete.&#8221;</p>
<h2>CONSIDER THE SOURCE</h2>
<p>It is not clear why LAPSUS$ was so fixated on stealing source code. Perhaps LAPSUS$ thought they could find in the source clues about security weaknesses that could be used to further hack these companies and their customers. Maybe the group already had buyers lined up for specific source code that they were then hired to procure. Or maybe it was all one big Capture the Flag competition, with source code being the flag. The leaked chats don&#8217;t exactly explain this fixation.</p>
<p>But it seems likely that the group routinely tried to steal and then delete any source code it could find on victim systems. That way, it could turn around and demand a payment to restore the deleted data.</p>
<p><img loading="lazy" class="size-full wp-image-59500 aligncenter" src="media/3031d2eb.lowerlevelsource.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/lowerlevelsource.png" alt="" width="633" height="614" /></p>
<p>In one conversation in late March, a LAPSUS$ member posts screenshots and other data indicating they&#8217;d gained remote administrative access to a multi-billion dollar company. But White is seemingly unimpressed, dismissing the illicit access as not worth the group&#8217;s time because there was no source code to be had.</p>
<p>LAPSUS$ first surfaced in December 2021, when it hacked into Brazil&#8217;s Ministry of Health and deleted more than 50 terabytes of data stored on the ministry&#8217;s hacked servers. The deleted data included information related to the ministry&#8217;s efforts to track and fight the COVID-19 pandemic in Brazil, which has suffered <a href="https://www.nytimes.com/2021/06/24/world/americas/brazil-500000-covid-deaths.html" target="_blank" rel="noopener">a disproportionate 13 percent of the world&#8217;s COVID-19 fatalities</a>. LAPSUS$&#8217;s next 15 victims were based either in Latin America or Portugal, according to cyber threat intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>.</p>
<p>By February 2022, LAPSUS$ had pivoted to targeting high-tech firms based in the United States. On Feb. 26, LAPSUS$ broke into graphics and computing chip maker <strong>NVIDIA</strong>. The group said it stole more than a terabyte of NVIDIA data, including source code and employee credentials.</p>
<p><strong>Dan Goodin</strong> at <em>Ars Technica</em> wrote about LAPSUS$&#8217;s <a href="https://arstechnica.com/information-technology/2022/03/cybercriminals-who-breached-nvidia-issue-one-of-the-most-unusual-demands-ever/" target="_blank" rel="noopener">unusual extortion demand against NVIDIA</a>: The group pledged to publish the stolen code unless NVIDIA agreed to make the drivers for its video cards open-source. According to these chats, NVIDIA responded by connecting to the computer the attackers were using in their attack, and then encrypting the stolen data.</p>
<p>Like many high-tech firms whose value is closely tied to their intellectual property, NVIDIA relies on a number of technologies designed to prevent data leaks or theft. According to LAPSUS$, among those is a requirement that only devices which have been approved or issued by the company can be used to access its virtual private network (VPN).</p>
<p><img loading="lazy" class="alignright size-full wp-image-59502" src="media/0f5513da.mdm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/mdm.png" alt="" width="368" height="264" />These so-called <strong>Mobile Device Management</strong> (MDM) systems retrieve information about the underlying hardware and software powering the system requesting access, and then relay that information along with any login credentials.</p>
<p>In a typical MDM setup, a company will issue employees a laptop or smartphone that has been pre-programmed with a data profile, VPN and other software that allows the employer to track, monitor, troubleshoot or even wipe device data in the event of theft, loss, or a detected breach.</p>
<p>MDM tools also can be used to encrypt or retrieve data from connected systems, and this was purportedly the functionality NVIDIA used to claw back the information stolen by LAPSUS$.</p>
<p>&#8220;Access to NVIDIA employee VPN requires the PC to be enrolled in MDM,&#8221; LAPSUS$ wrote in a post on their public Telegram channel. &#8220;With this they were able to connect to a [virtual machine] that we use. Yes, they successfully encrypted the data. However, we have a backup and it&#8217;s safe from scum!!!&#8221;</p>
<p>NVIDIA declined to comment for this story.</p>
<p>On March 7, consumer electronics giant <strong>Samsung</strong> confirmed what LAPSUS$ had bragged on its Telegram channel: That the group had stolen and leaked nearly 200 GB of source code and other internal company data.</p>
<p>The chats reveal that LAPSUS$ stole a great deal more source code than they bragged about online. One of White&#8217;s curious fascinations was <a href="https://www.crunchbase.com/organization/sascar" target="_blank" rel="noopener">SASCAR</a>, Brazil&#8217;s leading fleet management and freight security company. White had bought and talked his way into SASCAR&#8217;s systems, and had stolen many gigabytes worth of source code for the company&#8217;s fleet tracking software.</p>
<p>It was bad enough that LAPSUS$ had just relieved this company of valuable intellectual property: The chats show that for several days White taunted SASCAR employees who were responding to the then-unfolding breach, at first by defacing the company&#8217;s website with porn.</p>
<p>The messages show White maintained access to the company&#8217;s internal systems for at least 24 hours after that, even sitting in on the company&#8217;s incident response communications where the security team discussed how to evict their tormentors.</p>
<p>SASCAR is owned by tire industry giant <a href="https://www.michelin.com/en/press-releases/michelin-acquires-sascar-brazils-leading-digital-fleet-management-company/" target="_blank" rel="noopener">Michelin</a>, which did not respond to requests for comment.</p>
<h2>ENROLLMENT</h2>
<p>The leaked LAPSUS$ internal chats show the group spent a great deal of time trying to bypass multi-factor authentication for the credentials they&#8217;d stolen. By the time these leaked chat logs were recorded, LAPSUS$ had spent days relentlessly picking on another target that relied on MDM to restrict employee logins: <strong>Iqor</strong>, a customer support outsourcing company based in St. Petersburg, Fla.</p>
<p>LAPSUS$ apparently had no trouble using Russian Market to purchase access to Iqor employee systems. &#8220;I will buy login when on sale, Russians stock it every 3-4 days,&#8221; Amtrak wrote regarding Iqor credentials for sale in the bot shops.</p>
<p>The real trouble for LAPSUS$ came when the group tried to evade Iqor&#8217;s MDM systems by social engineering Iqor employees into removing multi-factor authentication on Iqor accounts they&#8217;d purchased previously. The chats show that time and again Iqor&#8217;s employees simply refused requests to modify multi-factor authentication settings on the targeted accounts, or make any changes unless the requests were coming from authorized devices.</p>
<div id="attachment_59489" style="width: 559px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59489" loading="lazy" class="size-full wp-image-59489" src="media/cf565b18.iqor-ftw.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/iqor-ftw.png" alt="" width="549" height="731" /><p id="caption-attachment-59489" class="wp-caption-text">One of several IQOR support engineers who told LAPSUS$ no over and over again.</p></div>
<p>After many days of trying, LAPSUS$ ultimately gave up on Iqor. On Mar. 22, LAPSUS$ announced it hacked <strong>Microsoft</strong>, and began leaking 37 gigabytes worth of Microsoft source code.</p>
<p>Like NVIDIA, Microsoft was able to stanch some of the bleeding, cutting off LAPSUS$&#8217;s illicit access while the group was in the process of downloading all of the available source code repositories alphabetically (the group publicized their access to Microsoft at the same time they were downloading the software giant&#8217;s source code). As a result, LAPSUS$ was only able to leak the source for Microsoft products at the beginning of the code repository, including Azure, Bing and Cortana.</p>
<h2>BETRAYAL</h2>
<p>LAPSUS$ leader White drew attention to himself prior to the creation of LAPSUS$ last year when he purchased a website called <strong>Doxbin</strong>, a long-running and highly toxic online community that is used to “dox” or post deeply personal information on people.</p>
<p>Based on the feedback posted by Doxbin members, White was not a particularly attentive administrator. Longtime members soon took to harassing him about various components of the site falling into disrepair. That pestering eventually prompted White to sell Doxbin back to its previous owner at a considerable loss. But before doing so, White leaked the Doxbin user database.</p>
<p>White’s leak triggered a swift counterpunch from Doxbin’s staff, which naturally responded by posting on White perhaps the most thorough dox the forum had ever produced &#8212; including videos filmed just outside his home where he lives with his parents in the United Kingdom.</p>
<p>The past and current owner of the Doxbin — an established cybercriminal who goes by the handle “<a href="https://www.twitter.com/kayte" target="_blank" rel="noopener"><strong>KT</strong></a>” &#8212; is the same person who leaked these private LAPSUS$ Telegram chat logs to KrebsOnSecurity.</p>
<p>In early April, multiple news outlets reported that U.K. police had arrested seven people aged 15-21 in connection with the LAPSUS$ investigation. But it seems clear from reading these leaked Telegram chats that individual members of LAPSUS$ were detained and questioned at different times over the course of several months.</p>
<p>In his chats with other LAPSUS$ members during the last week in March, White maintained that he was arrested 1-2 months prior in connection with an intrusion against a victim referred to only by the initials &#8220;BT.&#8221; White also appeared unconcerned when Amtrak admits that the City of London police found LAPSUS$ Telegram chat conversations on his mobile phone.</p>
<p>Perhaps to demonstrate his indifference (or maybe just to screw with Amtrak), White responds by <a href="media/7efd8cf9.parentsknowisimswap.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/parentsknowisimswap.png" target="_blank" rel="noopener">leaking Amtrak&#8217;s real name and phone number to the group&#8217;s public Telegram channel</a>. In an ALL CAPS invective of disbelief at the sudden betrayal, Amtrak relates how various people started calling his home and threatening his parents as a result, and how White effectively outed him to law enforcement and the rest of the world as a LAPSUS$ member.</p>
<p><img loading="lazy" class="aligncenter wp-image-59487" src="media/e8ba7e48.amtraxdox.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/amtraxdox.png" alt="" width="745" height="206" /></p>
<p>The vast majority of noteworthy activity documented in these private chats takes place between White and Amtrak, but it doesn&#8217;t seem that White counted Amtrak or any of his fellow LAPSUS$ members as friends or confidants. On the contrary, White generally behaved horribly toward everyone in the group, and he particularly seemed to enjoy abusing Amtrak (who somehow always came back for more).</p>
<p>&#8220;<strong>Mox</strong>,&#8221; one of the LAPSUS$ members who shows up throughout these leaked chats, helped the group in their unsuccessful attempts to enroll their mobile devices with an airline in the Middle East to which they had purchased access. Audio recordings leaked from the group&#8217;s private Telegram channel include a call wherein Mox can be heard speaking fluently in Arabic and impersonating an airline employee.</p>
<p>At one point, Mox&#8217;s first name briefly shows up in a video he made and shared with the group, and Mox mentions that he lives in the United States. White then begins trying to find and leak Mox&#8217;s real-life identity.</p>
<p>When Mox declares he&#8217;s so scared he wants to delete his iCloud account, White suggests he can get Mox&#8217;s real name, precise location and other information by making <a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">a fraudulent &#8220;emergency data request&#8221; (EDR)</a> to <strong>Apple</strong>, in which they use a hacked police department email account to request emergency access to subscriber information under the claim that the request can&#8217;t wait for a warrant because someone&#8217;s life is on the line.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-59515" src="media/30f859b0.edrtooapple.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/edrtooapple.png" alt="" width="633" height="161" /></p>
<p>White was no stranger to fake EDRs. White was a founding member of a cybercriminal group called “<a href="https://web.archive.org/web/20210410013319/http://recursion.team/" target="_blank" rel="noopener">Recursion Team,</a>” which existed between 2020 and 2021. This group mostly specialized in SIM swapping targets of interest and participating in <a href="https://krebsonsecurity.com/?s=swatting" target="_blank" rel="noopener">“swatting” attacks</a>, wherein fake bomb threats, hostage situations and other violent scenarios are phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address.</p>
<div id="attachment_59127" style="width: 768px" class="wp-caption aligncenter"><a href="media/bb2ea96b.infinityrecursion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59127" loading="lazy" class="wp-image-59127" src="media/bb2ea96b.infinityrecursion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion.png" alt="" width="758" height="630" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion.png 864w, https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion-768x638.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/infinityrecursion-782x650.png 782w" sizes="(max-width: 758px) 100vw, 758px" /></a><p id="caption-attachment-59127" class="wp-caption-text">The roster of the now-defunct &#8220;Infinity Recursion&#8221; hacking team, from which some members of LAPSUS$ hail.</p></div>
<p>The Recursion Team was founded by a then 14-year-old from the United Kingdom who used the handle “<strong>Everlynn</strong>.” On April 5, 2021, Everlynn posted a new sales thread to the cybercrime forum cracked[.]to titled, “Warrant/subpoena service (get law enforcement data from any service).” The price: $100 to $250 per request.</p>
<div id="attachment_59126" style="width: 715px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59126" loading="lazy" class="size-full wp-image-59126" src="media/829faddc.infinity-warrant.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/infinity-warrant.png" alt="" width="705" height="713" /><p id="caption-attachment-59126" class="wp-caption-text">Everlynn advertising a warrant/subpoena service based on fake EDRs.</p></div>
<p>As part of the Recursion Team, White used the alias &#8220;<strong>Peter</strong>.&#8221; Several LAPSUS$ members quizzed White and Amtrak about whether authorities asked about Recursion Team during questioning. In several discussion threads, White&#8217;s &#8220;Lapsus Jobs&#8221; alias on Telegram answers &#8220;yes?&#8221; or &#8220;I&#8217;m here&#8221; when another member addresses him by Peter.</p>
<p>White dismissed his public doxing of both Amtrak and Mox as their fault for being sloppy with operational security, or by claiming that everyone already knew their real identities. Incredibly, just a few minutes after doxing Amtrak, White nonchalantly asks him for help in stealing source code from yet another victim firm &#8212; as if nothing had just happened between them. Amtrak seems soothed by this invitation, and agrees to help.</p>
<p>On Mar. 30, software consultancy giant <strong>Globant</strong> was forced to acknowledge a hack after <a href="https://techcrunch.com/2022/03/30/lapsus-globant-breach/" target="_blank" rel="noopener">LAPSUS$ published 70 gigabytes of data stolen from the company</a>, including customers&#8217; source code. While the Globant hack has been widely reported for weeks, the cause of the breach remained hidden in these stolen logs: A stolen five-year-old access token for Globant&#8217;s network that still worked.</p>
<div id="attachment_59481" style="width: 647px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59481" loading="lazy" class="size-full wp-image-59481" src="media/f8e2f2b8.globant-howtf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/globant-howtf.png" alt="" width="637" height="764" /><p id="caption-attachment-59481" class="wp-caption-text">LAPSUS$ members marvel at a 5-year-old stolen authentication cookie still working when they use it against Globant to steal source code.</p></div>
<p>Globant lists a number of high-profile customers on its website, including the U.K. Metropolitan Police, software house Autodesk and gaming giant <strong>Electronic Arts</strong>. In March, KrebsOnSecurity showed how <a href="https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/" target="_blank" rel="noopener">White was connected to the theft of 780 GB worth of source code from Electronic Arts last summer</a>.</p>
<p>In that attack, the intruders reportedly gained access to EA&#8217;s data after purchasing authentication cookies for an EA Slack channel from the dark web marketplace &#8220;<a href="media/a9ac02a4.genesisshop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop.png" target="_blank" rel="noopener">Genesis</a>,&#8221; which offers more or less the same wares as the Russian Market.</p>
<p>One remarkable aspect of LAPSUS$ was that its members apparently decided not to personally download or store any data they stole from companies they hacked. They were all so paranoid of police raiding their homes that they assiduously kept everything &#8220;in the cloud.&#8221; That way, when investigators searched their devices, they would find no traces of the stolen information.</p>
<p>But this strategy ultimately backfired: Shortly before the private LAPSUS$ chat was terminated, the group learned it had just lost access to the Amazon AWS server it was using to store months of source code booty and other stolen data.</p>
<p>&#8220;RIP FBI seized my server,&#8221; Amtrak <a href="media/f5e8afea.fbiseizedmyserver.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/fbiseizedmyserver.png" target="_blank" rel="noopener">wrote.</a> &#8220;So much illegal shit. It&#8217;s filled with illegal shit.&#8221;</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-59496" src="media/dc7cc78c.somuchillegalshit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/somuchillegalshit.png" alt="" width="633" height="716" /></p>
<p>White shrugs it off with the dismissive comment, &#8220;U can&#8217;t do anything about ur server seized.&#8221; Then Amtrak replies that <em>he never made a backup of the server</em>.</p>
<p>&#8220;FFS, THAT AWS HAD TMO SRC [T-Mobile source] code!&#8221; White yelled back.</p>
<p>The two then make a mad scramble to hack back into T-Mobile and re-download the stolen source code. But that effort ultimately failed after T-Mobile&#8217;s systems revoked the access token they were using to raid the company&#8217;s source code stash.</p>
<p>&#8220;How they noticed?&#8221; Amtrak asked White.</p>
<p>&#8220;Gitlab auto-revoked, likely,&#8221; White replied. &#8220;Cloning 30k repos four times in 24 hours isn&#8217;t very normal.&#8221;</p>
<p>Ah, the irony of a criminal hacking group that specializes in stealing and deleting data having their stolen data deleted.</p>
<p>It&#8217;s remarkable how often LAPSUS$ was able to pay a few dollars to buy access to some hacked machine at a company they wanted to break into, and then successfully parlay that into the theft of source code and other sensitive information.</p>
<p>What&#8217;s even more remarkable is that anyone can access dark web bot shops like Russian Market and Genesis, which means larger companies probably should be paying someone to regularly scrape these criminal bot services, even buying back their own employee credentials to take those vulnerable systems off the market. Because that&#8217;s probably the simplest and cheapest incident response money can buy.</p>
<div id="attachment_58210" style="width: 774px" class="wp-caption aligncenter"><a href="media/a9ac02a4.genesisshop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-58210" loading="lazy" class="wp-image-58210" src="media/a9ac02a4.genesisshop.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop.png" alt="" width="764" height="500" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop.png 1240w, https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop-768x503.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/01/genesisshop-782x512.png 782w" sizes="(max-width: 764px) 100vw, 764px" /></a><p id="caption-attachment-58210" class="wp-caption-text">The Genesis bot shop.</p></div>


feed_id: https://krebsonsecurity.com/?p=59232
title: Fighting Fake EDRs With ‘Credit Ratings’ for Police
uri: Fighting-Fake-EDRs-With-Credit-Ratings-for-Police
url: https://krebsonsecurity.com/2022/04/fighting-fake-edrs-with-credit-ratings-for-police/
content:
<p>When KrebsOnSecurity recently explored how cybercriminals were using <a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">hacked email accounts at police departments worldwide</a> to obtain warrantless <strong>Emergency Data Requests</strong> (EDRs) from social media firms and technology providers, many security experts called it a fundamentally unfixable problem. But don&#8217;t tell that to <strong>Matt Donahue</strong>, a former FBI agent who recently quit the agency to launch a startup that aims to help tech companies do a better job screening out phony law enforcement data requests &#8212; in part by assigning trustworthiness or &#8220;credit ratings&#8221; to law enforcement authorities worldwide.</p>
<div id="attachment_59587" style="width: 765px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59587" class=" wp-image-59587" src="media/39f82e1f.kodex.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/kodex.png" alt="" width="755" height="521" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/kodex.png 635w, https://krebsonsecurity.com/wp-content/uploads/2022/04/kodex-100x70.png 100w" sizes="(max-width: 755px) 100vw, 755px" /><p id="caption-attachment-59587" class="wp-caption-text">A sample Kodex dashboard. Image: Kodex.us.</p></div>
<p>Donahue is co-founder of <a href="https://www.kodex.us/" target="_blank" rel="noopener">Kodex</a>, a company formed in February 2021 that builds security portals designed to help tech companies &#8220;manage information requests from government agencies who contact them, and to securely transfer data &amp; collaborate against abuses on their platform.&#8221;</p>
<p>The 30-year-old Donahue said he left the FBI in April 2020 to start Kodex because it was clear that social media and technology companies needed help validating the increasingly large number of law enforcement requests domestically and internationally.</p>
<p>&#8220;So much of this is such an antiquated, manual process,&#8221; Donahue said of his perspective gained at the FBI. &#8220;In a lot of cases we&#8217;re still sending faxes when more secure and expedient technologies exist.&#8221;</p>
<p>Donahue said when he brought the subject up with his superiors at the FBI, they would kind of shrug it off, as if to say, &#8220;This is how it&#8217;s done and there&#8217;s no changing it.&#8221;</p>
<p>&#8220;My bosses told me I was committing career suicide doing this, but I genuinely believe fixing this process will do more for national security than a 20-year career at the FBI,&#8221; he said. &#8220;This is such a bigger problem than people give it credit for, and that&#8217;s why I left the bureau to start this company.&#8221;</p>
<p>One of the stated goals of Kodex is to build a scoring or reputation system for law enforcement personnel who make these data requests. After all, there are tens of thousands of police jurisdictions around the world — including roughly <a href="https://en.wikipedia.org/wiki/Law_enforcement_in_the_United_States#:~:text=There%20are%2017%2C985%20U.S.%20police,and%20federal%20law%20enforcement%20agencies." target="_blank" rel="noopener">18,000 in the United States alone</a> — and all it takes for hackers to abuse the EDR process is illicit access to a single police email account.</p>
<p>Kodex is trying to tackle the problem of fake EDRs by working directly with the data providers to pool information about police or government officials submitting these requests, and hopefully making it easier for all customers to spot an unauthorized EDR.</p>
<p>Kodex&#8217;s first big client was cryptocurrency giant <strong>Coinbase</strong>, which confirmed their partnership but otherwise declined to comment for this story. <strong>Twilio</strong> confirmed it uses Kodex&#8217;s technology for law enforcement requests destined for any of its business units, but likewise declined to comment further.</p>
<p>Within their own separate Kodex portals, Twilio can&#8217;t see requests submitted to Coinbase, or vice versa. But each can see if a law enforcement entity or individual tied to one of their own requests has ever submitted a request to a different Kodex client, and then drill down further into other data about the submitter, such as Internet address(es) used, and the age of the requestor&#8217;s email address.</p>
<p>Donahue said in Kodex&#8217;s system, each law enforcement entity is assigned a credit rating, wherein officials who have a long history of sending valid legal requests will have a higher rating than someone sending an EDR for the first time.</p>
<p>&#8220;In those cases, we warn the customer with a flash on the request when it pops up that we&#8217;re allowing this to come through because the email was verified [as being sent from a valid police or government domain name], but we&#8217;re trying to verify the emergency situation for you, and we will change that rating once we get new information about the emergency,&#8221; Donahue said.</p>
<p>&#8220;This way, even if one customer gets a fake request, we&#8217;re able to prevent it from happening to someone else,&#8221; he continued. &#8220;In a lot of cases with fake EDRs, you can see the same email [address] being used to message different companies for data. And that&#8217;s the problem: So many companies are operating in their own silos and are not able to share information about what they&#8217;re seeing, which is why we&#8217;re seeing scammers exploit this good faith process of EDRs.&#8221;</p>
<h2>NEEDLES IN THE HAYSTACK</h2>
<p>As social media and technology platforms have grown over the years, so have the volumes of requests from law enforcement agencies worldwide for user data. For example, in its <a href="https://www.verizon.com/about/investors/transparency-report" target="_blank" rel="noopener">latest transparency report</a> mobile giant <strong>Verizon</strong> reported receiving 114,000 data requests of all types from U.S. law enforcement entities in the second half of 2021.</p>
<p>Verizon said <em>approximately 35,000 of those requests (~30 percent) were EDRs</em>, and that it provided data in roughly 91 percent of those cases. The company doesn&#8217;t disclose how many EDRs came from foreign law enforcement entities during that same time period. Verizon currently asks law enforcement officials to send these requests via fax.</p>
<p>Validating legal requests by domain name may be fine for data demands that include documents like subpoenas and search warrants, which can be validated with the courts. But not so for EDRs, which largely bypass any official review and <em>do not require the requestor to submit any court-approved documents</em>.</p>
<p>Police and government authorities can legitimately request EDRs to learn the whereabouts or identities of people who have posted online about plans to harm themselves or others, or in other exigent circumstances such as a child abduction or abuse, or a potential terrorist attack.</p>
<p>But as KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">reported in March</a>, it is now clear that crooks have figured out there is no quick and easy way for a company that receives one of these EDRs to know whether it is legitimate. Using illicit access to hacked police email accounts, the attackers will send a fake EDR along with an attestation that innocent people will likely suffer greatly or die unless the requested data is provided immediately.</p>
<p>In this scenario, the receiving company finds itself caught between two unsavory outcomes: Failing to immediately comply with an EDR — and potentially having someone’s blood on their hands — or possibly leaking a customer record to the wrong person. That might explain why the compliance rate for EDRs is usually quite high &#8212; often upwards of 90 percent.</p>
<p>Fake EDRs have become such a reliable method in the cybercrime underground for obtaining information about account holders that several cybercriminals have started offering services that will submit these fraudulent EDRs on behalf of paying clients to a number of top social media and technology firms.<span id="more-59232"></span></p>
<div id="attachment_59126" style="width: 771px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59126" loading="lazy" class=" wp-image-59126" src="media/829faddc.infinity-warrant.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/infinity-warrant.png" alt="" width="761" height="770" /><p id="caption-attachment-59126" class="wp-caption-text">A fake EDR service advertised on a hacker forum in 2021.</p></div>
<p>An individual who&#8217;s part of the community of crooks that are abusing fake EDR told KrebsOnSecurity the schemes often involve hacking into police department emails by first compromising the agency’s website. From there, they can drop a backdoor “shell” on the server to secure permanent access, and then create new email accounts within the hacked organization.</p>
<p>In other cases, hackers will try to guess the passwords of police department email systems. In these attacks, the hackers will identify email addresses associated with law enforcement personnel, and then attempt to authenticate using passwords those individuals have used at other websites that have been breached previously.</p>
<h2>EDR OVERLOAD?</h2>
<p>Donahue said depending on the industry, EDRs make up between 5 percent and 30 percent of the total volume of requests. In contrast, he said, EDRs amount to less than three percent of the requests sent through Kodex portals used by customers.</p>
<p>KrebsOnSecurity sought to verify those numbers by compiling EDR statistics based on annual or semi-annual transparency reports from some of the largest technology and social media firms. While there are no available figures on the number of fake EDRs each provider is receiving each year, those phony requests can easily hide amid an increasingly heavy torrent of legitimate demands.</p>
<p><strong>Meta/Facebook</strong> <a href="https://transparency.fb.com/data/government-data-requests/data-types/" target="_blank" rel="noopener">says</a> roughly 11 percent of all law enforcement data requests &#8212; 21,700 of them &#8212; were EDRs in the first half of 2021. Almost 80 percent of the time the company produced at least some data in response. Facebook has long used its own online portal where law enforcement officials must first register before submitting requests.</p>
<div id="attachment_59601" style="width: 766px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59601" loading="lazy" class=" wp-image-59601" src="media/05dcbdb6.fbgovtdatareq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/fbgovtdatareq.png" alt="" width="756" height="462" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/fbgovtdatareq.png 1009w, https://krebsonsecurity.com/wp-content/uploads/2022/04/fbgovtdatareq-768x470.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/fbgovtdatareq-782x478.png 782w" sizes="(max-width: 756px) 100vw, 756px" /><p id="caption-attachment-59601" class="wp-caption-text">Government data requests, including EDRs, received by Facebook over the years. Image: Meta Transparency Report.</p></div>
<p><strong>Apple</strong> <a href="https://www.apple.com/legal/transparency/emergency-requests.html" target="_blank" rel="noopener">said</a> it received 1,162 emergency requests for data in the last reporting period it made public &#8212; July &#8211; December 2020. Apple&#8217;s compliance with EDRs was 93 percent worldwide in 2020. Apple&#8217;s website says it accepts EDRs via email, after applicants have filled out a supplied PDF form. [As a lifelong Apple user and customer, I was floored to learn that the richest company in the world &#8212; which for several years has banked heavily on privacy and security promises to customers &#8212; still relies on email for such sensitive requests].</p>
<p><strong>Twitter</strong> <a href="https://transparency.twitter.com/en/reports/information-requests.html#2021-jan-jun" target="_blank" rel="noopener">says</a> it received 1,860 EDRs in the first half of 2021, or roughly 15 percent of the global information requests sent to Twitter. Twitter accepts EDRs via an interactive form on the company&#8217;s website. Twitter reports that EDRs decreased by 25% during this reporting period, while the aggregate number of accounts specified in these requests decreased by 15%. The United States submitted the highest volume of global emergency requests (36%), followed by Japan (19%), and India (12%).</p>
<p><strong>Discord</strong> <a href="https://discord.com/blog/discord-transparency-report-h1-2021" target="_blank" rel="noopener">reported</a> receiving 378 requests for emergency data disclosure in the first half of 2021. Discord accepts EDRs via a specified email address.</p>
<p>For the six months ending in December 2021, <strong>Snapchat</strong> <a href="https://snap.com/en-US/privacy/transparency/legal-requests" target="_blank" rel="noopener">said</a> it received 2,085 EDRs from authorities in the United States (with a 59 percent compliance rate), and another 1,448 from international police (64 percent granted). Snapchat has a form for submitting EDRs on its website.</p>
<p><strong>TikTok</strong>&#8216;s <a href="https://www.tiktok.com/transparency/en-us/information-requests-2021-1" target="_blank" rel="noopener">resources on government data requests</a> currently lead to a &#8220;Page not found&#8221; error, but a company spokesperson said TikTok received 715 EDRs in the first half of 2021. That&#8217;s up from 409 EDRs in the previous six months. Tiktok handles EDRs via a form on its website.</p>
<p>The current transparency reports for both <strong>Google</strong> and <strong>Microsoft</strong> do not break out EDRs by category. Microsoft <a href="https://www.microsoft.com/en-us/corporate-responsibility/law-enforcement-requests-report" target="_blank" rel="noopener">says</a> that in the second half of 2021 it received more than 25,000 government requests, and that it complied at least partly with those requests more than 90 percent of the time.</p>
<p>Microsoft runs its own portal that law enforcement officials must register at to submit legal requests, but that portal doesn&#8217;t accept requests for other Microsoft properties, such as <a href="https://www.linkedin.com/legal/transparency" target="_blank" rel="noopener">LinkedIn</a> or <a href="https://github.blog/2021-02-25-2020-transparency-report/" target="_blank" rel="noopener">Github</a>.</p>
<p>Google <a href="https://transparencyreport.google.com/user-data/overview?hl=en" target="_blank" rel="noopener">said</a> it received more than 113,000 government requests for user data in the last half of 2020, and that about 76 percent of the requests resulted in the disclosure of some user information. Google doesn&#8217;t publish EDR numbers, and it did not respond to requests for those figures. Google also runs its own portal for accepting law enforcement data requests.</p>
<p><strong>Verizon</strong> <a href="media/7c54b01c.US-Transparency-Report-2H-2021.pdf" data-original-source="https://www.verizon.com/about/sites/default/files/2022-04/US-Transparency-Report-2H-2021.pdf" target="_blank" rel="noopener">reports</a> (PDF) receiving more than 35,000 EDRs from just U.S. law enforcement in the second half of 2021, out of a total of 114,000 law enforcement requests (Verizon doesn&#8217;t disclose how many EDRs came from foreign law enforcement entities). Verizon said it complied with approximately 91 percent of requests. The company accepts law enforcement requests via snail mail or fax.</p>
<div id="attachment_59603" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59603" loading="lazy" class="size-full wp-image-59603" src="media/7ca2efb5.vzgovdatareq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/vzgovdatareq.png" alt="" width="747" height="660" /><p id="caption-attachment-59603" class="wp-caption-text">Image: Verizon.com.</p></div>
<p><strong>AT&amp;T</strong> <a href="media/d014cc25.2022-February-Transparency-Report.pdf" data-original-source="https://about.att.com/content/dam/csr/2019/transparency/2022/2022-February-Transparency-Report.pdf" target="_blank" rel="noopener">says</a> (PDF) it received nearly 19,000 EDRs in the second half of 2021; it provided some data roughly 95 percent of the time. AT&amp;T requires EDRs to be faxed.</p>
<p>The <a href="media/8ed0c133.2020-Transparency-Report.pdf" data-original-source="https://www.t-mobile.com/news/_admin/uploads/2021/07/2020-Transparency-Report.pdf" target="_blank" rel="noopener">most recent transparency report</a> published by <strong>T-Mobile</strong> says the company received more than 164,000 &#8220;emergency/911&#8221; requests in 2020 &#8212; but it does not specifically call out EDRs. Like its old school telco brethren, T-Mobile requires EDRs to be faxed. T-Mobile did not respond to requests for more information.</p>
<div id="attachment_59602" style="width: 691px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59602" loading="lazy" class=" wp-image-59602" src="media/bbaed1db.tmobgovdatareq.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/tmobgovdatareq.png" alt="" width="681" height="478" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/tmobgovdatareq.png 635w, https://krebsonsecurity.com/wp-content/uploads/2022/04/tmobgovdatareq-100x70.png 100w" sizes="(max-width: 681px) 100vw, 681px" /><p id="caption-attachment-59602" class="wp-caption-text">Data from T-Mobile&#8217;s most recent transparency report in 2020. Image: T-Mobile.</p></div>


feed_id: https://krebsonsecurity.com/?p=59639
title: You Can Now Ask Google to Remove Your Phone Number, Email or Address from Search Results
uri: You-Can-Now-Ask-Google-to-Remove-Your-Phone-Number-Email-or-Address-f
url:
https://krebsonsecurity.com/2022/04/you-can-now-ask-google-to-remove-your-phone-number-email-or-address-from-search-results/

content:
<p><strong>Google</strong> said this week it is expanding the types of data people can ask to have removed from search results, to include personal contact information like your phone number, email address or physical address. The move comes just months after Google rolled out a new policy enabling people under the age of 18 (or a parent/guardian) to request removal of their images from Google search results.</p>
<p><img class="aligncenter size-full wp-image-59643" src="media/a9a2c4bb.googledoxx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/googledoxx.png" alt="" width="748" height="704" /></p>
<p>Google has for years accepted requests to remove certain sensitive data such as bank account or credit card numbers from search results. In <a href="https://blog.google/products/search/new-options-for-removing-your-personally-identifiable-information-from-search/" target="_blank" rel="noopener">a blog post on Wednesday</a>, Google&#8217;s <strong>Michelle Chang</strong> wrote that the company&#8217;s expanded policy now allows for the removal of additional information that may pose a risk for identity theft, such as confidential log-in credentials, email addresses and phone numbers when it appears in Search results.</p>
<p>&#8220;When we receive removal requests, we will evaluate all content on the web page to ensure that we&#8217;re not limiting the availability of other information that is broadly useful, for instance in news articles,&#8221; Chang wrote. &#8220;We&#8217;ll also evaluate if the content appears as part of the public record on the sites of government or official sources. In such cases, we won&#8217;t make removals.&#8221;</p>
<p>Google says a removal request will be considered if the search result in question includes the presence of &#8220;explicit or implicit threats&#8221; or &#8220;explicit or implicit calls to action for others to harm or harass.&#8221; The company says if it approves your request, it may respond by removing the provided URL(s) for all queries, or for only queries including your name.</p>
<p>While Google&#8217;s removal of a search result from its index will do nothing to remove the offending content from the site that is hosting it, getting a link decoupled from Google search results is going to make the content at that link far less visible. According to recent estimates, Google enjoys somewhere near 90 percent market share in search engine usage.</p>
<p>KrebsOnSecurity decided to test this expanded policy with what would appear to be a no-brainer request: I asked Google to remove search result for <a href="https://krebsonsecurity.com/?s=briansclub" target="_blank" rel="noopener">BriansClub</a>, one of the largest (if not THE largest) cybercrime stores for selling stolen payment card data.</p>
<p>BriansClub has long abused my name and likeness to pimp its wares on the hacking forums. Its homepage includes a copy of my credit report, Social Security card, phone bill, and a fake but otherwise official looking government ID card. <span id="more-59639"></span></p>
<div id="attachment_59647" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59647" loading="lazy" class=" wp-image-59647" src="media/5b7cf2e7.bclogin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/bclogin.png" alt="" width="754" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/04/bclogin.png 1133w, https://krebsonsecurity.com/wp-content/uploads/2022/04/bclogin-768x501.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/04/bclogin-782x510.png 782w" sizes="(max-width: 754px) 100vw, 754px" /><p id="caption-attachment-59647" class="wp-caption-text">The login page for perhaps the most bustling cybercrime store for stolen payment card data.</p></div>
<p>Briansclub updated its homepage with this information in 2019, after it got massively hacked and <a href="https://krebsonsecurity.com/2019/10/briansclub-hack-rescues-26m-stolen-cards/" target="_blank" rel="noopener">a copy of its customer database was shared with this author</a>. The leaked data &#8212; which included 26 million credit and debit card records taken from hacked online and brick-and-mortar retailers &#8212; was ultimately shared with dozens of financial institutions.</p>
<p><em>TechCrunch</em> <a href="https://techcrunch.com/2022/04/28/google-request-removal-personal-contact-information-search-results/" target="_blank" rel="noopener">writes</a> that the policy expansion comes six months after Google started allowing people under 18 or their parents request to delete their photos from search results. To <a href="https://support.google.com/websearch/answer/10949130?hl=en" target="_blank" rel="noopener">do so</a>, users need to specify that they want Google to remove “Imagery of an individual currently under the age of 18” and provide some personal information, the image URLs and search queries that would surface the results. Google also lets you submit requests to remove non-consensual explicit or intimate personal images from Google, along with involuntary fake pornography, TechCrunch notes.</p>
<p>This post will be updated in the event Google responds one way or the other, but that may take a while: Google&#8217;s automated response said: &#8220;Due to the preventative measures being taken for our support specialists in light of COVID-19, it may take longer than usual to respond to your support request. We apologize for any inconvenience this may cause, and we’ll send you a reply as soon as we can.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=59685
title: Russia to Rent Tech-Savvy Prisoners to Corporate IT?
uri: Russia-to-Rent-Tech-Savvy-Prisoners-to-Corporate-IT
url: https://krebsonsecurity.com/2022/05/russia-to-rent-tech-savvy-prisoners-to-corporate-it/
content:
<div id="attachment_59692" style="width: 745px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59692" src="media/0dfedc70.ruprisonhacker.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/ruprisonhacker.png" alt="" width="735" height="489" class="size-full wp-image-59692" /><p id="caption-attachment-59692" class="wp-caption-text">Image: Proxima Studios, via Shutterstock.</p></div>
<p>Faced with a brain drain of smart people fleeing the country following its invasion of Ukraine, the Russian Federation is floating a new strategy to address a worsening shortage of qualified information technology experts: Forcing tech-savvy people within the nation&#8217;s prison population to perform low-cost IT work for domestic companies.</p>
<p>Multiple Russian news outlets published stories on April 27 saying the Russian <strong>Federal Penitentiary Service</strong> had announced a plan to recruit IT specialists from Russian prisons to work remotely for domestic commercial companies.</p>
<p>Russians sentenced to forced labor will serve out their time at one of many correctional centers across dozens of Russian regions, usually at the center that is closest to their hometown. <strong>Alexander Khabarov</strong>, deputy head of Russia&#8217;s penitentiary service, said his agency had received proposals from businessmen in different regions to involve IT specialists serving sentences in correctional centers to work remotely for commercial companies.</p>
<p>Khabarov told Russian media outlets that under the proposal people with IT skills at these facilities would labor only in IT-related roles, but would not be limited to working with companies in their own region.</p>
<p>&#8220;We are approached with this initiative in a number of territories, in a number of subjects by entrepreneurs who work in this area,&#8221; Khabarov told <a href="https://www.rbc.ru/society/27/04/2022/626914459a7947739ffe8d31" rel="noopener" target="_blank">Russian state media organization TASS</a>. &#8220;We are only at the initial stage. If this is in demand, and this is most likely in demand, we think that we will not force specialists in this field to work in some other industries.&#8221;</p>
<p>According to Russian media site Lenta.ru, since March 21 nearly <a href="https://lenta.ru/news/2022/04/04/vaccc/" rel="noopener" target="_blank">95,000 vacancies in IT have remained unfilled in Russia</a>. Lenta says the number unfilled job slots actually shrank 25 percent from the previous month, officially because &#8220;many Russian companies are currently reviewing their plans and budgets, and some projects have been postponed.&#8221; The story fails to even mention the recent economic sanctions that are currently affecting many Russian companies thanks to Russia&#8217;s invasion of Ukraine in late February.<span id="more-59685"></span></p>
<p>The <strong>Russian Association for Electronic Communications</strong> (RAEC) estimated recently that between 70,000 and 100,000 people will leave Russia as part of the second wave of emigration of IT specialists from Russia. &#8220;The study also notes that the number of IT people who want to leave Russia is growing. Experts consider the USA, Germany, Georgia, Cyprus and Canada to be the most attractive countries for moving,&#8221; Lenta reported of the RAEC survey.</p>
<p>It&#8217;s not clear how many &#8220;IT specialists&#8221; are currently serving prison time in Russia, or precisely what that might mean in terms of an inmate&#8217;s IT skills and knowledge. According to <a href="http://news.bbc.co.uk/2/shared/spl/hi/uk/06/prisons/html/nn2page1.stm" rel="noopener" target="_blank">the BCC</a>, about half of the world&#8217;s prison population is held in the United States, Russia or China. The BCC says Russia currently houses nearly 875,000 inmates, or about 615 inmates for every 100,000 citizens. The United States has an even higher incarceration rate (737/100,000), but also a far larger total prison population of nearly 2.2 million.</p>
<p><strong>Sergei Boyarsky</strong>, deputy chairman of the Russian Duma&#8217;s Committee on Information Policy, said the idea was worth pursuing if indeed there are a significant number of IT specialists who are already incarcerated in Russia.</p>
<p>&#8220;I know that we have a need in general for IT specialists, this is a growing market,&#8221; said Boyarsky, who was among the Russian leaders sanctioned by the United States Treasury on Marc. 24, 2022 in response to the Russian invasion of Ukraine. Boyarsky is head of the St. Petersburg branch of <a href="https://en.wikipedia.org/wiki/United_Russia" rel="noopener" target="_blank">United Russia</a>, a strongly pro-Putin political party that holds more than 70 percent of the seats in the Russian State Duma. </p>
<p>&#8220;Since they still work there, it would probably be right to give people with a profession that allows them to work remotely not to lose their qualifications,&#8221; Boyarsky was <a href="https://lenta.ru/news/2022/04/27/ocenili/" rel="noopener" target="_blank">quoted as saying of potentially qualified inmates</a>. &#8220;At a minimum, this proposal is worth attention and discussion if there are a lot of such specialists.&#8221;</p>
<p>According to Russia&#8217;s penitentiary service, the average salary of those sentenced to forced labor is about 20,000 rubles per month, or approximately USD $281. Russian news outlet <a href="https://www.rbc.ru/society/27/05/2021/60aeecac9a7947178ce8708d" rel="noopener" target="_blank">RBC reports</a> that businesses started using prison labor after the possibility of creating correctional centers in organizations appeared in 2020. RBC notes that Russia now has 117 such centers across 76 Russian regions.</p>


feed_id: https://krebsonsecurity.com/?p=59727
title: Your Phone May Soon Replace Many of Your Passwords
uri: Your-Phone-May-Soon-Replace-Many-of-Your-Passwords
url: https://krebsonsecurity.com/2022/05/your-phone-may-soon-replace-many-of-your-passwords/
content:
<p><strong>Apple</strong>, <strong>Google</strong> and <strong>Microsoft</strong> announced this week they will soon support an approach to authentication that avoids passwords altogether, and instead requires users to merely unlock their smartphones to sign in to websites or online services. Experts say the changes should help defeat many types of phishing attacks and ease the overall password burden on Internet users, but caution that a true passwordless future may still be years away for most websites.</p>
<div id="attachment_59741" style="width: 772px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59741" class=" wp-image-59741" src="media/a352b1b5.googlefidoeg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/googlefidoeg.png" alt="" width="762" height="492" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/googlefidoeg.png 805w, https://krebsonsecurity.com/wp-content/uploads/2022/05/googlefidoeg-768x496.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/googlefidoeg-782x505.png 782w" sizes="(max-width: 762px) 100vw, 762px" /><p id="caption-attachment-59741" class="wp-caption-text">Image: Blog.google</p></div>
<p>The tech giants are part of an industry-led effort to replace passwords, which are easily forgotten, frequently stolen by malware and phishing schemes, or leaked and sold online in the wake of corporate data breaches.</p>
<p>Apple, Google and Microsoft are some of the more active contributors to a passwordless sign-in standard crafted by the FIDO (&#8220;Fast Identity Online&#8221;) Alliance and the <a href="https://en.wikipedia.org/wiki/World_Wide_Web_Consortium" target="_blank" rel="noopener">World Wide Web Consortium</a> (W3C), groups that have been working with hundreds of tech companies over the past decade to develop a new login standard that works the same way across multiple browsers and operating systems.</p>
<p>According to the FIDO Alliance, users will be able to sign in to websites through the same action that they take multiple times each day to unlock their devices &#8212; including a device PIN, or a biometric such as a fingerprint or face scan.</p>
<p>&#8220;This new approach protects against phishing and sign-in will be radically more secure when compared to passwords and legacy multi-factor technologies such as one-time passcodes sent over SMS,&#8221; the alliance wrote on May 5.</p>
<p><strong>Sampath Srinivas</strong>, director of security authentication at Google and president of the FIDO Alliance, said that under the new system your phone will store a FIDO credential called a &#8220;passkey&#8221; which is used to unlock your online account.</p>
<p>&#8220;The passkey makes signing in far more secure, as it’s based on public key cryptography and is only shown to your online account when you unlock your phone,&#8221; Srinivas wrote. &#8220;To sign into a website on your computer, you’ll just need your phone nearby and you’ll simply be prompted to unlock it for access. Once you’ve done this, you won’t need your phone again and you can sign in by just unlocking your computer.&#8221;</p>
<p>As <em>ZDNet</em> <a href="https://www.zdnet.com/article/google-apple-microsoft-make-a-new-commitment-for-a-passwordless-future/" target="_blank" rel="noopener">notes</a>, Apple, Google and Microsoft already support these passwordless standards (e.g. &#8220;Sign in with Google&#8221;), but users need to sign in at every website to use the passwordless functionality. Under this new system, users will be able to automatically access their passkey on many of their devices &#8212; without having to re-enroll every account &#8212; and use their mobile device to sign into an app or website on a nearby device.</p>
<p><strong>Johannes Ullrich</strong>, dean of research for the <a href="https://www.sans.org" target="_blank" rel="noopener">SANS Technology Institute</a>, called the announcement &#8220;by far the most promising effort to solve the authentication challenge.&#8221;</p>
<p>&#8220;The most important part of this standard is that it will not require users to buy a new device, but instead they may use devices they already own and know how to use as authenticators,&#8221; Ullrich said.</p>
<p><strong>Steve Bellovin</strong>, a computer science professor at Columbia University and an early internet <a href="https://www.cs.columbia.edu/~smb/" target="_blank" rel="noopener">researcher and pioneer</a>, called the passwordless effort a &#8220;huge advance&#8221; in authentication, but said it will take a very long time for many websites to catch up.</p>
<p>Bellovin and others say one potentially tricky scenario in this new passwordless authentication scheme is what happens when someone loses their mobile device, or their phone breaks and they can&#8217;t recall their iCloud password.</p>
<p>&#8220;I worry about people who can&#8217;t afford an extra device, or can&#8217;t easily replace a broken or stolen device,&#8221; Bellovin said. &#8220;I worry about forgotten password recovery for cloud accounts.&#8221;<span id="more-59727"></span></p>
<p>Google <a href="https://blog.google/technology/safety-security/one-step-closer-to-a-passwordless-future/" target="_blank" rel="noopener">says</a> that even if you lose your phone, &#8220;your passkeys will securely sync to your new phone from cloud backup, allowing you to pick up right where your old device left off.&#8221;</p>
<p>Apple and Microsoft likewise have cloud backup solutions that customers using those platforms could use to recover from a lost mobile device. But Bellovin said much depends on how securely such cloud systems are administered.</p>
<p>&#8220;How easy is it to add another device&#8217;s public key to an account, without authorization?&#8221; Bellovin wondered. &#8220;I think their protocols make it impossible, but others disagree.&#8221;</p>
<p><strong>Nicholas Weaver</strong>, a lecturer at the computer science department at <strong>University of California, Berkeley</strong>, said websites still have to have some recovery mechanism for the &#8220;you lost your phone and your password&#8221; scenario, which he described as &#8220;a really hard problem to do securely and already one of the biggest weaknesses in our current system.&#8221;</p>
<p>&#8220;If you forget the password and lose your phone and can recover it, now this is a huge target for attackers,&#8221; Weaver said in an email. &#8220;If you forget the password and lose your phone and CAN&#8217;T, well, now you&#8217;ve lost your authorization token that is used for logging in. It is going to have to be the latter. Apple has the infrastructure in place to support it (iCloud keychain), but it is unclear if Google does.&#8221;</p>
<p>Even so, he said, the overall FIDO approach has been a great tool for improving both security and usability.</p>
<p>&#8220;It is a really, really good step forward, and I&#8217;m delighted to see this,&#8221; Weaver said. &#8220;Taking advantage of the phone&#8217;s strong authentication of the phone owner (if you have a decent passcode) is quite nice. And at least for the iPhone you can make this robust even to phone compromise, as it is the secure enclave that would handle this and the secure enclave doesn&#8217;t trust the host operating system.&#8221;</p>
<p>The tech giants said the new passwordless capabilities will be enabled across Apple, Google and Microsoft platforms &#8220;over the course of the coming year.&#8221; But experts said it will likely take several more years for smaller web destinations to adopt the technology and ditch passwords altogether.</p>
<p>Recent research shows far too many people still reuse or recycle passwords (modifying the same password slightly), which presents an account takeover risk when those credentials eventually get exposed in a data breach. A <a href="https://spycloud.com/resource/2022-annual-identity-exposure-report/" target="_blank" rel="noopener">report</a> in March from cybersecurity firm <strong>SpyCloud</strong> found 64 percent of users reuse passwords for multiple accounts, and that 70 percent of credentials compromised in previous breaches are still in use.</p>
<p>A March 2022 white paper on the FIDO approach is available <a href="media/4f69ec0d.How-FIDO-Addresses-a-Full-Range-of-Use-CasesFINAL.pdf" data-original-source="https://media.fidoalliance.org/wp-content/uploads/2022/03/How-FIDO-Addresses-a-Full-Range-of-Use-CasesFINAL.pdf" target="_blank" rel="noopener">here</a> (PDF). A FAQ on it is <a href="https://fidoalliance.org/faqs/#multi-device-fido-credentials" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=59789
title: Microsoft Patch Tuesday, May 2022 Edition
uri: Microsoft-Patch-Tuesday-May-2022-Edition
url: https://krebsonsecurity.com/2022/05/microsoft-patch-tuesday-may-2022-edition/
content:
<p><strong>Microsoft </strong>today released updates to fix at least 74 separate security problems in its <strong>Windows </strong>operating systems and related software. This month&#8217;s patch batch includes fixes for seven &#8220;critical&#8221; flaws, as well as a zero-day vulnerability that affects all supported versions of Windows.</p>
<p><img class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="754" height="531" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 754px) 100vw, 754px" /></p>
<p>By all accounts, the most urgent bug Microsoft addressed this month is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26925" target="_blank" rel="noopener">CVE-2022-26925</a>, a weakness in a central component of Windows security (the &#8220;<strong>Local Security Authority</strong>&#8221; process within Windows). CVE-2022-26925 was publicly disclosed prior to today, and Microsoft says it is now actively being exploited in the wild. The flaw affects Windows 7 through 10 and Windows Server 2008 through 2022.</p>
<p><strong>Greg Wiseman</strong>, product manager for <strong>Rapid7</strong>, said Microsoft has rated this vulnerability as important and assigned it a CVSS (danger) score of 8.1 (10 being the worst), although Microsoft notes that the CVSS score can be as high as 9.8 in certain situations.</p>
<p>&#8220;This allows attackers to perform a man-in-the-middle attack to force domain controllers to authenticate to the attacker using NTLM authentication,&#8221; Wiseman said. &#8220;This is very bad news when used in conjunction with an NTLM relay attack, potentially leading to remote code execution. This bug affects all supported versions of Windows, but Domain Controllers should be patched on a priority basis before updating other servers.&#8221;</p>
<p>Wiseman said the most recent time Microsoft patched a similar vulnerability &#8212; last August in <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-36942" target="_blank" rel="noopener">CVE-2021-36942</a> &#8212; it was also being exploited in the wild under the name &#8220;<a href="https://support.microsoft.com/en-gb/topic/kb5005413-mitigating-ntlm-relay-attacks-on-active-directory-certificate-services-ad-cs-3612b773-4043-4aa9-b23d-b87910cd3429" target="_blank" rel="noopener">PetitPotam</a>.&#8221;</p>
<p>&#8220;CVE-2021-36942 was so bad it made CISA’s catalog of Known Exploited Vulnerabilities,&#8221; Wiseman said.<span id="more-59789"></span></p>
<p>Seven of the flaws fixed today earned Microsoft&#8217;s most-dire &#8220;critical&#8221; label, which it assigns to vulnerabilities that can be exploited by malware or miscreants to remotely compromise a vulnerable Windows system without any help from the user.</p>
<p>Among those is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-26937" target="_blank" rel="noopener">CVE-2022-26937</a>, which carries a CVSS score of 9.8, and affects services using the <strong>Windows Network File System</strong> (NFS). <strong>Trend Micro&#8217;s Zero Day Initiative</strong> notes that this bug could allow remote, unauthenticated attackers to execute code in the context of the Network File System (NFS) service on affected systems.</p>
<p>&#8220;NFS isn’t on by default, but it’s prevalent in environment where Windows systems are mixed with other OSes such as Linux or Unix,&#8221; ZDI&#8217;s <strong>Dustin Childs</strong> <a href="https://www.zerodayinitiative.com/blog/2022/5/10/the-may-2022-security-update-review" target="_blank" rel="noopener">wrote</a>. &#8220;If this describes your environment, you should definitely test and deploy this patch quickly.&#8221;</p>
<p>Once again, this month&#8217;s Patch Tuesday is sponsored by <strong>Windows Print Spooler</strong>, a core Windows service that keeps spooling out the security hits. May&#8217;s patches include four fixes for Print Spooler, including two information disclosure and two elevation of privilege flaws.</p>
<p>&#8220;All of the flaws are rated as important, and two of the three are considered more likely to be exploited,&#8221; said <strong>Satnam Narang</strong>, staff research engineer at <strong>Tenable</strong>. &#8220;Windows Print Spooler continues to remain a valuable target for attackers since <a href="https://krebsonsecurity.com/2021/07/microsoft-issues-emergency-patch-for-windows-flaw/" target="_blank" rel="noopener">PrintNightmare was disclosed nearly a year ago</a>. Elevation of Privilege flaws in particular should be carefully prioritized, as we’ve seen ransomware groups like Conti favor them as part of its playbook.&#8221;</p>
<p>Other Windows components that received patches this month include <strong>.NET</strong> and <strong>Visual Studio</strong>, <strong>Microsoft Edge</strong> (Chromium-based), <strong>Microsoft Exchange Server</strong>, <strong>Office,</strong> <strong>Windows Hyper-V</strong>,<strong> Windows Authentication Methods</strong>, <strong>BitLocker</strong>, <strong>Remote Desktop Client</strong>, and <strong>Windows Point-to-Point Tunneling Protocol</strong>.</p>
<p>Also today, Adobe issued five security bulletins to address at least 18 flaws in <strong>Adobe CloudFusion</strong>, <strong>Framemaker</strong>, <strong>InCopy</strong>, <strong>InDesign</strong>, and <strong>Adobe Character Animator</strong>. Adobe said it is not aware of any exploits in the wild for any of the issues addressed in today&#8217;s updates.</p>
<p>For a more granular look at the patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+May+2022+Patch+Tuesday/28632/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com" target="_blank" rel="noopener">AskWoody.com</a> usually has the skinny on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these patches, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=59758
title: DEA Investigating Breach of Law Enforcement Data Portal
uri: DEA-Investigating-Breach-of-Law-Enforcement-Data-Portal
url: https://krebsonsecurity.com/2022/05/dea-investigating-breach-of-law-enforcement-data-portal/
content:
<p>The <strong>U.S. Drug Enforcement Administration</strong> (DEA) says it is investigating reports that hackers gained unauthorized access to an agency portal that taps into 16 different federal law enforcement databases. KrebsOnSecurity has learned the alleged compromise is tied to a cybercrime and online harassment community that routinely impersonates police and government officials to harvest personal information on their targets.</p>
<div id="attachment_59765" style="width: 767px" class="wp-caption aligncenter"><a href="media/1fc6e049.esp-screenshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59765" class="wp-image-59765" src="media/1fc6e049.esp-screenshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot.png" alt="" width="757" height="375" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot.png 1283w, https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot-768x380.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot-782x387.png 782w" sizes="(max-width: 757px) 100vw, 757px" /></a><p id="caption-attachment-59765" class="wp-caption-text">Unidentified hackers shared this screenshot of alleged access to the Drug Enforcement Administration&#8217;s intelligence sharing portal.</p></div>
<p>On May 8, KrebsOnSecurity received a tip that hackers obtained a username and password for an authorized user of <strong>esp.usdoj.gov</strong>, which is the <strong>Law Enforcement Inquiry and Alerts</strong> (LEIA) system managed by the DEA.</p>
<p>KrebsOnSecurity shared information about the allegedly hijacked account with the DEA, the <strong>Federal Bureau of Investigation</strong> (FBI), and the <strong>Department of Justice</strong>, which houses both agencies. The DEA declined to comment on the validity of the claims, and issued only the briefest of statements about the matter in response to being notified.</p>
<p>&#8220;DEA takes cyber security and information of intrusions seriously and investigates all such reports to the fullest extent,&#8221; the agency said in a statement shared via email.</p>
<p>According to <a href="https://www.justice.gov/open/inventory.php?page=87" target="_blank" rel="noopener">this page</a> at the Justice Department website, LEIA &#8220;provides federated search capabilities for both EPIC and external database repositories,&#8221; including data classified as &#8220;law enforcement sensitive&#8221; and &#8220;mission sensitive&#8221; to the DEA.</p>
<p>A <a href="media/019f4c59.southwest_strategy-3.pdf" data-original-source="https://obamawhitehouse.archives.gov/sites/default/files/ondcp/policy-and-research/southwest_strategy-3.pdf" target="_blank" rel="noopener">document published by the Obama administration in May 2016</a> (PDF) says the DEA&#8217;s <a href="https://en.wikipedia.org/wiki/El_Paso_Intelligence_Center" target="_blank" rel="noopener">El Paso Intelligence Center</a> (EPIC) systems in Texas are available for use by federal, state, local and tribal law enforcement, as well as the Department of Defense and intelligence community.</p>
<p>EPIC and LEIA also have access to the DEA&#8217;s <strong>National Seizure System </strong>(NSS), which the DEA uses to identify property thought to have been purchased with the proceeds of criminal activity (think fancy cars, boats and homes seized from drug kingpins).</p>
<p>&#8220;The <strong>EPIC System Portal (ESP)</strong> enables vetted users to remotely and securely share intelligence, access the National Seizure System, conduct data analytics, and obtain information in support of criminal investigations or law enforcement operations,&#8221; the 2016 White House document reads. &#8220;Law Enforcement Inquiry and Alerts (LEIA) allows for a federated search of 16 Federal law enforcement databases.&#8221;</p>
<p>The screenshots shared with this author indicate the hackers could use EPIC to look up a variety of records, including those for motor vehicles, boats, firearms, aircraft, and even drones.</p>
<p>Claims about the purloined DEA access were shared with this author by &#8220;<strong>KT</strong>,&#8221; the current administrator of the <strong>Doxbin</strong> &#8212; a highly toxic online community that provides a forum for digging up personal information on people and posting it publicly.</p>
<p>[SIDE NOTE: Nearly two dozen domain names used by Doxbin were very recently included on the &#8220;<strong>Domain Block List</strong>&#8221; (DBL) maintained by <a href="https://www.spamhaus.org/dbl/" target="_blank" rel="noopener">Spamhaus</a>, an anti-abuse group that many Internet service providers work with to block spam and malicious activity online. As a result, the Doxbin is currently unreachable on the open Internet].</p>
<p>As KrebsOnSecurity reported earlier this year, the previous owner of the Doxbin has been <a href="https://krebsonsecurity.com/2022/03/a-closer-look-at-the-lapsus-data-extortion-group/" target="_blank" rel="noopener">identified as the leader</a> of <strong>LAPSUS$</strong>, a data extortion group that hacked into some of the world&#8217;s largest tech companies this year &#8212; including Microsoft, NVIDIA, Okta, Samsung and T-Mobile.</p>
<p>That reporting also showed how the core members of LAPSUS$ were involved in <a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">selling a service offering fraudulent Emergency Data Requests</a> (EDRs), wherein the hackers use compromised police and government email accounts to file warrantless data requests with social media firms, mobile telephony providers and other technology firms, attesting that the information being requested can&#8217;t wait for a warrant because it relates to an urgent matter of life and death.</p>
<p>From the standpoint of individuals involved in filing these phony EDRs, access to databases and user accounts within the Department of Justice would be a major coup. But the data in EPIC would probably be far more valuable to organized crime rings or drug cartels, said <strong>Nicholas Weaver</strong>, a researcher for the <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a> at <strong>University of California, Berkeley</strong>.</p>
<p>Weaver said it&#8217;s clear from the screenshots shared by the hackers that they could use their access not only to view sensitive information, but also submit false records to law enforcement and intelligence agency databases.</p>
<p>&#8220;I don&#8217;t think these [people] realize what they got, how much money the cartels would pay for access to this,&#8221; Weaver said. &#8220;Especially because as a cartel you don&#8217;t search for yourself you search for your enemies, so that even if it&#8217;s discovered there is no loss to you of putting things ONTO the DEA&#8217;s radar.&#8221;</p>
<p><div id="attachment_59766" style="width: 765px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59766" loading="lazy" class=" wp-image-59766" src="media/7bdb0743.epicaccess.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/epicaccess.png" alt="" width="755" height="358" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/epicaccess.png 1684w, https://krebsonsecurity.com/wp-content/uploads/2022/05/epicaccess-768x364.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/epicaccess-1536x728.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/05/epicaccess-782x371.png 782w" sizes="(max-width: 755px) 100vw, 755px" /><p id="caption-attachment-59766" class="wp-caption-text">The DEA&#8217;s EPIC portal login page.</p></div><span id="more-59758"></span></p>
<h2>ANALYSIS</h2>
<p>The login page for esp.usdoj.gov (above) suggests that authorized users can access the site using <a href="https://www.nist.gov/identity-access-management/personal-identity-verification-piv" target="_blank" rel="noopener">a &#8220;Personal Identity Verification&#8221; or PIV card</a>, which is a fairly strong form of authentication used government-wide to control access to federal facilities and information systems at each user&#8217;s appropriate security level.</p>
<p>However, the EPIC portal also appears to accept just a username and password, which would seem to radically diminish the security value of requiring users to present (or prove possession of) an authorized PIV card. Indeed, KT said the hacker who obtained this illicit access was able to log in using the stolen credentials alone, and that at no time did the portal prompt for a second authentication factor.</p>
<p>It&#8217;s not clear why there are still sensitive government databases being protected by nothing more than a username and password, but I&#8217;m willing to bet big money that this DEA portal is not only offender here. The DEA portal esp.usdoj.gov is listed on <em>Page 87 </em>of <a href="https://www.justice.gov/open/inventory.php?page=87" target="_blank" rel="noopener">a Justice Department &#8220;data inventory,&#8221;</a> which catalogs all of the data repositories that correspond to DOJ agencies. </p>
<p><em>There are 3,330 results</em>. Granted, only some of those results are login portals, but that&#8217;s just within the Department of Justice.</p>
<p>If we assume for the moment that state-sponsored foreign hacking groups can gain access to sensitive government intelligence in the same way as teenage hacker groups like LAPSUS$, then it is long past time for the U.S. federal government to perform a top-to-bottom review of authentication requirements tied to any government portals that traffic in sensitive or privileged information.</p>
<p>I&#8217;ll say it because it needs to be said: The United States government is in urgent need of leadership on cybersecurity at the executive branch level &#8212; preferably someone who has the authority and political will to eventually disconnect <em>any</em> federal government agency data portals that fail to enforce strong, multi-factor authentication.</p>
<p>I realize this may be far more complex than it sounds, particularly when it comes to authenticating law enforcement personnel who access these systems without the benefit of a PIV card or government-issued device (state and local authorities, for example). It&#8217;s not going to be as simple as just turning on multi-factor authentication for every user, thanks in part to a broad diversity of technologies being used across the law enforcement landscape.</p>
<p>But when hackers can plunder 16 law enforcement databases, arbitrarily send out law enforcement alerts for specific people or vehicles, or potentially disrupt ongoing law enforcement operations &#8212; all because someone stole, found or bought a username and password &#8212; it&#8217;s time for drastic measures.</p>


feed_id: https://krebsonsecurity.com/?p=59840
title: When Your Smart ID Card Reader Comes With Malware
uri: When-Your-Smart-ID-Card-Reader-Comes-With-Malware
url: https://krebsonsecurity.com/2022/05/when-your-smart-id-card-reader-comes-with-malware/
content:
<p>Millions of U.S. government employees and contractors have been issued a secure smart ID card that enables physical access to buildings and controlled spaces, and provides access to government computer networks and systems at the cardholder&#8217;s appropriate security level. But many government employees aren&#8217;t issued an approved card reader device that lets them use these cards at home or remotely, and so turn to low-cost readers they find online. What could go wrong? Here&#8217;s one example.</p>
<div id="attachment_59847" style="width: 740px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59847" class="size-full wp-image-59847" src="media/fcd66a95.caccard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/caccard.png" alt="" width="730" height="224" /><p id="caption-attachment-59847" class="wp-caption-text">A sample Common Access Card (CAC). Image: Cac.mil.</p></div>
<p>KrebsOnSecurity recently heard from a reader &#8212; we&#8217;ll call him &#8220;Mark&#8221; because he wasn&#8217;t authorized to speak to the press &#8212; who works in IT for a major government defense contractor and was issued a Personal Identity Verification (PIV) government smart card designed for civilian employees. Not having a smart card reader at home and lacking any obvious guidance from his co-workers on how to get one, Mark opted to purchase a $15 reader from Amazon that said it was made to handle U.S. government smart cards.</p>
<p>The USB-based device Mark settled on is the first result that currently comes up one when searches on Amazon.com for &#8220;PIV card reader.&#8221; The card reader Mark bought was sold by a company called <strong>Saicoo</strong>, whose sponsored Amazon listing advertises a &#8220;DOD Military USB Common Access Card (CAC) Reader&#8221; and has more than 11,700 mostly positive ratings. </p>
<p>The <a href="https://www.cac.mil/common-access-card/" target="_blank" rel="noopener">Common Access Card</a> (CAC) is the standard identification for active duty uniformed service personnel, selected reserve, DoD civilian employees, and eligible contractor personnel. It is the principal card used to enable physical access to buildings and controlled spaces, and provides access to DoD computer networks and systems.</p>
<p>Mark said when he received the reader and plugged it into his Windows 10 PC, the operating system complained that the device&#8217;s hardware drivers weren&#8217;t functioning properly. Windows suggested consulting the vendor&#8217;s website for newer drivers.</p>
<div id="attachment_59848" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59848" loading="lazy" class=" wp-image-59848" src="media/f9b9c3fb.saicoo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicoo.png" alt="" width="751" height="428" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicoo.png 1151w, https://krebsonsecurity.com/wp-content/uploads/2022/05/saicoo-768x438.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/saicoo-782x446.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-59848" class="wp-caption-text">The Saicoo smart card reader that Mark purchased. Image: Amazon.com</p></div>
<p>So Mark went to the website mentioned on Saicoo&#8217;s packaging and found a ZIP file containing drivers for Linux, Mac OS and Windows:</p>
<div id="attachment_59852" style="width: 796px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59852" loading="lazy" class="size-full wp-image-59852" src="media/5f3829ef.saicoodrivers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicoodrivers.png" alt="" width="786" height="756" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicoodrivers.png 786w, https://krebsonsecurity.com/wp-content/uploads/2022/05/saicoodrivers-768x739.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/saicoodrivers-782x752.png 782w" sizes="(max-width: 786px) 100vw, 786px" /><p id="caption-attachment-59852" class="wp-caption-text">Image: Saicoo</p></div>
<p>Out of an abundance of caution, Mark submitted Saicoo&#8217;s drivers file to <a href="https://www.virustotal.com" target="_blank" rel="noopener">Virustotal.com</a>, which simultaneously scans any shared files with more than five dozen antivirus and security products. Virustotal reported that some 43 different security tools detected the Saicoo drivers as malicious. The consensus seems to be that the ZIP file currently harbors a malware threat known as <a href="https://www.trendmicro.com/vinfo/us/threat-encyclopedia/malware/trojan.win32.ramnit.a" target="_blank" rel="noopener">Ramnit</a>, a fairly common but dangerous trojan horse that spreads by appending itself to other files.</p>
<div id="attachment_59849" style="width: 764px" class="wp-caption aligncenter"><a href="media/eaf7f4df.saicooramnit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicooramnit.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59849" loading="lazy" class="wp-image-59849" src="media/eaf7f4df.saicooramnit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicooramnit.png" alt="" width="754" height="541" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicooramnit.png 1138w, https://krebsonsecurity.com/wp-content/uploads/2022/05/saicooramnit-768x551.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/saicooramnit-782x561.png 782w" sizes="(max-width: 754px) 100vw, 754px" /></a><p id="caption-attachment-59849" class="wp-caption-text">Image: Virustotal.com</p></div>
<p>Ramnit is a well-known and older threat &#8212; first surfacing more than a decade ago &#8212; but it has evolved over the years and is <a href="https://www.cybereason.com/blog/research/banking-trojan-delivered-by-lolbins-ramnit-trojan" target="_blank" rel="noopener">still employed in more sophisticated data exfiltration attacks</a>. Amazon said in a written statement that it was investigating the reports.</p>
<p>&#8220;Seems like a potentially significant national security risk, considering that many end users might have elevated clearance levels who are using PIV cards for secure access,&#8221; Mark said.</p>
<p>Mark said he contacted Saicoo about their website serving up malware, and received a response saying the company&#8217;s newest hardware did not require any additional drivers. He said Saicoo did not address his concern that the driver package on its website was bundled with malware.</p>
<p>In response to KrebsOnSecurity&#8217;s request for comment, Saicoo sent a somewhat less reassuring reply.</p>
<p>&#8220;From the details you offered, issue may probably caused by your computer security defense system as it seems not recognized our rarely used driver &amp; detected it as malicious or a virus,&#8221; Saicoo&#8217;s support team wrote in an email.</p>
<p>&#8220;Actually, it&#8217;s not carrying any virus as you can trust us, if you have our reader on hand, please just ignore it and continue the installation steps,&#8221; the message continued. &#8220;When driver installed, this message will vanish out of sight. Don&#8217;t worry.&#8221;<span id="more-59840"></span></p>
<div id="attachment_59851" style="width: 621px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59851" loading="lazy" class="size-full wp-image-59851" src="media/a914398e.saicooresponse.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicooresponse.png" alt="" width="611" height="487" /><p id="caption-attachment-59851" class="wp-caption-text">Saicoo&#8217;s response to KrebsOnSecurity.</p></div>
<p>The trouble with Saicoo&#8217;s apparently infected drivers may be little more than a case of a technology company having their site hacked and responding poorly. <strong>Will Dormann</strong>, a vulnerability analyst at CERT/CC, <a href="https://twitter.com/wdormann/status/1526306527237267458" target="_blank" rel="noopener">wrote</a> on Twitter that the executable files (.exe) in the Saicoo drivers ZIP file were not altered by the Ramnit malware &#8212; only the included HTML files.</p>
<p>Dormann said it&#8217;s bad enough that searching for device drivers online is one of the riskiest activities one can undertake online.</p>
<p>&#8220;Doing a web search for drivers is a VERY dangerous (in terms of legit/malicious hit ration) search to perform, based on results of any time I&#8217;ve tried to do it,&#8221; Dormann <a href="https://twitter.com/wdormann/status/1526404312137703424" target="_blank" rel="noopener">added</a>. &#8220;Combine that with the apparent due diligence of the vendor outlined here, and well, it ain&#8217;t a pretty picture.&#8221;</p>
<p>But by all accounts, the potential attack surface here is enormous, as many federal employees clearly will purchase these readers from a myriad of online vendors when the need arises. Saicoo&#8217;s product listings, for example, are replete with <a href="https://www.amazon.com/hz/reviews-render/lighthouse/B00CMKS2DI?filterByKeyword=smart+card&amp;pageNumber=1" target="_blank" rel="noopener">comments</a> from customers who self-state that they work at a federal agency (and several who reported problems installing drivers).</p>
<p>A <a href="https://twitter.com/briankrebs/status/1526297731748216833" target="_blank" rel="noopener">thread about Mark&#8217;s experience on Twitter</a> generated a strong response from some of my followers, many of whom apparently work for the U.S. government in some capacity and have government-issued CAC or PIV cards.</p>
<p><img loading="lazy" class="aligncenter  wp-image-59865" src="media/dfcd0fa6.saicootweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/saicootweet.png" alt="" width="751" height="537" /></p>
<p>Two things emerged clearly from that conversation. The first was general confusion about whether the U.S. government has any sort of list of approved vendors. It does. The <strong>General Services Administration</strong> (GSA), the agency which handles procurement for federal civilian agencies, maintains <a href="https://www.idmanagement.gov/approved-products-list-pacs-products/" target="_blank" rel="noopener">a list of approved card reader vendors at idmanagement.gov</a> (Saicoo is not on that list). [Thanks to <a href="https://twitter.com/MetaBiometrics/status/1526662768476270597" rel="noopener" target="_blank">@MetaBiometrics</a> and <a href="https://twitter.com/shugenja/status/1526613826858254338" rel="noopener" target="_blank">@shugenja</a> for the link!]</p>
<p>The other theme that ran through the Twitter discussion was the reality that many people find buying off-the-shelf readers more expedient than going through the GSA&#8217;s official procurement process, whether it&#8217;s because they were never issued one or the reader they were using simply no longer worked or was lost and they needed another one quickly.</p>
<p>&#8220;Almost every officer and NCO [non-commissioned officer] I know in the Reserve Component has a CAC reader they bought because they had to get to their DOD email at home and they&#8217;ve never been issued a laptop or a CAC reader,&#8221; <a href="https://twitter.com/dixondaver/with_replies" target="_blank" rel="noopener">said</a> <strong>David Dixon</strong>, an Army veteran and author who lives in Northern Virginia. &#8220;When your boss tells you to check your email at home and you&#8217;re in the National Guard and you live 2 hours from the nearest [non-classified military network installation], what do you think is going to happen?&#8221;</p>
<p>Interestingly, anyone asking on Twitter about how to navigate purchasing the right smart card reader and getting it all to work properly is invariably steered toward <a href="https://www.militarycac.com" target="_blank" rel="noopener">militarycac.com</a>. The website is maintained by <strong>Michael Danberry</strong>, a decorated and retired Army veteran who launched the site in 2008 (its text and link-heavy design very much takes one back to that era of the Internet and webpages in general). His site has even been <a href="media/38685d12.EEmail.pdf" data-original-source="https://militarycac.com/PDFs/EEmail.pdf" target="_blank" rel="noopener">officially recommended by the Army</a> (PDF). Mark shared emails showing Saicoo itself recommends militarycac.com.</p>
<div id="attachment_59853" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59853" loading="lazy" class=" wp-image-59853" src="media/9e82a81c.militarycac.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/militarycac.png" alt="" width="751" height="749" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/militarycac.png 814w, https://krebsonsecurity.com/wp-content/uploads/2022/05/militarycac-768x766.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/militarycac-782x780.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-59853" class="wp-caption-text">Image: Militarycac.com.</p></div>
<p>&#8220;The Army Reserve started using CAC logon in May 2006,&#8221; Danberry wrote on his <a href="https://militarycac.com/about.htm" target="_blank" rel="noopener">&#8220;About&#8221; page</a>. &#8220;I [once again] became the &#8216;Go to guy&#8217; for my Army Reserve Center and Minnesota. I thought Why stop there? I could use my website and knowledge of CAC and share it with you.&#8221;</p>
<p>Danberry did not respond to requests for an interview &#8212; no doubt because he&#8217;s busy doing tech support for the federal government. The friendly message on Danberry&#8217;s voicemail instructs support-needing callers to leave detailed information about the issue they&#8217;re having with CAC/PIV card readers.</p>
<p>Dixon said Danberry has &#8220;done more to keep the Army running and connected than all the G6s [Army Chief Information Officers] put together.&#8221;</p>
<p>In many ways, Mr. Danberry is the equivalent of that little known software developer whose tiny open-sourced code project ends up becoming widely adopted and eventually folded into the fabric of the Internet.  I wonder if he ever imagined 15 years ago that his website would one day become &#8220;critical infrastructure&#8221; for Uncle Sam?</p>


feed_id: https://krebsonsecurity.com/?p=59891
title: Senators Urge FTC to Probe ID.me Over Selfie Data
uri: Senators-Urge-FTC-to-Probe-ID-me-Over-Selfie-Data
url: https://krebsonsecurity.com/2022/05/senators-urge-ftc-to-probe-id-me-over-selfie-data/
content:
<p>Some of more tech-savvy Democrats in the U.S. Senate are asking the <strong>Federal Trade Commission</strong> (FTC) to investigate identity-proofing company <strong>ID.me</strong> for &#8220;deceptive statements&#8221; the company and its founder allegedly made over how they handle facial recognition data collected on behalf of the <strong>Internal Revenue Service</strong>, which until recently required anyone seeking a new IRS account online to provide a live video selfie to ID.me.</p>
<p><a href="media/58b52186.irs-gov-5-17-22.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/irs-gov-5-17-22.png" target="_blank" rel="noopener"><img class="aligncenter wp-image-59905" src="media/58b52186.irs-gov-5-17-22.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/irs-gov-5-17-22.png" alt="" width="750" height="535" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/irs-gov-5-17-22.png 1091w, https://krebsonsecurity.com/wp-content/uploads/2022/05/irs-gov-5-17-22-768x548.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/irs-gov-5-17-22-782x558.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/05/irs-gov-5-17-22-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></a></p>
<p>In a letter to <strong>FTC Chair Lina Khan</strong>, the Senators charge that ID.me&#8217;s <strong>CEO Blake Hall</strong> has offered conflicting statements about how his company uses the facial scan data it collects on behalf of the federal government and many states that use the ID proofing technology to screen applicants for unemployment insurance.</p>
<p>The lawmakers say that in public statements and blog posts, ID.me has frequently emphasized the difference between two types of facial recognition: One-to-one, and one-to-many. In the one-to-one approach, a live video selfie is compared to the image on a driver&#8217;s license, for example. One-to-many facial recognition involves comparing a face against a database of other faces to find any potential matches.</p>
<p>Americans have particular reason to be concerned about the difference between these two types of facial recognition, says the letter to the FTC, signed by <strong>Sens. Cory Booker</strong> (D-N.J.), <strong>Edward Markey </strong>(D-Mass.), <strong>Alex Padilla</strong> (D-Calif.), and <strong>Ron Wyden</strong> (D-Ore.):</p>
<blockquote><p>&#8220;While one-to-one recognition involves a one-time comparison of two images in order to confirm an applicant’s identity, the use of one-to-many recognition means that millions of innocent people will have their photographs endlessly queried as part of a digital &#8216;line up.&#8217; Not only does this violate individuals’ privacy, but the inevitable false matches associated with one-to-many recognition can result in applicants being wrongly denied desperately-needed services for weeks or even months as they try to get their case reviewed.&#8221;</p>
<p>&#8220;This risk is especially acute for people of color: NIST’s Facial Recognition Vendor Test found that many facial recognition algorithms have rates of false matches that are as much as 100 times higher for individuals from countries in West Africa, East Africa and East Asia than for individuals from Eastern European countries. This means Black and Asian Americans could be disproportionately likely to be denied benefits due to a false match in a one-to-many facial recognition system.&#8221;</p></blockquote>
<p>The lawmakers say that throughout the latter half of 2021, ID.me published statements and blog posts stating it did not use one-to-many facial recognition and that the approach was &#8220;problematic&#8221; and &#8220;tied to surveillance operations.&#8221; But several days after <a href="https://krebsonsecurity.com/2022/01/irs-will-soon-require-selfies-for-online-access/" target="_blank" rel="noopener">a Jan. 16, 2022 post here about the IRS&#8217;s new facial ID requirement</a> went viral and prompted a public backlash, Hall <a href="https://www.linkedin.com/feed/update/urn:li:activity:6892131524746326016/" target="_blank" rel="noopener">acknowledged in a LinkedIn posting</a> that ID.me does use one-to-many facial recognition.</p>
<p>&#8220;Within days, the company edited the numerous blog posts and white papers on its website that previously stated the company did not use one-to-many to reflect the truth,&#8221; the letter alleges. &#8220;According to media reports, the company’s decision to correct its prior misleading statements came after mounting internal pressure from its employees.&#8221;<span id="more-59891"></span></p>
<p>Cyberscoop&#8217;s <strong>Tonya Riley</strong> <a href="https://www.cyberscoop.com/id-me-ceo-backtracks-on-claims-company-doesnt-use-powerful-facial-recognition-tech/" target="_blank" rel="noopener">published excerpts from internal ID.me employee Slack messages</a> wherein some expressed dread and unease with the company&#8217;s equivocation on its use of one-to-many facial recognition.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-59896" src="media/1d631f82.tonyarileytweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/tonyarileytweet.png" alt="" width="582" height="522" /></p>
<p>In February, the IRS <a href="https://krebsonsecurity.com/2022/02/irs-selfies-now-optional-biometric-data-to-be-deleted/" target="_blank" rel="noopener">announced</a> it would no longer require facial scans or other biometric data from taxpayers seeking to create an account at the agency&#8217;s website. The agency also pledged that any biometric data shared with ID.me would be permanently deleted.</p>
<p>But the IRS still requires new account applicants to sign up with either ID.me or <strong>Login.gov</strong>, a single sign-on solution already used to access 200 websites run by 28 federal agencies. It also still offers the option of providing a live selfie for verification purposes, although the IRS says this data will be deleted automatically.</p>
<p>Asked to respond to concerns raised in the letter from Senate lawmakers, ID.me instead touted its successes in stopping fraud.</p>
<p>&#8220;Five state workforce agencies have publicly credited ID.me with helping to prevent $238 billion dollars in fraud,&#8221; the statement reads. &#8220;Conditions were so bad during the pandemic that the deputy assistant director of the FBI called the fraud &#8216;an economic attack on the United States.&#8217; ID.me played a critical role in stopping that attack in more than 20 states where the service was rapidly adopted for its equally important ability to increase equity and verify individuals left behind by traditional options. We look forward to cooperating with all relevant government bodies to clear up any misunderstandings.&#8221;</p>
<p>As Cyberscoop <a href="https://www.cyberscoop.com/id-me-government-contracts-house-oversight/" target="_blank" rel="noopener">reported on Apr. 14</a>, the <strong>House Oversight and Reform Committee</strong> last month began an investigation into ID.me&#8217;s practices, with committee chairwoman <strong>Carolyn Maloney</strong> (D-N.Y.) saying the committee&#8217;s questions to the company would help shape policy on how the government wields facial recognition technology.</p>
<p>A copy of the letter the senators sent to the FTC is <a href="media/d9244f78.Letter20to20FTC20on20ID.me20deceptive20statements20051822.pdf" data-original-source="https://www.wyden.senate.gov/imo/media/doc/Letter%20to%20FTC%20on%20ID.me%20deceptive%20statements%20051822.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=59920
title: Costa Rica May Be Pawn in Conti Ransomware Group’s Bid to Rebrand, Evade Sanctions
uri: Costa-Rica-May-Be-Pawn-in-Conti-Ransomware-Group-s-Bid-to-Rebrand-E
url:
https://krebsonsecurity.com/2022/05/costa-rica-may-be-pawn-in-conti-ransomware-groups-bid-to-rebrand-evade-sanctions/

content:
<p><img class="aligncenter size-full wp-image-59928" src="media/e0e0141a.crflag-abstract.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/crflag-abstract.png" alt="" width="740" height="415" /></p>
<p>Costa Rica&#8217;s national health service was hacked sometime earlier this morning by a Russian ransomware group known as <strong>Hive</strong>. The intrusion comes just weeks after <strong>Costa Rican President Rodrigo Chaves</strong> declared a state of emergency in response to a data ransom attack from a different Russian ransomware gang &#8212; <strong>Conti</strong>. Ransomware experts say there is good reason to believe the same cybercriminals are behind both attacks, and that Hive has been helping Conti rebrand and evade international sanctions targeting extortion payouts to cybercriminals operating in Russia.</p>
<p>The Costa Rican publication <a href="https://crprensa.com/ccss-sufrio-hackeo-en-la-madruga-de-este-martes/" target="_blank" rel="noopener">CRprensa.com</a> reports that affected systems at the <a href="https://en.wikipedia.org/wiki/Costa_Rican_Social_Security_Fund" target="_blank" rel="noopener">Costa Rican Social Security Fund</a> (CCSS) were taken offline on the morning of May 31, but that the extent of the breach was still unclear. The CCSS is responsible for Costa Rica&#8217;s public health sector, and worker and employer contributions are mandated by law.</p>
<p>A copy of the ransom note left behind by the intruders and subsequently uploaded to Virustotal.com indicates the CCSS intrusion was the work of Hive, which typically demands payment for a digital key needed to unlock files and servers compromised by the group&#8217;s ransomware.</p>
<div id="attachment_59934" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59934" loading="lazy" class=" wp-image-59934" src="media/61eeab3d.hive-chat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/hive-chat.png" alt="" width="751" height="596" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/hive-chat.png 783w, https://krebsonsecurity.com/wp-content/uploads/2022/05/hive-chat-768x609.png 768w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-59934" class="wp-caption-text">A HIVE ransomware chat page for a specific victim (redacted).</p></div>
<p>On May 8, President Chaves used his first day in office to declare a national state of emergency after the Conti ransomware group threatened to publish gigabytes of sensitive data stolen from Costa Rica&#8217;s Ministry of Finance and other government agencies. Conti initially demanded $10 million, and later doubled the amount when Costa Rica refused to pay. On May 20, Conti leaked more than 670 gigabytes of data taken from Costa Rican government servers.</p>
<p>As <em>CyberScoop</em> <a href="https://www.cyberscoop.com/costa-rica-conti-ransomware-extortion-collaborators/" target="_blank" rel="noopener">reported on May 17</a>, Chaves told local media he believed that collaborators within Costa Rica were helping Conti extort the government. Chaves offered no information to support this claim, but the timeline of Conti&#8217;s descent on Costa Rica is worth examining.</p>
<p>Most of Conti&#8217;s public communications about the Costa Rica attack have very clearly assigned credit for the intrusion to an individual or group calling itself &#8220;unc1756.&#8221; In March 2022, a new user by the same name registered on the Russian language crime forum Exploit.</p>
<div id="attachment_59930" style="width: 575px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59930" loading="lazy" class=" wp-image-59930" src="media/edb49bfb.conti-krebs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/conti-krebs.png" alt="" width="565" height="580" /><p id="caption-attachment-59930" class="wp-caption-text">A message Conti posted to its dark web blog on May 20.</p></div>
<p>On the evening of April 18, Costa Rica&#8217;s Ministry of Finance <a href="https://twitter.com/HaciendaCR/status/1516190939114803203" target="_blank" rel="noopener">disclosed the Conti intrusion via Twitter</a>. Earlier that same day, the user unc1756 posted a help wanted ad on Exploit saying they were looking to buy access to &#8220;special networks&#8221; in Costa Rica.</p>
<p>&#8220;By special networks I mean something like Haciendas,&#8221; unc1756 wrote on Exploit. Costa Rica&#8217;s Ministry of Finance is known in Spanish as the &#8220;Ministerio Hacienda de Costa Rica.&#8221; Unc1756 said they would pay $USD 500 or more for such access, and would work only with Russian-speaking people.<span id="more-59920"></span></p>
<h2>THE NAME GAME DISTRACTION</h2>
<p>Experts say there are clues to suggest Conti and Hive are working together in their attacks on Costa Rica, and that the intrusions are tied to a rebranding effort by Conti. Shortly after Russia invaded Ukraine at the end of February, Conti declared its full support, aligning itself directly with Russia and against anyone who would stand against the motherland.</p>
<div id="attachment_58693" style="width: 651px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58693" loading="lazy" class="size-full wp-image-58693" src="media/213774ba.conti-ukraine.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/conti-ukraine.png" alt="" width="641" height="637" /><p id="caption-attachment-58693" class="wp-caption-text">Conti&#8217;s threatening message this week regarding international interference in Ukraine.</p></div>
<p>Conti quickly deleted the declaration from its website, but the damage had already been done, and any favor or esteem that Conti had earned among the Ukrainian cybercriminal underground effectively evaporated overnight.</p>
<p>Shortly thereafter, a Ukrainian security expert <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">leaked many months worth of internal chat records between Conti personnel</a> as they plotted and executed attacks against hundreds of victim organizations. Those candid messages exposed <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-ii-the-office/" target="_blank" rel="noopener">what it&#8217;s like to work for Conti</a>, <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-iii-weaponry/" target="_blank" rel="noopener">how they undermined the security of their targets</a>, as well as how the group&#8217;s leaders strategized for the upper hand in ransom negotiations.</p>
<p>But Conti&#8217;s declaration of solidarity with the Kremlin also made it increasingly ineffective as an instrument of financial extortion. According to cyber intelligence firm <strong>ADVIntel</strong>, Conti&#8217;s alliance with the Russian state soon left it largely unable to receive ransom payments because victim companies are being advised that paying a Conti ransom demand could mean violating U.S. economic sanctions on Russia.</p>
<p>&#8220;Conti as a brand became associated with the Russian state — a state that is currently undergoing extreme sanctions,&#8221; ADVIntel wrote in <a href="https://www.advintel.io/post/discontinued-the-end-of-conti-s-brand-marks-new-chapter-for-cybercrime-landscape" target="_blank" rel="noopener">a lengthy analysis</a> (PDF). &#8220;In the eyes of the state, each ransom payment going to Conti may have potentially gone to an individual under sanction, turning simple data extortion into a violation of OFAC regulation and sanction policies against Russia.&#8221;</p>
<div id="attachment_58780" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-58780" loading="lazy" class=" wp-image-58780" src="media/fe5fad82.contistats.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats.png" alt="" width="751" height="382" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats.png 932w, https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats-768x391.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/contistats-782x398.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-58780" class="wp-caption-text">Conti is by far the most aggressive and profitable ransomware group in operation today. Image: Chainalysis</p></div>
<p>ADVIntel says it first learned of Conti&#8217;s intrusion into Costa Rican government systems on April 14, and that it has seen internal Conti communications indicating that getting paid in the Costa Rica attack was not the goal.</p>
<p>Rather, ADVIntel argues, Conti was simply using it as a way to appear publicly that it was still operating as the world&#8217;s most lucrative ransomware collective, when in reality the core Conti leadership was busy dismantling the crime group and folding themselves and top affiliates into other ransomware groups that are already on friendly terms with Conti.</p>
<p>&#8220;The only goal Conti had wanted to meet with this final attack was to use the platform as a tool of publicity, performing their own death and subsequent rebirth in the most plausible way it could have been conceived,&#8221; ADVIntel concluded.</p>
<p>ADVIntel says Conti&#8217;s leaders and core affiliates are dispersing to several Conti-loyal crime collectives that use either ransomware lockers or strictly engage in data theft for ransom, including AlphV/BlackCat, AvosLocker, BlackByte, HelloKitty, Hive, and Karakurt.</p>
<p>Still, Hive appears to be perhaps the biggest beneficiary of any attrition from Conti: Twice over the past week, both Conti and Hive and claimed responsibility for hacking the same companies. When the discrepancy was <a href="https://twitter.com/BrettCallow/status/1529470995114799104" target="_blank" rel="noopener">called out on Twitter</a>, Hive updated its website to claim it was not affiliated with Conti.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-59927" src="media/98390d77.contihivemixup.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/contihivemixup.png" alt="" width="596" height="493" /></p>
<p>Conti and Hive&#8217;s Costa Rican exploits mark the latest in a string of recent cyberattacks against government targets across Latin America. Around the same time it hacked Costa Rica in April, Conti announced it had hacked Peru&#8217;s <strong>National Directorate of Intelligence</strong>, threatening to publish sensitive stolen data if the government did not pay a ransom.</p>
<p>But Conti and Hive are not alone in targeting Latin American victims of late. According to data gathered from the victim shaming blogs maintained by multiple ransomware groups, over the past 90 days ransom actors have hacked and sought to extort 15 government agencies in Brazil, nine in Argentina, six in Columbia, four in Ecuador and three in Chile.</p>
<p>A recent <a href="media/c3ef9c1a.gress-and-the-Way-Forward-in-Latin-America-and-the-Caribbean.pdf" data-original-source="https://publications.iadb.org/publications/english/document/2020-Cybersecurity-Report-Risks-Progress-and-the-Way-Forward-in-Latin-America-and-the-Caribbean.pdf" target="_blank" rel="noopener">report</a> (PDF) by the Inter-American Development Bank suggests many Latin American countries lack the technical expertise or cybercrime laws to deal with today&#8217;s threats and threat actors.</p>
<p>&#8220;This study shows that the Latin American and Caribbean (LAC) region is not sufficiently prepared to handle cyberattacks,&#8221; the IADB document explains. &#8220;Only 7 of the 32 countries studied have a critical infrastructure protection plan, while 20 have established cybersecurity incident response teams, often called CERTs or CSIRTs. This limits their ability to identify and respond to attacks.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=59969
title: What Counts as “Good Faith Security Research?”
uri: What-Counts-as-Good-Faith-Security-Research
url: https://krebsonsecurity.com/2022/06/what-counts-as-good-faith-security-research/
content:
<p>The <strong>U.S. Department of Justice </strong>(DOJ) recently revised its policy on charging violations of the <strong>Computer Fraud and Abuse Act</strong> (CFAA), a 1986 law that remains the primary statute by which federal prosecutors pursue cybercrime cases. The new guidelines state that prosecutors should avoid charging security researchers who operate in &#8220;good faith&#8221; when finding and reporting vulnerabilities. But legal experts continue to advise researchers to proceed with caution, noting the new guidelines can&#8217;t be used as a defense in court, nor are they any kind of shield against civil prosecution.</p>
<p><img class="aligncenter  wp-image-59975" src="media/1f8e495f.cyberjustice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/cyberjustice.png" alt="" width="705" height="608" /></p>
<p>In <a href="https://www.justice.gov/opa/pr/department-justice-announces-new-policy-charging-cases-under-computer-fraud-and-abuse-act" target="_blank" rel="noopener">a statemen</a>t about the changes, <strong>Deputy Attorney General Lisa O. Monaco</strong> said the DOJ &#8220;has never been interested in prosecuting good-faith computer security research as a crime,&#8221; and that the new guidelines &#8220;promote cybersecurity by providing clarity for good-faith security researchers who root out vulnerabilities for the common good.&#8221;</p>
<p>What constitutes &#8220;good faith security research?&#8221; The DOJ&#8217;s <a href="https://www.justice.gov/opa/press-release/file/1507126/download" target="_blank" rel="noopener">new policy</a> (PDF) borrows language from a Library of Congress <a href="media/5b3abda3.2021_Section_1201_Registers_Recommendation.pdf" data-original-source="https://cdn.loc.gov/copyright/1201/2021/2021_Section_1201_Registers_Recommendation.pdf" target="_blank" rel="noopener">rulemaking</a> (PDF) on the <a href="https://en.wikipedia.org/wiki/Digital_Millennium_Copyright_Act" target="_blank" rel="noopener">Digital Millennium Copyright Act</a> (DMCA), a similarly controversial law that criminalizes production and dissemination of technologies or services designed to circumvent measures that control access to copyrighted works. According to the government, good faith security research means:</p>
<blockquote><p>&#8220;&#8230;accessing a computer solely for purposes of good-faith testing, investigation, and/or correction of a security flaw or vulnerability, where such activity is carried out in a manner designed to avoid any harm to individuals or the public, and where the information derived from the activity is used primarily to promote the security or safety of the class of devices, machines, or online services to which the accessed computer belongs, or those who use such devices, machines, or online services.&#8221;</p>
<p>&#8220;Security research not conducted in good faith — for example, for the purpose of discovering security holes in devices, machines, or services in order to extort the owners of such devices, machines, or services — might be called &#8216;research,&#8217; but is not in good faith.&#8221;</p></blockquote>
<p>The new DOJ policy comes in response to a Supreme Court ruling last year in <a href="media/6bf79241.19-783_k53l.pdf" data-original-source="https://www.supremecourt.gov/opinions/20pdf/19-783_k53l.pdf" target="_blank" rel="noopener">Van Buren v. United States</a> (PDF), a case involving a former police sergeant in Florida who was convicted of CFAA violations after a friend paid him to use police resources to look up information on a private citizen.</p>
<p>But in an opinion authored by <strong>Justice Amy Coney Barrett</strong>, the Supreme Court <a href="https://btlaw.com/en/insights/alerts/2021/supreme-court-narrows-scope-of-computer-fraud-and-abuse-act-in-van-buren-v-united-states" target="_blank" rel="noopener">held</a> that the CFAA does not apply to a person who obtains electronic information that they are otherwise authorized to access and then misuses that information.</p>
<p><strong>Orin Kerr</strong>, a law professor at <strong>University of California, Berkeley</strong>, said the DOJ&#8217;s updated policy was not unexpected given the Supreme Court ruling in the Van Buren case. Kerr noted that while the new policy says one measure of &#8220;good faith&#8221; involves researchers taking steps to prevent harm to third parties, what exactly those steps might constitute is another matter.</p>
<p>&#8220;The DOJ is making clear they&#8217;re not going to prosecute good faith security researchers, but be really careful before you rely on that,&#8221; Kerr said. &#8220;First, because you could still get sued [civilly, by the party to whom the vulnerability is being reported], but also the line as to what is legitimate security research and what isn&#8217;t is still murky.&#8221;<span id="more-59969"></span></p>
<p>Kerr said the new policy also gives CFAA defendants no additional cause for action.</p>
<p>&#8220;A lawyer for the defendant can make the pitch that something is good faith security research, but it&#8217;s not enforceable,&#8221; Kerr said. &#8220;Meaning, if the DOJ does bring a CFAA charge, the defendant can&#8217;t move to dismiss it on the grounds that it&#8217;s good faith security research.&#8221;</p>
<p>Kerr added that he can&#8217;t think of a CFAA case where this policy would have made a substantive difference.</p>
<p>&#8220;I don&#8217;t think the DOJ is giving up much, but there&#8217;s a lot of hacking that could be covered under good faith security research that they&#8217;re saying they won&#8217;t prosecute, and it will be interesting to see what happens there,&#8221; he said.</p>
<p>The new policy also clarifies other types of potential CFAA violations that are not to be charged. Most of these include violations of a technology provider&#8217;s terms of service, and here the DOJ says &#8220;violating an access restriction contained in a term of service are not themselves sufficient to warrant federal criminal charges.&#8221; Some examples include:</p>
<p>-Embellishing an online dating profile contrary to the terms of service of the dating website;<br />
-Creating fictional accounts on hiring, housing, or rental websites;<br />
-Using a pseudonym on a social networking site that prohibits them;<br />
-Checking sports scores or paying bills at work.</p>
<h2>ANALYSIS</h2>
<p>Kerr&#8217;s warning about the dangers that security researchers face from civil prosecution is well-founded. KrebsOnSecurity regularly hears from security researchers seeking advice on how to handle reporting a security vulnerability or data exposure. In most of these cases, the researcher isn&#8217;t worried that the government is going to come after them: It&#8217;s that they&#8217;re going to get sued by the company responsible for the security vulnerability or data leak.</p>
<p>Often these conversations center around the researcher&#8217;s desire to weigh the rewards of gaining recognition for their discoveries with the risk of being targeted with costly civil lawsuits. And almost just as often, the source of the researcher&#8217;s unease is that they recognize they might have taken their discovery just a tad too far.</p>
<p>Here&#8217;s a common example: A researcher finds a vulnerability in a website that allows them to individually retrieve every customer record in a database. But instead of simply polling a few records that could be used as a proof-of-concept and shared with the vulnerable website, the researcher decides to download every single file on the server.</p>
<p>Not infrequently, there is also concern because at some point the researcher suspected that their automated activities might have actually caused stability or uptime issues with certain services they were testing. Here, the researcher is usually concerned about approaching the vulnerable website or vendor because they worry their activities may already have been identified internally as some sort of external cyberattack.</p>
<p>What do I take away from these conversations? Some of the most trusted and feared security researchers in the industry today gained that esteem not by constantly taking things to extremes and skirting the law, but rather by publicly exercising restraint in the use of their powers and knowledge &#8212; and by being effective at communicating their findings in a way that maximizes the help and minimizes the potential harm.</p>
<p>If you believe you&#8217;ve discovered a security vulnerability or data exposure, try to consider first how you might defend your actions to the vulnerable website or vendor before embarking on any automated or semi-automated activity that the organization might reasonably misconstrue as a cyberattack. In other words, try as best you can to minimize the potential harm to the vulnerable site or vendor in question, and don&#8217;t go further than you need to prove your point.</p>


feed_id: https://krebsonsecurity.com/?p=59987
title: KrebsOnSecurity in New Netflix Series on Cybercrime
uri: KrebsOnSecurity-in-New-Netflix-Series-on-Cybercrime
url: https://krebsonsecurity.com/2022/06/krebsonsecurity-in-new-netflix-series-on-cybercrime/
content:
<p><strong>Netflix</strong> has a new documentary series airing next week &#8212; &#8220;<strong>Web of Make Believe: Death, Lies &amp; the Internet</strong>&#8221; &#8212; in which Yours Truly apparently has a decent amount of screen time. The debut episode explores the far-too-common harassment tactic of &#8220;<a href="https://krebsonsecurity.com/?s=swatting" target="_blank" rel="noopener">swatting</a>&#8221; &#8212; wherein fake bomb threats or hostage situations are phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target’s address.</p>
<div id="attachment_59988" style="width: 778px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-59988" class=" wp-image-59988" src="media/cd217d11.netflixseries.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/netflixseries.png" alt="" width="768" height="518" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/netflixseries.png 838w, https://krebsonsecurity.com/wp-content/uploads/2022/06/netflixseries-768x518.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/netflixseries-782x527.png 782w" sizes="(max-width: 768px) 100vw, 768px" /><p id="caption-attachment-59988" class="wp-caption-text">Image: Netflix.com</p></div>
<p>The producers of the Netflix show said footage from an interview I sat for in early 2020 on swatting and other threats should appear in the first episode. They didn&#8217;t specify what additional topics the series would scrutinize, but Netflix&#8217;s teaser for the show suggests it concerns cybercrimes that result in deadly, real-world kinetic attacks.</p>
<p>&#8220;Conspiracy. Fraud. Violence. Murder,&#8221; reads the Netflix short description for the series. &#8220;What starts out virtual can get real all too quickly &#8212; and when the web is worldwide, so are the consequences.&#8221;<span id="more-59987"></span></p>
<p>Our family has been victimized by multiple swatting attacks over the past decade. Our first swatting, in March 2013, resulted in Fairfax County, Va. police <a href="https://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">surrounding our home and forcing me into handcuffs at gunpoint</a>. For an excruciating two minutes, I had multiple police officers pointing rifles, shotguns and pistols directly at me.</p>
<p>More recently, our family was subjected to swatting attacks by <a href="https://krebsonsecurity.com/2019/07/neo-nazi-swatters-target-dozens-of-journalists/https://krebsonsecurity.com/2019/07/neo-nazi-swatters-target-dozens-of-journalists/" target="_blank" rel="noopener">a neo-Nazi group that targeted journalists, judges and corporate executives</a>. We&#8217;ve been fortunate that none of our swatting events ended in physical harm, and that our assailants have all faced justice.</p>
<p>But these dangerous hoaxes can quickly turn deadly: In March 2019, 26-year-old serial swatter <strong>Tyler Barriss</strong> <a href="https://krebsonsecurity.com/2019/03/man-behind-fatal-swatting-gets-20-years/" target="_blank" rel="noopener">was sentenced to 20 years in prison</a> for making a phony emergency call to police in late 2017 that resulted in the <a href="https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack/" target="_blank" rel="noopener">shooting death of an innocent Kansas resident</a>.</p>
<p>In 2021, an 18-year-old Tennessee man who helped set in motion a fraudulent distress call to police that <a href="https://krebsonsecurity.com/2021/07/serial-swatter-who-caused-death-gets-five-years-in-prison/" target="_blank" rel="noopener">led to the death of a 60-year-old grandfather</a> in was sentenced to five years in prison.</p>
<p>The first season of the new documentary series will be <a href="https://www.netflix.com/title/81122462" target="_blank" rel="noopener">available on Netflix starting June 15</a>. See you on TV!</p>


feed_id: https://krebsonsecurity.com/?p=60002
title: Adconion Execs Plead Guilty in Federal Anti-Spam Case
uri: Adconion-Execs-Plead-Guilty-in-Federal-Anti-Spam-Case
url: https://krebsonsecurity.com/2022/06/adconion-execs-plead-guilty-in-federal-anti-spam-case/
content:
<p>At the outset of their federal criminal trial for hijacking vast swaths of Internet addresses for use in large-scale email spam campaigns, three current or former executives at online advertising firm <strong>Adconion Direct</strong> (now <strong>Amobee</strong>)<strong> </strong>have pleaded guilty to lesser misdemeanor charges of fraud and misrepresentation via email.  </p>
<p><img class="aligncenter wp-image-47720" src="media/c1899999.ips.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/05/ips.jpg" alt="" width="750" height="515" /></p>
<p>In October 2018, prosecutors in the Southern District of California named four Ad employees — <a href="https://www.linkedin.com/in/jacobbychak/" target="_blank" rel="noopener"><strong>Jacob Bychak</strong></a>, <a href="media/be97e657.99-Mark-M.-_-LinkedIn.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/09/99-Mark-M.-_-LinkedIn.pdf" target="_blank" rel="noopener"><strong>Mark Manoogian</strong></a>, <a href="https://www.linkedin.com/in/petrpacas/" target="_blank" rel="noopener"><strong>Petr Pacas</strong></a>, and <a href="https://www.linkedin.com/in/mohammed-abdul-qayyum-888a559/" target="_blank" rel="noopener"><strong>Mohammed Abdul Qayyum</strong></a> —  in <a href="media/c6741815.Case318-cr-04683-GPC.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/08/Case318-cr-04683-GPC.pdf" target="_blank" rel="noopener">a ten-count indictment</a> (PDF) on felony charges of conspiracy, wire fraud, and electronic mail fraud.</p>
<p>The government alleged that between December 2010 and September 2014, the defendants engaged in a conspiracy to identify or pay to identify blocks of Internet Protocol (IP) addresses that were registered to others but which were otherwise inactive.</p>
<p>Prosecutors said the men also sent forged letters to an Internet hosting firm claiming they had been authorized by the registrants of the inactive IP addresses to use that space for their own purposes.</p>
<p>All four defendants <a href="https://krebsonsecurity.com/2019/09/feds-allege-adconion-employees-hijacked-ip-addresses-for-spamming/" target="_blank" rel="noopener">pleaded not guilty when they were charged back in 2018</a>, but this week Bychak, Manoogian and Qayyum each entered a plea deal. </p>
<p>&#8220;The defendants’ jobs with Adconion were to acquire fresh IP addresses and employ other measures to circumvent the spam filters,&#8221; reads a statement released today by the U.S. Attorney for the Southern District of California, which said the defendants would pay $100,000 in fines each and perform 100 hours of community service. </p>
<p>&#8220;To conceal Adconion’s ties to the stolen IP addresses and the spam sent from these IP addresses, the defendants used a host of DBAs, virtual addresses, and fake names provided by the company,&#8221; the statement continues. &#8220;While defendants touted ties to well-known name brands, the email marketing campaigns associated with the hijacked IP addresses included advertisements such as &#8216;BigBeautifulWomen,&#8217; &#8216;iPhone4S Promos,&#8217; and &#8216;LatinLove[Cost-per-Click].'&#8221;</p>
<p>None of the three plea agreements are currently available on PACER, the online federal court document clearinghouse. However, PACER does show that on June 7 &#8212; the same day the pleas were entered by the defendants &#8212;  the government submitted to the court a superseding set of <a href="media/27a9a84b.adconion-noticeoflodgement.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/adconion-noticeoflodgement.pdf" target="_blank" rel="noopener">just two misdemeanor charges</a> (PDF) of <a href="https://www.law.cornell.edu/uscode/text/18/1037" target="_blank" rel="noopener">fraud in connection with email</a>.</p>
<p>Another document filed in the case says the fourth defendant &#8212; Pacas &#8212; accepted a deferred prosecution deal, which includes a probationary period and a required $50,000 &#8220;donation&#8221; to a federal &#8220;crime victims fund.&#8221;</p>
<p>There are fewer than four billion so-called “Internet Protocol version 4” or IPv4 addresses available for use, but the vast majority of them have already been allocated. The global dearth of available IP addresses has turned them into a commodity wherein each IP can fetch between $15-$25 on the open market.</p>
<p>This has led to boom times for those engaged in the acquisition and sale of IP address blocks, but it has likewise emboldened those who specialize in <a href="https://krebsonsecurity.com/2019/05/a-tough-week-for-ip-address-scammers/" target="_blank" rel="noopener">absconding with</a> and <a href="https://krebsonsecurity.com/2019/09/feds-allege-adconion-employees-hijacked-ip-addresses-for-spamming/" target="_blank" rel="noopener">spamming from dormant IP address blocks</a> without permission from the rightful owners.<span id="more-60002"></span></p>
<p>In May, prosecutors published information about the source of some IP address ranges from which the Adconion employees allegedly spammed. For example, the government found the men leased some of their IP address ranges from a Dutch company that&#8217;s been tied to a scandal involving more than four million addresses siphoned from the <strong>African Network Information Centre</strong> (AFRINIC), the nonprofit responsible for overseeing IP address allocation for African organizations.</p>
<p>In 2019, AFRINIC fired a top employee after it emerged that in 2013 he quietly commandeered millions of IPs from defunct African entities or from those that were long ago acquired by other firms, and then <a href="https://krebsonsecurity.com/2019/12/the-great-50m-african-ip-address-heist/" target="_blank" rel="noopener">conspired to sell an estimated $50 million worth of the IPs to marketers based outside Africa</a>.</p>
<p>&#8220;Exhibit A&#8221; in a recent government court filing shows that in 2013 Adconion leased more than 65,000 IP addresses from <strong>Inspiring Networks</strong>, a Dutch network services company. In 2020, Inspiring Networks and its director <strong>Maikel Uerlings</strong> were named in a <a href="https://mybroadband.co.za/news/security/367188-the-great-african-ip-address-heist-south-african-internet-resources-worth-r558-million-usurped-with-shady-domains.html" target="_blank" rel="noopener">dogged</a>, <a href="https://mybroadband.co.za/news/internet/383902-r1-3-billion-worth-of-ip-addresses-stolen-in-brazen-heist.html" target="_blank" rel="noopener">multi-part</a> <a href="https://mybroadband.co.za/news/internet/390378-afrinic-hired-a-convicted-criminal-to-look-after-valuable-it-assets.html" target="_blank" rel="noopener">investigation</a> by South African news outlet <strong>MyBroadband.co.za</strong> and researcher <a href="https://krebsonsecurity.com/?s=ron+guilmette" target="_blank" rel="noopener">Ron Guilmette</a> as one of two major beneficiaries of the four million IP addresses looted from AFRINIC by its former employee.</p>
<div id="attachment_60009" style="width: 777px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60009" loading="lazy" class="size-full wp-image-60009" src="media/f34e78d5.inspiring-exhibit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/inspiring-exhibit.png" alt="" width="767" height="552" /><p id="caption-attachment-60009" class="wp-caption-text">Exhibit A, from a May 2022 filing by U.S. federal prosecutors.</p></div>
<p>The address block in the above image &#8212; 196.246.0.0/16 &#8212; was reportedly <a href="https://mailman.nanog.org/pipermail/nanog/2020-January/105679.html" target="_blank" rel="noopener">later reclaimed by AFRINIC</a> following an investigation into the findings by MyBroadband.co.za. Inspiring Networks has not responded to requests for comment.</p>
<p>Prosecutors allege the Adconion employees also obtained hijacked IP address blocks from <strong>Daniel Dye</strong>, another man tied to this case who was charged separately. For many years, Dye was a system administrator for <strong>Optinrealbig</strong>, a Colorado company that relentlessly pimped all manner of junk email, from mortgage leads and adult-related services to counterfeit products and Viagra. In 2018, Dye pleaded guilty to violations of the <a href="https://en.wikipedia.org/wiki/CAN-SPAM_Act_of_2003" target="_blank" rel="noopener">CAN-SPAM Act</a>.</p>
<p>Optinrealbig’s CEO was the spam king <a href="https://en.wikipedia.org/wiki/Scott_Richter" target="_blank" rel="noopener">Scott Richter</a>, who changed the name of the company to <a href="https://krebsonsecurity.com/?s=media+breakaway&amp;x=0&amp;y=0" target="_blank" rel="noopener">Media Breakaway</a> after being successfully sued for spamming by <strong>AOL,</strong> <strong>Microsoft</strong>, <strong>MySpace</strong>, and the New York Attorney General Office, among others. In 2008, this author <a href="http://voices.washingtonpost.com/securityfix/2008/04/a_case_of_network_identity_the_1.html" target="_blank" rel="noopener">penned a column for The Washington Post</a> detailing how Media Breakaway had hijacked tens of thousands of IP addresses from a defunct San Francisco company for use in its spamming operations.</p>
<p>The last-minute plea deals by the Adconion employees were reminiscent of another recent federal criminal prosecution for IP address sleight-of-hand. In November 2021, the CEO of South Carolina technology firm <strong>Micfo</strong> <a href="https://krebsonsecurity.com/2021/11/tech-ceo-pleads-to-wire-fraud-in-ip-address-scheme/" target="_blank" rel="noopener">pleaded guilty just two days into his trial</a>, admitting 20 counts of wire fraud in connection with an elaborate network of phony companies set up to obtain more than 700,000 IPs from the <strong>American Registry for Internet Numbers</strong> (ARIN) &#8212; AFRINIC&#8217;s counterpart in North America.</p>
<p>Adconion was acquired in June 2014 by <strong>Amobee</strong>, a Redwood City, Calif. online ad platform that has catered to some of the world&#8217;s biggest brands. Amobee&#8217;s parent firm &#8212; Singapore-based communications giant <a href="https://en.wikipedia.org/wiki/Singtel" target="_blank" rel="noopener">Singtel</a> &#8212; bought Amobee for $321 million in March 2012.</p>
<p>But as <em>Reuters</em> <a href="https://www.reuters.com/technology/singtel-reviewing-digital-businesses-after-907-million-hit-2021-05-14/" target="_blank" rel="noopener">reported in 2021</a>, Amobee cost Singtel nearly twice as much in the last year alone &#8212; $589 million &#8212; in a &#8220;<a href="https://www.investopedia.com/terms/n/noncashcharge.asp#:~:text=Key%20Takeaways-,A%20non%2Dcash%20charge%20is%20a%20write%2Ddown%20or%20accounting,earnings%20but%20not%20cash%20flows." target="_blank" rel="noopener">non-cash impairment charge</a>&#8221; Singtel disclosed to investors. Marketing industry blog <strong>Digiday.com</strong> <a href="https://digiday.com/marketing/singtel-has-appointed-investment-bank-moelis-to-explore-a-potential-sale-of-amobee/" target="_blank" rel="noopener">reported</a> in February that Singtel was seeking to part ways with its ad tech subsidiary.</p>
<p>One final note about Amobee: In response to <a href="https://krebsonsecurity.com/2019/09/feds-allege-adconion-employees-hijacked-ip-addresses-for-spamming/" target="_blank" rel="noopener">my 2019 story on the criminal charges against the Adconion executives</a>, Amobee issued a statement saying &#8220;Amobee has fully cooperated with the government&#8217;s investigation of this 2017 matter which pertains to alleged activities that occurred years prior to Amobee&#8217;s acquisition of the company.&#8221;</p>
<p>Yet as the government&#8217;s indictment points out, the alleged hijacking activities took place up until September 2014, which was <em>after</em> Amobee&#8217;s acquisition of Adconion Direct in June 2014. Also, the IP address ranges that the Adconion executives were prosecuted for hijacking were all related to incidents in 2013 and 2014, which is hardly &#8220;years prior to Amobee&#8217;s acquisition of the company.&#8221;</p>
<p>Amobee has not yet responded to requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=60077
title: “Downthem” DDoS-for-Hire Boss Gets 2 Years in Prison
uri: Downthem-DDoS-for-Hire-Boss-Gets-2-Years-in-Prison
url: https://krebsonsecurity.com/2022/06/downthem-ddos-for-hire-boss-gets-2-years-in-prison/
content:
<p>A 33-year-old Illinois man was sentenced to two years in prison today following his conviction last year for operating services that allowed paying customers to launch powerful distributed denial-of-service (DDoS) attacks against hundreds of thousands of Internet users and websites. </p>
<div id="attachment_46107" style="width: 790px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-46107" src="media/cf505133.downthempanel2.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/downthempanel2.jpg" alt="" width="780" height="581" class="size-full wp-image-46107" /><p id="caption-attachment-46107" class="wp-caption-text">The user interface for Downthem[.]org.</p></div>
<p><strong>Matthew Gatrel</strong> of St. Charles, Ill. was found guilty for violations of the Computer Fraud and Abuse Act (CFAA) related to his operation of <strong>downthem[.]org</strong> and <strong>ampnode[.]com</strong>, two DDoS-for-hire services that had thousands of customers who paid to launch more than 200,000 attacks. </p>
<p>Despite admitting to FBI agents that he ran these so-called &#8220;<strong>booter</strong>&#8221; services (and turning over plenty of incriminating evidence in the process), Gatrel opted to take his case to trial, defended the entire time by public defenders. Gatrel&#8217;s co-defendant and partner in the business, <strong>Juan &#8220;Severon&#8221; Martinez</strong> of Pasadena, Calif., pleaded guilty just before the trial.</p>
<p>After a nine-day trial in the Central District of California, Gatrel was convicted on all three counts, including conspiracy to commit unauthorized impairment of a protected computer, conspiracy to commit wire fraud, and unauthorized impairment of a protected computer.</p>
<p>Prosecutors said Downthem sold subscriptions allowing customers to launch DDoS attacks, while AmpNode provided &#8220;bulletproof&#8221; server hosting to customers &#8212; with an emphasis on &#8220;spoofing&#8221; servers that could be pre-configured with DDoS attack scripts and lists of vulnerable &#8220;attack amplifiers&#8221; used to launch simultaneous cyberattacks on victims.<span id="more-60077"></span></p>
<p>Booter and stresser services let customers pick from among a variety of attack methods, but almost universally the most powerful of these methods involves what’s known as a &#8220;reflective amplification attack.&#8221; In such assaults, the perpetrators leverage unmanaged Domain Name Servers (DNS) or other devices on the Web to create huge traffic floods.</p>
<p>Ideally, DNS servers only provide services to machines within a trusted domain — such as translating an Internet address from a series of numbers into a domain name, like example.com. But DNS reflection attacks rely on consumer and business routers and other devices equipped with DNS servers that are (mis)configured to accept queries from anywhere on the Web.</p>
<p>Attackers can send spoofed DNS queries to these DNS servers, forging the request so that it appears to come from the target’s network. That way, when the DNS servers respond, they reply to the spoofed (target) address.</p>
<p>The bad guys also can amplify a reflective attack by crafting DNS queries so that the responses are much bigger than the requests. For example, an attacker could compose a DNS request of less than 100 bytes, prompting a response that is 60-70 times as large. This “amplification” effect is especially pronounced if the perpetrators query dozens of DNS servers with these spoofed requests simultaneously.</p>
<p>The government charged that Gatrel and Martinez constantly scanned the Internet for these misconfigured devices, and then sold lists of Internet addresses tied to these devices to other booter service operators.</p>
<p>&#8220;Gatrel ran a criminal enterprise designed around launching hundreds of thousands of cyber-attacks on behalf of hundreds of customers,&#8221; prosecutors wrote in a memorandum submitted in advance of his sentencing. &#8220;He also provided infrastructure and resources for other cybercriminals to run their own businesses launching these same kinds of attacks. These attacks victimized wide swaths of American society and compromised computers around the world.&#8221;</p>
<p>The U.S. and United Kingdom have been trying to impress on would-be customers of these booter services that hiring them for DDoS attacks is illegal. The U.K. has even <a href="https://krebsonsecurity.com/2020/05/uk-ad-campaign-seeks-to-deter-cybercrime/" rel="noopener" target="_blank">taken out Google ads to remind U.K. residents when they search online for terms common to booter services</a>. </p>
<p>The case against Gatrel and Martinez was brought as part of <a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" rel="noopener" target="_blank">a widespread crackdown on booter services in 2018</a>, when the FBI joined law enforcement partners overseas to seize 15 different booter service domains. </p>
<p>Those actions have prompted <a href="https://krebsonsecurity.com/category/ddos-for-hire/" rel="noopener" target="_blank">a flurry of prosecutions</a>, with wildly varying sentences when the booter service owners are invariably found guilty. However, DDoS experts say booter and stresser services that remain in operation continue to account for the vast majority of DDoS attacks launched daily around the globe.</p>


feed_id: https://krebsonsecurity.com/?p=60097
title: Ransomware Group Debuts Searchable Victim Data
uri: Ransomware-Group-Debuts-Searchable-Victim-Data
url: https://krebsonsecurity.com/2022/06/ransomware-group-debuts-searchable-victim-data/
content:
<p>Cybercrime groups that specialize in stealing corporate data and demanding a ransom not to publish it have tried countless approaches to shaming their victims into paying. The latest innovation in ratcheting up the heat comes from the <strong>ALPHV/BlackCat </strong>ransomware group, which has traditionally published any stolen victim data on the Dark Web. Today, however, the group began publishing individual victim websites on the public Internet, with the leaked data made available in an easily searchable form.</p>
<div id="attachment_60099" style="width: 764px" class="wp-caption aligncenter"><a href="media/17e2a84a.clearwebvictim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/clearwebvictim.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-60099" class="wp-image-60099" src="media/17e2a84a.clearwebvictim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/clearwebvictim.png" alt="" width="754" height="283" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/clearwebvictim.png 1284w, https://krebsonsecurity.com/wp-content/uploads/2022/06/clearwebvictim-768x288.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/clearwebvictim-782x294.png 782w" sizes="(max-width: 754px) 100vw, 754px" /></a><p id="caption-attachment-60099" class="wp-caption-text">The ALPHV site claims to care about people&#8217;s privacy, but they let anyone view the sensitive stolen data.</p></div>
<p>ALPHV recently announced on its victim shaming and extortion website that it had hacked a luxury spa and resort in the western United States. Sometime in the last 24 hours, ALPHV published a website with the same victim&#8217;s name in the domain, and their logo on the homepage.</p>
<p>The website claims to list the personal information of 1,500 resort employees, and more than 2,500 residents at the facility. At the top of the page are two &#8220;Check Yourself&#8221; buttons, one for employees, and another for guests.</p>
<p><strong>Brett Callow</strong>, a threat analyst with security firm <a href="https://www.emsisoft.com" target="_blank" rel="noopener">Emsisoft</a>, called the move by ALPHV &#8220;a cunning tactic&#8221; that will most certainly worry their other victims.</p>
<p>Callow said most of the victim shaming blogs maintained by the major ransomware and data ransom groups exist on obscure, slow-loading sites on the Darknet, reachable only through the use of third-party software like <a href="https://www.torproject.org/" target="_blank" rel="noopener">Tor</a>. But the website erected by ALPHV as part of this new pressure tactic is available on the open Internet.</p>
<p>&#8220;Companies will likely be more concerned about the prospect of their data being shared in this way than of simply being posted to an obscure Tor site for which barely anyone knows the URL,&#8221; Callow said. &#8220;It&#8217;ll piss people off and make class actions more likely.&#8221;<span id="more-60097"></span></p>
<p>It&#8217;s unclear if ALPHV plans to pursue this approach with every victim, but other recent victims of the crime group include a school district and a U.S. city. Most likely, this is a test run to see if it improves results.</p>
<p>&#8220;We are not going to stop, our leak distribution department will do their best to bury your business,&#8221; the victim website reads. &#8220;At this point, you still have a chance to keep your hotel&#8217;s security and reputation. We strongly advise you to be proactive in your negotiations; you do not have much time.&#8221;</p>
<p>Emerging in November 2021, ALPHV is perhaps most notable for its programming language (<a href="https://krebsonsecurity.com/2022/01/who-wrote-the-alphv-blackcat-ransomware-strain/" target="_blank" rel="noopener">it is written in Rust</a>). ALPHV has been actively recruiting operators from several ransomware organizations — including <a href="https://krebsonsecurity.com/?s=REvil" target="_blank" rel="noopener">REvil</a>, <a href="https://krebsonsecurity.com/?s=blackmatter" target="_blank" rel="noopener">BlackMatter</a> and <a href="https://krebsonsecurity.com/?s=darkside" target="_blank" rel="noopener">DarkSide</a> — offering affiliates up to 90 percent of any ransom paid by a victim organization.</p>
<p>Many security experts believe ALPHV/BlackCat is simply <a href="https://krebsonsecurity.com/2021/08/ransomware-gangs-and-the-name-game-distraction/" target="_blank" rel="noopener">a rebrand of another ransomware group</a> &#8212; &#8220;<strong>Darkside</strong>&#8221; a.k.a. &#8220;<strong>BlackMatter</strong>,&#8221; the same gang responsible for <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">the 2021 attack on Colonial Pipeline that caused fuel shortages and price spikes for several days last summer</a>.</p>
<p>Callow said there may be an upside to this ALPHV innovation, noting that his wife recently heard directly from a different ransomware group &#8212; <strong>Cl0p</strong>.</p>
<p>&#8220;On a positive note, stunts like this mean people may actually find out that their PI has been compromised,&#8221; he said. &#8220;Cl0p emailed my wife last year. The company that lost her data still hasn&#8217;t made any public disclosure or notified the people who were impacted (at least, she hasn&#8217;t heard from the company.)&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=59985
title: Microsoft Patch Tuesday, June 2022 Edition
uri: Microsoft-Patch-Tuesday-June-2022-Edition
url: https://krebsonsecurity.com/2022/06/microsoft-patch-tuesday-june-2022-edition/
content:
<p><strong>Microsoft</strong> on Tuesday released software updates to fix 60 security vulnerabilities in its <strong>Windows</strong> operating systems and other software, including a zero-day flaw in all supported <strong>Microsoft Office</strong> versions on all flavors of Windows that&#8217;s seen active exploitation for at least two months now. On a lighter note, Microsoft is officially retiring its <strong>Internet Explorer</strong> (IE) web browser, which turns 27 years old this year.</p>
<p><img class="aligncenter size-full wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="841" height="592" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 841px) 100vw, 841px" /></p>
<p>Three of the bugs tackled this month earned Microsoft&#8217;s most dire &#8220;critical&#8221; label, meaning they can be exploited remotely by malware or miscreants to seize complete control over a vulnerable system. On top of the critical heap this month is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30190">CVE-2022-30190</a>, a vulnerability in the <strong>Microsoft Support Diagnostics Tool</strong> (MSDT), a service built into Windows.</p>
<p>Dubbed &#8220;<strong>Follina</strong>,&#8221; the flaw became public knowledge on May 27, when a security researcher <a href="https://twitter.com/nao_sec/status/1530196847679401984" target="_blank" rel="noopener">tweeted</a> about a malicious <strong>Word</strong> document that had surprisingly low detection rates by antivirus products. Researchers soon learned that the malicious document was using a feature in Word to retrieve a HTML file from a remote server, and that HTML file in turn used MSDT to load code and execute PowerShell commands.</p>
<p>&#8220;What makes this new MS Word vulnerability unique is the fact that there are no macros exploited in this attack,&#8221; writes <strong>Mayuresh Dani</strong>, manager of threat research at <strong>Qualys</strong>. &#8220;Most malicious Word documents leverage the macro feature of the software to deliver their malicious payload. As a result, normal macro-based scanning methods will not work to detect Follina. All an attacker needs to do is lure a targeted user to download a Microsoft document or view an HTML file embedded with the malicious code.&#8221;</p>
<p><strong>Kevin Beaumont</strong>, the researcher who gave Follina its name, penned <a href="https://doublepulsar.com/follina-a-microsoft-office-code-execution-vulnerability-1a47fce5629e?gi=544f02649952" target="_blank" rel="noopener">a fairly damning account and timeline</a> of Microsoft&#8217;s response to being alerted about the weakness. Beaumont says researchers in March 2021 told Microsoft they were able achieve the same exploit using Microsoft Teams as an example, and that Microsoft silently fixed the issue in Teams but did not patch MSDT in Windows or the attack vector in Microsoft Office.</p>
<p>Beaumont said other researchers on April 12, 2022 told Microsoft about active exploitation of the MSDT flaw, but Microsoft closed the ticket saying it wasn&#8217;t a security issue. Microsoft finally issued a CVE for the problem on May 30, the same day it <a href="https://msrc-blog.microsoft.com/2022/05/30/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/" target="_blank" rel="noopener">released recommendations</a> on how to mitigate the threat from the vulnerability.</p>
<p>Microsoft also is taking flak from security experts regarding a different set of flaws in its Azure cloud hosting platform. <strong>Orca Security</strong> said that <a href="https://orca.security/resources/blog/synlapse-critical-azure-synapse-analytics-service-vulnerability/" target="_blank" rel="noopener">back on January 4</a> it told Microsoft about a critical bug in Azure&#8217;s <strong>Synapse</strong> service that allowed attackers to obtain credentials to other workspaces, execute code, or leak customer credentials to data sources outside of Azure.</p>
<p>In <a href="https://orca.security/resources/blog/azure-synapse-analytics-security-advisory/" target="_blank" rel="noopener">an update</a> to their research published Tuesday, Orca researchers said they were able to bypass Microsoft&#8217;s fix for the issue twice before the company put a working fix in place.</p>
<p>&#8220;In previous cases, vulnerabilities were fixed by the cloud providers within a few days of our disclosure to the affected vendor,&#8221; wrote Orca&#8217;s <strong>Avi Shua</strong>. &#8220;Based on our understanding of the architecture of the service, and our repeated bypasses of fixes, we think that the architecture contains underlying weaknesses that should be addressed with a more robust tenant separation mechanism. Until a better solution is implemented, we advise that all customers assess their usage of the service and refrain from storing sensitive data or keys in it.&#8221;<span id="more-59985"></span></p>
<p><strong>Amit Yoran</strong>, CEO of <strong>Tenable</strong> and a former U.S. cybersecurity czar, took Microsoft to task for silently patching an issue Tenable reported in the same Azure Synapse service.</p>
<p>&#8220;It was only after being told that we were going to go public, that their story changed&#8230;89 days after the initial vulnerability notification&#8230;when they privately acknowledged the severity of the security issue,&#8221; Yoran wrote in <a href="https://www.linkedin.com/pulse/microsofts-vulnerability-practices-put-customers-risk-amit-yoran/?trackingId=PLcDXIRdRxuq%2FQ4RDpyEHA%3D%3D" target="_blank" rel="noopener">a post on LinkedIn</a>. &#8220;To date, Microsoft customers have not been notified. Without timely and detailed disclosures, customers have no idea if they were, or are, vulnerable to attack…or if they fell victim to attack prior to a vulnerability being patched. And not notifying customers denies them the opportunity to look for evidence that they were or were not compromised, a grossly irresponsible policy.&#8221;</p>
<p>Also in the critical and notable stack this month is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30136" target="_blank" rel="noopener">CVE-2022-30136</a>, which is a remote code execution flaw in the <strong>Windows Network File System</strong> (NFS version 4.1) that earned a CVSS score of 9.8 (10 being the worst). Microsoft issued a very similar patch last month for vulnerabilities in NFS versions 2 and 3.</p>
<p>&#8220;This vulnerability could allow a remote attacker to execute privileged code on affected systems running NFS. On the surface, the only difference between the patches is that this month’s update fixes a bug in NFSV4.1, whereas last month’s bug only affected versions NSFV2.0 and NSFV3.0,&#8221; wrote <strong>Trend Micro&#8217;s Zero Day Initiative</strong>. &#8220;It’s not clear if this is a variant or a failed patch or a completely new issue. Regardless, enterprises running NFS should prioritize testing and deploying this fix.&#8221;</p>
<p>Beginning today, Microsoft will officially stop supporting most versions of its Internet Explorer Web browser, which was launched in August 1995. The IE desktop application will be disabled, and Windows users who wish to stick with a Microsoft browser are encouraged to move to Microsoft Edge with IE mode, which will be supported through at least 2029.</p>
<p>For a closer look at the patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+June+2022+Patch+Tuesday/28742/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody.com</a> usually has the dirt on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=60121
title: Why Paper Receipts are Money at the Drive-Thru
uri: Why-Paper-Receipts-are-Money-at-the-Drive-Thru
url: https://krebsonsecurity.com/2022/06/why-paper-receipts-are-money-at-the-drive-thru/
content:
<p>Check out this handmade sign posted to the front door of a shuttered <strong>Jimmy John&#8217;s</strong> sandwich chain shop in Missouri last week. See if you can tell from the store owner&#8217;s message what happened.</p>
<p><img class="aligncenter wp-image-60133" src="media/351bc4eb.jjclosed.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/jjclosed.png" alt="" width="560" height="761" /></p>
<p>If you guessed that someone in the Jimmy John&#8217;s store might have fallen victim to a <a href="https://krebsonsecurity.com/tag/bec/" target="_blank" rel="noopener">Business Email Compromise</a> (BEC) or &#8220;CEO fraud&#8221; scheme &#8212; wherein the scammers impersonate company executives to steal money &#8212; you&#8217;d be in good company.</p>
<p>In fact, that was my initial assumption when a reader in Missouri shared this photo after being turned away from his favorite local sub shop. But a conversation with the store&#8217;s owner <strong>Steve Saladin</strong> brought home the truth that some of the best solutions to fighting fraud are even more low-tech than BEC scams.</p>
<p>Visit any random fast-casual dining establishment and there&#8217;s a good chance you&#8217;ll see a sign somewhere from the management telling customers their next meal is free if they don&#8217;t receive a receipt with their food. While it may not be obvious, such policies are meant to deter employee theft.</p>
<p>You can probably guess by now that this particular Jimmy John&#8217;s franchise &#8212; in Sunset Hills, Mo. &#8212; was among those that chose not to incentivize its customers to insist upon receiving receipts. Thanks to that oversight, Saladin was forced to close the store last week and fire the husband-and-wife managers for allegedly embezzling nearly $100,000 in cash payments from customers.</p>
<p>Saladin said he began to suspect something was amiss after he agreed to take over the Monday and Tuesday shifts for the couple so they could have two consecutive days off together. He said he noticed that cash receipts at the end of the nights on Mondays and Tuesdays were &#8220;substantially larger&#8221; than when he wasn&#8217;t manning the till, and that this was consistent over several weeks.</p>
<p>Then he had friends proceed through his restaurant&#8217;s drive-thru, to see if they received receipts for cash payments.</p>
<p>&#8220;One of [the managers] would take an order at the drive-thru, and when they determined the customer was going to pay with cash the other would make the customer&#8217;s change for it, but then delete the order before the system could complete it and print a receipt,&#8221; Saladin said.</p>
<p><span id="more-60121"></span></p>
<p>Saladin said his attorneys and local law enforcement are now involved, and he estimates the former employees stole close to $100,000 in cash receipts. That was on top of the $115,000 in salaries he paid in total each year to both employees. Saladin also has to figure out a way to pay his franchisor a fee for each of the stolen transactions.</p>
<p>Now Saladin sees the wisdom of adding the receipt sign, and says all of his stores will soon carry a sign offering $10 in cash to any customers who report not receiving a receipt with their food.</p>
<p>Many business owners are reluctant to involve the authorities when they discover that a current or former employee has stolen from them. Too often, organizations victimized by employee theft shy away from reporting it because they&#8217;re worried that any resulting media coverage of the crime will do more harm than good.</p>
<p>But there are discrete ways to ensure embezzlers get their due. A few years back, I attended a presentation by an investigator with the criminal division of the <strong>U.S.</strong> <strong>Internal Revenue Service</strong> (IRS) who suggested that any embezzling victims seeking a discrete law enforcement response should simply contact the IRS.</p>
<p>The agent said the IRS is obligated to investigate all notifications it receives from employers about unreported income, but that embezzling victims often neglect to even notify the agency. That&#8217;s a shame, he said, because under U.S. federal law, anyone who willfully attempts to evade or defeat taxes can be charged with a felony, with penalties including up to $100,000 in fines, up to five years in prison, and the costs of prosecution.</p>


feed_id: https://krebsonsecurity.com/?p=60160
title: Meet the Administrators of the RSOCKS Proxy Botnet
uri: Meet-the-Administrators-of-the-RSOCKS-Proxy-Botnet
url: https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/
content:
<p>Authorities in the United States, Germany, the Netherlands and the U.K. last week said they dismantled the &#8220;<strong>RSOCKS</strong>&#8221; botnet, a collection of millions of hacked devices that were sold as &#8220;proxies&#8221; to cybercriminals looking for ways to route their malicious traffic through someone else&#8217;s computer. While the coordinated action did not name the Russian hackers allegedly behind RSOCKS, KrebsOnSecurity has identified its owner as a 35-year-old Russian man living abroad who also runs the world&#8217;s top Russian spamming forum.</p>
<div id="attachment_60165" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60165" class=" wp-image-60165" src="media/7a509415.rusdotmailer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdotmailer.png" alt="" width="750" height="467" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdotmailer.png 1183w, https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdotmailer-768x478.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdotmailer-782x487.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60165" class="wp-caption-text">The RUSdot mailer, the email spamming tool made and sold by the administrator of RSOCKS.</p></div>
<p>According to <a href="https://www.justice.gov/usao-sdca/pr/russian-botnet-disrupted-international-cyber-operation" target="_blank" rel="noopener">a statement</a> by the <strong>U.S. Department of Justice</strong>, RSOCKS offered clients access to IP addresses assigned to devices that had been hacked:</p>
<p>&#8220;A cybercriminal who wanted to utilize the RSOCKS platform could use a web browser to navigate to a web-based &#8216;storefront&#8217; (i.e., a public web site that allows users to purchase access to the botnet), which allowed the customer to pay to rent access to a pool of proxies for a specified daily, weekly, or monthly time period. The cost for access to a pool of RSOCKS proxies ranged from $30 per day for access to 2,000 proxies to $200 per day for access to 90,000 proxies.&#8221;</p>
<p>The DOJ&#8217;s statement doesn&#8217;t mention that RSOCKS has been in operation since 2014, when access to the web store for the botnet was first advertised on multiple Russian-language cybercrime forums.</p>
<p>The user &#8220;RSOCKS&#8221; on the Russian crime forum <strong>Verified</strong> changed his name to RSOCKS from a previous handle: &#8220;<strong>Stanx</strong>,&#8221; whose very first sales thread on Verified in 2016 quickly ran afoul of the forum&#8217;s rules and prompted a public chastisement by the forum&#8217;s administrator.</p>
<p>Verified was hacked twice in the past few years, and each time the private messages of all users on the forum were leaked. Those messages show that after being warned of his forum infraction, Stanx sent a private message to the Verified administrator detailing his cybercriminal bona fides.</p>
<p>&#8220;I am the owner of the RUSdot forum (former Spamdot),&#8221; Stanx wrote in Sept. 2016. &#8220;In spam topics, people know me as a reliable person.&#8221;</p>
<div id="attachment_60181" style="width: 774px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60181" loading="lazy" class=" wp-image-60181" src="media/78b8e106.rusdot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot.png" alt="" width="764" height="455" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot.png 1267w, https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot-768x457.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot-782x465.png 782w" sizes="(max-width: 764px) 100vw, 764px" /><p id="caption-attachment-60181" class="wp-caption-text">A Google-translated version of the Rusdot spam forum.</p></div>
<p>RUSdot is the successor forum to <strong>Spamdot</strong>, a far more secretive and restricted forum where most of the world&#8217;s top spammers, virus writers and cybercriminals collaborated for years before <a href="https://krebsonsecurity.com/2010/09/spam-affialite-program-spamit-com-to-close/" target="_blank" rel="noopener">the community&#8217;s implosion in 2010</a>. Even today, the RUSdot Mailer is advertised for sale at the top of the RUSdot community forum.</p>
<p>Stanx said he was a longtime member of several major forums, including the Russian hacker forum <strong>Antichat</strong> (since 2005), and the Russian crime forum <strong>Exploit</strong> (since April 2013). In an early post to Antichat in January 2005, Stanx disclosed that he is from <strong>Omsk</strong>, a large city in the Siberian region of Russia.</p>
<p>According to the cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, the user Stanx indeed registered on Exploit in 2013, using the email address <strong>stanx@rusdot.com</strong>, and the ICQ number <strong>399611</strong>. A search in Google for that ICQ number turns up a cached version of a <a href="https://web.archive.org/web/20100724205441/http://vkontakte.ru/kloster" target="_blank" rel="noopener">Vkontakte profile</a> for a <strong>Denis &#8220;Neo&#8221; Kloster</strong>, from Omsk, Russia.<span id="more-60160"></span></p>
<p>Cybersecurity firm <a href="http://www.constellainteligence.com" target="_blank" rel="noopener">Constella Intelligence</a> shows that in 2017, someone using the email address <strong>istanx@gmail.com</strong> registered at the Russian freelancer job site <strong>fl.ru</strong> with the profile name of &#8220;<strong>Denis Kloster</strong>&#8221; and the Omsk phone number of <strong>79136334444</strong>.</p>
<p>That phone number is tied to the WHOIS registration records for multiple domain names over the years, including <strong>proxy[.]info</strong>, <strong>allproxy[.]info</strong>, <strong>kloster.pro</strong> and <strong>deniskloster.com</strong>.</p>
<div id="attachment_60166" style="width: 498px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60166" loading="lazy" class="size-full wp-image-60166" src="media/95f9be6f.klosterpp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/klosterpp.png" alt="" width="488" height="500" /><p id="caption-attachment-60166" class="wp-caption-text">A copy of the passport for Denis Kloster, as posted to his Vkontakte page in 2019. It shows that in Oct. 2019, he obtained a visa from the American Embassy in Bangkok, Thailand.</p></div>
<p>The &#8220;about me&#8221; section of DenisKloster.com says the 35-year-old was born in Omsk, that he got his first computer at age 12, and graduated from high school at 16. Kloster says he&#8217;s worked in many large companies in Omsk as a system administrator, web developer and photographer.</p>
<p>According to Kloster&#8217;s blog, his first real job was running an &#8220;online advertising&#8221; firm he founded called <strong>Internet Advertising Omsk</strong> (&#8220;<strong>riOmsk</strong>&#8220;), and that he even lived in New York City for a while.</p>
<p>&#8220;Something new was required and I decided to leave Omsk and try to live in the States,&#8221; Kloster <a href="https://web.archive.org/web/20130819021130/http://deniskloster.com/index.php/aboutme" target="_blank" rel="noopener">wrote in 2013</a>. &#8220;I opened an American visa for myself, it was not difficult to get. And so I moved to live in New York, the largest city in the world, in a country where all wishes come true. But even this was not enough for me, and since then I began to travel the world.&#8221;</p>
<p>The <a href="https://deniskloster-com.translate.goog/%d0%be%d0%b1%d0%be-%d0%bc%d0%bd%d0%b5/?_x_tr_sl=en&amp;_x_tr_tl=ru&amp;_x_tr_hl=en&amp;_x_tr_pto=wapp&amp;_x_tr_sch=http" target="_blank" rel="noopener">current version of the About Me page</a> on Kloster&#8217;s site says he closed his advertising business in 2013 to travel the world and focus on his new company: One that provides security and anonymity services to customers around the world. Kloster&#8217;s vanity website and <a href="https://www.linkedin.com/in/denis-kloster-036793111/" target="_blank" rel="noopener">LinkedIn page</a> both list him as CEO of a company called &#8220;<strong>SL MobPartners</strong>.&#8221;</p>
<p>In 2016, Deniskloster.com featured <a href="https://deniskloster-com.translate.goog/%d0%bd%d0%b0%d0%bc-%d1%82%d1%80%d0%b8-%d0%b3%d0%be%d0%b4%d0%b0-2/?_x_tr_sch=http&amp;_x_tr_sl=en&amp;_x_tr_tl=ru&amp;_x_tr_hl=en&amp;_x_tr_pto=wapp" target="_blank" rel="noopener">a post celebrating three years in operation</a>. The anniversary post said Kloster&#8217;s anonymity business had grown to nearly two dozen employees, most of whom were included in a group photo posted to that article (and some of whom Kloster thanked by their first names and last initials).</p>
<div id="attachment_60163" style="width: 667px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60163" loading="lazy" class="size-full wp-image-60163" src="media/3d2966f9.klosterphoto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/klosterphoto.png" alt="" width="657" height="366" /><p id="caption-attachment-60163" class="wp-caption-text">The employees who kept things running for RSOCKS, circa 2016.</p></div>
<p>&#8220;Thanks to you, we are now developing in the field of information security and anonymity!,&#8221; the post enthuses. &#8220;We make products that are used by thousands of people around the world, and this is very cool! And this is just the beginning!!! We don&#8217;t just work together and we&#8217;re not just friends, we&#8217;re Family.&#8221;</p>
<p>Mr. Kloster did not respond to repeated requests for comment.</p>
<p>It&#8217;s not clear if the coordinated takedown targeting the RSOCKS botnet will be permanent, as the botnet&#8217;s owners could simply rebuild &#8212; and possibly rebrand &#8212; their crime machine. But the malware-based proxy services have struggled to remain competitive in a cybercrime market with increasingly sophisticated proxy services that offer many additional features.</p>
<p>The demise of RSOCKS follows closely on the heels of <strong>VIP72[.]com</strong>, a competing proxy botnet service that operated for a decade before its owners <a href="https://krebsonsecurity.com/2021/09/15-year-old-malware-proxy-network-vip72-goes-dark/" target="_blank" rel="noopener">pulled the plug on the service</a> last year.</p>


feed_id: https://krebsonsecurity.com/?p=60191
title: The Link Between AWM Proxy & the Glupteba Botnet
uri: The-Link-Between-AWM-Proxy-the-Glupteba-Botnet
url: https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/
content:
<p>On December 7, 2021, <strong>Google</strong> announced it was suing two Russian men allegedly responsible for operating the <strong>Glupteba</strong> botnet, a global malware menace that has infected millions of computers over the past decade. That same day, <strong>AWM Proxy</strong> &#8212; a 14-year-old anonymity service that rents hacked PCs to cybercriminals &#8212; suddenly went offline. Security experts had long seen a link between Glupteba and AWM Proxy, but new research shows AWM Proxy&#8217;s founder is one of the men being sued by Google.</p>
<div id="attachment_11383" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-11383" class=" wp-image-11383" src="media/dd60d1ea.awmpsite.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2011/09/awmpsite.png" alt="" width="754" height="443" srcset="https://krebsonsecurity.com/wp-content/uploads/2011/09/awmpsite.png 1234w, https://krebsonsecurity.com/wp-content/uploads/2011/09/awmpsite-300x176.png 300w, https://krebsonsecurity.com/wp-content/uploads/2011/09/awmpsite-1024x601.png 1024w" sizes="(max-width: 754px) 100vw, 754px" /><p id="caption-attachment-11383" class="wp-caption-text">AWMproxy, the storefront for renting access to infected PCs, circa 2011.</p></div>
<p>Launched in March 2008, AWM Proxy quickly became the largest service for crooks seeking to route their malicious Web traffic through compromised devices. In 2011, researchers at <strong>Kaspersky Lab</strong> <a href="https://krebsonsecurity.com/2011/09/rent-a-bot-networks-tied-to-tdss-botnet/" target="_blank" rel="noopener">showed</a> that virtually all of the hacked systems for rent at AWM Proxy had been compromised by <strong>TDSS</strong> (a.k.a <a href="https://en.wikipedia.org/wiki/Alureon" target="_blank" rel="noopener">TDL-4 and Alureon</a>), a stealthy &#8220;rootkit&#8221; that installs deep within infected PCs and loads even before the underlying Windows operating system boots up.</p>
<p>In March 2011, security researchers at <strong>ESET</strong> <a href="https://www.welivesecurity.com/2011/03/02/tdl4-and-glubteba-piggyback-piggybugs/" target="_blank" rel="noopener">found</a> TDSS was being used to deploy Glupteba, another rootkit that steals passwords and other access credentials, disables security software, and tries to compromise other devices on the victim&#8217;s network &#8212; such as Internet routers and media storage servers &#8212; for use in relaying spam or other malicious traffic.</p>
<div id="attachment_60212" style="width: 998px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60212" loading="lazy" class="size-full wp-image-60212" src="media/218d8565.certpolska-glupteba.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/certpolska-glupteba.png" alt="" width="988" height="602" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/certpolska-glupteba.png 988w, https://krebsonsecurity.com/wp-content/uploads/2022/06/certpolska-glupteba-768x468.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/certpolska-glupteba-782x476.png 782w" sizes="(max-width: 988px) 100vw, 988px" /><p id="caption-attachment-60212" class="wp-caption-text">A report from the Polish computer emergency response team (CERT Orange Polksa) found Glupteba was by far the biggest malware threat in 2021.</p></div>
<p>Like its predecessor TDSS, Glupteba is primarily distributed through <a href="https://krebsonsecurity.com/2011/06/pay-per-install-a-major-source-of-badness/" target="_blank" rel="noopener">&#8220;pay-per-install&#8221; or PPI networks</a>, and via traffic purchased from traffic distribution systems (TDS). Pay-per-install networks try to match cybercriminals who already have access to large numbers of hacked PCs with other crooks seeking broader distribution of their malware.</p>
<p>In a typical PPI network, clients will submit their malware—a spambot or password-stealing Trojan, for example —to the service, which in turn charges per thousand successful installations, with the price depending on the requested geographic location of the desired victims. One of the most common ways PPI affiliates generate revenue is by secretly bundling the PPI network&#8217;s installer with pirated software titles that are widely available for download via the web or from file-sharing networks.</p>
<div id="attachment_60211" style="width: 547px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60211" loading="lazy" class=" wp-image-60211" src="media/331058e4.glupteba-eg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/glupteba-eg.png" alt="" width="537" height="585" /><p id="caption-attachment-60211" class="wp-caption-text">An example of a cracked software download site distributing Glupteba. Image: Google.com.</p></div>
<p>Over the past decade, both Glupteba and AWM Proxy have grown substantially. When KrebsOnSecurity <a href="https://krebsonsecurity.com/2011/09/rent-a-bot-networks-tied-to-tdss-botnet/" target="_blank" rel="noopener">first covered AWM Proxy in 2011</a>, the service was selling access to roughly 24,000 infected PCs scattered across dozens of countries. Ten years later, AWM Proxy was offering 10 times that number of hacked systems on any given day, and Glupteba had grown to more than one million infected devices worldwide.</p>
<p>There is also <a href="https://decoded.avast.io/martinhron/meris-and-trickbot-standing-on-the-shoulders-of-giants/" target="_blank" rel="noopener">ample</a> <a href="https://therecord.media/russian-security-firm-sinkholes-part-of-the-dangerous-meris-ddos-botnet/" target="_blank" rel="noopener">evidence</a> to suggest that Glupteba may have spawned <strong>Meris</strong>, <a href="https://krebsonsecurity.com/2021/09/krebsonsecurity-hit-by-huge-new-iot-botnet-meris/" target="_blank" rel="noopener">a massive botnet of hacked Internet of Things (IoT) devices</a> that surfaced in September 2021 and was responsible for some of the largest and most disruptive distributed denial-of-service (DDoS) attacks the Internet has ever seen.</p>
<p>But on Dec. 7, 2021, Google <a href="https://blog.google/threat-analysis-group/disrupting-glupteba-operation/" target="_blank" rel="noopener">announced</a> it had taken technical measures to dismantle the Glupteba botnet, and <a href="media/9f1e1a6f.1_Complaint.pdf" data-original-source="https://storage.googleapis.com/gweb-uniblog-publish-prod/documents/1_Complaint.pdf" target="_blank" rel="noopener">filed a civil lawsuit</a> (PDF) against two Russian men thought to be responsible for operating the vast crime machine. AWM Proxy&#8217;s online storefront disappeared that same day.<span id="more-60191"></span></p>
<p>AWM Proxy quickly alerted its customers that the service had moved to a new domain, with all customer balances, passwords and purchase histories seamlessly ported over to the new home. However, subsequent takedowns targeting AWM Proxy&#8217;s domains and other infrastructure have conspired to keep the service on the ropes and frequently switching domains ever since.</p>
<p>Earlier this month, the United States, Germany, the Netherlands and the U.K. dismantled the “<strong>RSOCKS</strong>” botnet, a competing proxy service that had been in operation since 2014. KrebsOnSecurity has <a href="https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/" target="_blank" rel="noopener">identified the owner of RSOCKS as a 35-year-old from Omsk, Russia</a> who runs the world&#8217;s largest forum catering to spammers.</p>
<div id="attachment_60163" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60163" loading="lazy" class=" wp-image-60163" src="media/3d2966f9.klosterphoto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/klosterphoto.png" alt="" width="747" height="416" /><p id="caption-attachment-60163" class="wp-caption-text">The employees who kept things running for RSOCKS, circa 2016.</p></div>
<p>Shortly after last week&#8217;s story on the RSOCKS founder, I heard from <strong>Riley Kilmer</strong>, co-founder of <a href="https://www.spur.us" target="_blank" rel="noopener">Spur.us</a>, a startup that tracks criminal proxy services. Kilmer said RSOCKS was similarly disabled after Google&#8217;s combined legal sneak attack and technical takedown targeting Glupteba.</p>
<p>&#8220;The RSOCKS website gave you the estimated number of proxies in each of their subscription packages, and that number went down to zero on Dec. 7,&#8221; Kilmer said. &#8220;It&#8217;s not clear if that means the services were operated by the same people, or if they were just using the same sources (i.e., PPI programs) to generate new installations of their malware.&#8221;</p>
<p>Kilmer said each time his company tried to determine how many systems RSOCKS had for sale, they found each Internet address being sold by RSOCKS was also present in AWM Proxy&#8217;s network. In addition, Kilmer said, the application programming interfaces (APIs) used by both services to keep track of infected systems were virtually identical, once again suggesting strong collaboration.</p>
<p>&#8220;One hundred percent of the IPs we got back from RSOCKS we&#8217;d already identified in AWM,&#8221; Kilmer said. &#8220;And the IP port combinations they give you when you access an individual IP were the same as from AWM.&#8221;</p>
<p>In 2011, KrebsOnSecurity published an investigation that <a href="https://krebsonsecurity.com/2011/09/whos-behind-the-tdss-botnet/" target="_blank" rel="noopener">identified one of the founders of AWM Proxy</a>, but Kilmer&#8217;s revelation prompted me to take a fresh look at the origins of this sprawling cybercriminal enterprise to determine if there were additional clues showing more concrete links between RSOCKS, AWM Proxy and Glupteba.</p>
<h2>IF YOUR PLAN IS TO RIP OFF GOOGLE&#8230;</h2>
<p>Supporting Kilmer&#8217;s theory that AWM Proxy and RSOCKS may simply be using the same PPI networks to spread, further research shows the RSOCKS owner also had an ownership stake in <a href="https://web.archive.org/web/20110123155232/http://ad1.ru/contacts/" target="_blank" rel="noopener"><strong>AD1[.]ru</strong></a>, an extremely popular Russian-language pay-per-install network that has been in operation for at least a decade.</p>
<p>Google took aim at Glupteba in part because its owners were using the botnet to divert and steal vast sums in online advertising revenue. So it&#8217;s more than a little ironic that the critical piece of evidence linking all of these operations begins with a Google Analytics code included in the HTML code for the original AWM Proxy back in 2008 (<strong>UA-3816536</strong>).</p>
<p>That analytics code also was present on a handful of other sites over the years, including the now-defunct Russian domain name registrar <strong>Domenadom[.]ru</strong>, and the website <strong>web-site[.]ru</strong>, which curiously was a Russian company operating a global real estate appraisal business called <a href="https://web.archive.org/web/20030203124357/http://www.web-site.ru/" target="_blank" rel="noopener">American Appraisal</a>.</p>
<p>Two other domains connected to that Google Analytics code &#8212; Russian plastics manufacturers <strong>techplast[.]ru</strong> and <strong>tekhplast.ru</strong> &#8212; also shared a different Google Analytics code (<strong>UA-1838317</strong>) with web-site[.]ru and with the domain &#8220;<strong>starovikov[.]ru</strong>.&#8221;</p>
<p>The name on the WHOIS registration records for the plastics domains is an &#8220;<strong>Alexander I. Ukraincki</strong>,&#8221; whose personal information also is included in the domains tpos[.]ru and alphadisplay[.]ru, both apparently manufacturers of point-of-sale payment terminals in Russia.</p>
<p><a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a security firm that indexes passwords and other personal information exposed in past data breaches, revealed dozens of variations on email addresses used by Alexander I. Ukraincki over the years. Most of those email addresses start with some variation of &#8220;<strong>uai@</strong>&#8221; followed by a domain from one of the many Russian email providers (e.g., yandex.ru, mail.ru). [Full disclosure: Constella is currently an advertiser on this website].</p>
<p>But Constella also shows those different email addresses all relied on a handful of passwords &#8212; most commonly &#8220;<strong>2222den</strong>&#8221; and &#8220;<strong>2222DEN</strong>.&#8221; Both of those passwords have been used almost exclusively in the past decade by the person who registered more than a dozen email addresses with the username &#8220;<strong>dennstr</strong>.&#8221;</p>
<p>The dennstr identity leads to several variations on the same name &#8212; Denis Strelinikov, or Denis Stranatka, from Ukraine, but those clues ultimately led nowhere promising. And maybe that was the point.</p>
<p>Things began looking brighter after I ran a search in <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools</a> for web-site[.]ru&#8217;s original WHOIS records, which shows it was assigned in 2005 to a &#8220;private person&#8221; who used the email address <strong>lycefer@gmail.com</strong>. A search in Constella on that email address says it was used to register nearly two dozen domains, including starovikov.ru and <strong>starovikov[.]com</strong>.</p>
<p>A <a href="https://web.archive.org/web/20080208120444/http://www.starovikov.com/" target="_blank" rel="noopener">cached copy of the contact page for Starovikov[.]com</a> shows that in 2008 it displayed the personal information for a <strong>Dmitry Starovikov</strong>, who listed his Skype username as &#8220;lycefer.&#8221;</p>
<p>Finally, Russian incorporation documents <a href="https://www.list-org.com/company/3994287" target="_blank" rel="noopener">show</a> the company LLC Website (web-site[.]ru)was registered in 2005 to two men, one of whom was named <strong>Dmitry Sergeevich Starovikov</strong>.</p>
<p>Bringing this full circle, Google says Starovikov is one of the two operators of the Glupteba botnet:</p>
<div id="attachment_60210" style="width: 751px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60210" loading="lazy" class=" wp-image-60210" src="media/a192f9ad.goog-glupteba-lawsuit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/goog-glupteba-lawsuit.png" alt="" width="741" height="522" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/goog-glupteba-lawsuit.png 606w, https://krebsonsecurity.com/wp-content/uploads/2022/06/goog-glupteba-lawsuit-100x70.png 100w" sizes="(max-width: 741px) 100vw, 741px" /><p id="caption-attachment-60210" class="wp-caption-text">The cover page for Google&#8217;s lawsuit against the alleged Glupteba botnet operators.</p></div>
<p>Mr. Starovikov did not respond to requests for comment. But attorneys for Starovikov and his co-defendant last month filed a response to Google&#8217;s complaint in the Southern District of New York, <a href="media/b1d42c66.starovikov-answer.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/starovikov-answer.pdf" target="_blank" rel="noopener">denying</a> (PDF) their clients had any knowledge of the scheme.</p>
<p>Despite all of the disruption caused by Google&#8217;s legal and technical meddling, AWM is still around and nearly as healthy as ever, although the service has been branded with a new name and there are dubious claims of new owners. Advertising customer plans ranging from $50 a day to nearly $700 for &#8220;VIP access,&#8221; AWM Proxy says its malware has been running on approximately 175,000 systems worldwide over the last 24 hours, and that roughly 65,000 of these systems are currently online.</p>
<div id="attachment_60222" style="width: 760px" class="wp-caption aligncenter"><a href="media/47a2cd96.awmproxy-today.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/awmproxy-today.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-60222" loading="lazy" class="wp-image-60222" src="media/47a2cd96.awmproxy-today.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/awmproxy-today.png" alt="" width="750" height="474" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/awmproxy-today.png 1217w, https://krebsonsecurity.com/wp-content/uploads/2022/06/awmproxy-today-768x485.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/awmproxy-today-782x494.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-60222" class="wp-caption-text">AWM Proxy, as it exists today.</p></div>
<p>Meanwhile, the administrators of RSOCKS recently alerted customers that the service and any unspent balances will soon be migrated over to a new location.</p>
<p>Many people seem to equate spending time, money and effort to investigate and prosecute cybercriminals with the largely failed war on drugs, meaning there is an endless supply of up-and-coming crooks who will always fill in any gaps in the workforce whenever cybercriminals face justice.</p>
<p>While that may be true for many low-level cyber thieves today, investigations like these show once again how small the cybercriminal underground really is. It also shows how it makes a great deal of sense to focus efforts on targeting and disrupting the relatively small number of established hackers who remain the real force multipliers of cybercrime.</p>


feed_id: https://krebsonsecurity.com/?p=60259
title: Experian, You Have Some Explaining to Do
uri: Experian-You-Have-Some-Explaining-to-Do
url: https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/
content:
<p>Twice in the past month KrebsOnSecurity has heard from readers who&#8217;ve had their accounts at big-three credit bureau <strong>Experian</strong> hacked and updated with a new email address that wasn&#8217;t theirs. In both cases the readers used password managers to select strong, unique passwords for their Experian accounts. Research suggests identity thieves were able to hijack the accounts simply by signing up for new accounts at Experian using the victim&#8217;s personal information and a different email address.</p>
<p><img class="aligncenter wp-image-31685" src="media/89b3723c.experian.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/experian.png" alt="" width="757" height="501" /></p>
<p><strong>John Turner </strong>is a software engineer based in Salt Lake City. Turner said he created the account at Experian in 2020 to place a security freeze on his credit file, and that he used a password manager to select and store a strong, unique password for his Experian account.</p>
<p>Turner said that in early June 2022 he received an email from Experian saying the email address on his account had been changed. Experian&#8217;s password reset process was useless at that point because any password reset links would be sent to the new (impostor&#8217;s) email address.</p>
<p>An Experian support person Turner reached via phone after a lengthy hold time asked for his Social Security Number (SSN) and date of birth, as well as his account PIN and answers to his secret questions. But the PIN and secret questions had already been changed by whoever re-signed up as him at Experian.</p>
<p>&#8220;I was able to answer the credit report questions successfully, which authenticated me to their system,&#8221; Turner said. &#8220;At that point, the representative read me the current stored security questions and PIN, and they were definitely not things I would have used.&#8221;</p>
<p>Turner said he was able to regain control over his Experian account by creating a new account. But now he&#8217;s wondering what else he could do to prevent another account compromise. That&#8217;s because Experian <em>does not offer any type of multi-factor authentication options on consumer accounts</em>.</p>
<p>&#8220;The most frustrating part of this whole thing is that I received multiple &#8216;here&#8217;s your login information&#8217; emails later that I attributed to the original attackers coming back and attempting to use the &#8216;forgot email/username&#8217; flow, likely using my SSN and DOB, but it didn&#8217;t go to their email that they were expecting,&#8221; Turner said. &#8220;Given that Experian doesn&#8217;t support two-factor authentication of any kind &#8212; and that I don&#8217;t know how they were able to get access to my account in the first place &#8212; I&#8217;ve felt very helpless ever since.&#8221;</p>
<p>To be clear, Experian <em>does</em> have a business unit that <a href="https://www.experian.com/business/solutions/identity-solutions/multi-factor-authentication-solutions" target="_blank" rel="noopener">sells one-time password services to businesses</a>. But it does not offer this directly to consumers who sign up to manage their credit file at Experian&#8217;s website.</p>
<p><strong>Arthur Rishi</strong> is a musician and co-executive director of the Boston Landmarks Orchestra. Rishi said he recently discovered his Experian account had been hijacked after receiving an alert from his credit monitoring service (not Experian&#8217;s) that someone had tried to open an account in his name at JPMorgan Chase.</p>
<p>Rishi said the alert surprised him because his credit file at Experian was frozen at the time, and Experian did not notify him about any activity on his account. Rishi said Chase agreed to cancel the unauthorized account application, and even rescinded its credit inquiry (each credit pull can ding your credit score slightly).</p>
<p>But he never could get anyone from Experian&#8217;s support to answer the phone, despite spending what seemed like eternity trying to progress through the company&#8217;s phone-based system. That&#8217;s when Rishi decided to see if he could create a new account for himself at Experian.</p>
<p>&#8220;I was able to open a new account at Experian starting from scratch, using my SSN, date of birth and answering some really basic questions, like what kind of car did you take out a loan for, or what city did you used to live in,&#8217; Rishi said.</p>
<p>Upon completing the sign-up, Rishi noticed that his credit was unfrozen.</p>
<p>Like Turner, Rishi is now worried that identity thieves will just hijack his Experian account once more, and that there is nothing he can do to prevent such a scenario. For now, Rishi has decided to pay Experian $25.99 a month to more closely monitor his account for suspicious activity. Even using the paid Experian service, there were no additional multi-factor authentication options available, although he said Experian did send a one-time code to his phone via SMS recently when he logged on.</p>
<p>&#8220;Experian now sometimes does require MFA for me now if I use a new browser or have my VPN on,&#8221; Rishi said, but he&#8217;s not sure if Experian&#8217;s free service would have operated differently.</p>
<p>&#8220;I get so angry when I think about all this,&#8221; he said. &#8220;I have no confidence this won&#8217;t happen again.&#8221;</p>
<p>In a written statement, Experian suggested that what happened to Rishi and Turner was not a normal occurrence, and that its security and identity verification practices extend beyond what is visible to the user.</p>
<p>&#8220;We believe these are isolated incidents of fraud using stolen consumer information,&#8221; Experian&#8217;s statement reads. &#8220;Specific to your question, once an Experian account is created, if someone attempts to create a second Experian account, our systems will notify the original email on file.&#8221;</p>
<p>&#8220;We go beyond reliance on personally identifiable information (PII) or a consumer’s ability to answer knowledge-based authentication questions to access our systems,&#8221; the statement continues. &#8220;We do not disclose additional processes for obvious security reasons; however, our data and analytical capabilities verify identity elements across multiple data sources and are not visible to the consumer. This is designed to create a more positive experience for our consumers and to provide additional layers of protection. We take consumer privacy and security seriously, and we continually review our security processes to guard against constant and evolving threats posed by fraudsters.&#8221;<span id="more-60259"></span></p>
<h2>ANALYSIS</h2>
<p>KrebsOnSecurity sought to replicate Turner and Rishi&#8217;s experience &#8212; to see if Experian would allow me to re-create my account using my personal information but a different email address. The experiment was done from a different computer and Internet address than the one that created the original account years ago.</p>
<p>After providing my Social Security Number (SSN), date of birth, and answering several multiple choice questions whose answers are derived almost entirely from public records, Experian promptly changed the email address associated with my credit file. It did so without first confirming that new email address could respond to messages, or that the previous email address approved the change.</p>
<p>Experian&#8217;s system then sent an automated message to the original email address on file, saying the account&#8217;s email address had been changed. The only recourse Experian offered in the alert was to sign in, or send an email to an Experian inbox that replies with the message, &#8220;this email address is no longer monitored.&#8221;</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-60291" src="media/a2f3d736.experianemail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/experianemail.png" alt="" width="1121" height="570" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/experianemail.png 1121w, https://krebsonsecurity.com/wp-content/uploads/2022/07/experianemail-768x391.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/experianemail-782x398.png 782w" sizes="(max-width: 1121px) 100vw, 1121px" /></p>
<p>After that, Experian prompted me to select new secret questions and answers, as well as a new account PIN &#8212; effectively erasing the account&#8217;s previously chosen PIN and recovery questions. Once I&#8217;d changed the PIN and security questions, Experian&#8217;s site helpfully reminded me that I have a security freeze on file, and would I like to remove or temporarily lift the security freeze?</p>
<p>How does Experian differ from the practices of <strong>Equifax</strong> and <strong>TransUnion</strong>, the other two big consumer credit reporting bureaus? When KrebsOnSecurity tried to re-create an existing account at TransUnion using my Social Security number, TransUnion rejected the application, noting that I already had an account and prompting me to proceed through its lost password flow. The company also appears to send an email to the address on file asking to validate account changes.</p>
<p>Likewise, trying to recreate an existing account at Equifax using personal information tied to my existing account prompts Equifax&#8217;s systems to report that I already have an account, and to use their password reset process (which involves sending a verification email to the address on file).</p>
<p>KrebsOnSecurity has long urged readers in the United States to place <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">a security freeze on their files with the three major credit bureaus</a>. With a freeze in place, potential creditors can&#8217;t pull your credit file, which makes it very unlikely anyone will be granted new lines of credit in your name. I&#8217;ve also advised readers to <a href="https://krebsonsecurity.com/2020/08/why-where-you-should-you-plant-your-flag/" target="_blank" rel="noopener">plant their flag at the three major bureaus</a>, to prevent identity thieves from creating an account for you and assuming control over your identity.</p>
<p>The experiences of Rishi, Turner and this author suggest Experian&#8217;s practices currently undermine both of those proactive security measures. Even so, <em>having an active account at Experian may be the only way you find out when crooks have assumed your identity</em>. Because at least then you should receive an email from Experian saying they gave your identity to someone else.</p>
<p>In April 2021, KrebsOnSecurity revealed how identity thieves were <a href="https://krebsonsecurity.com/2021/04/experians-credit-freeze-security-is-still-a-joke/" target="_blank" rel="noopener">exploiting lax authentication on Experian&#8217;s PIN retrieval page</a> to unfreeze consumer credit files. In those cases, Experian failed to send any notice via email when a freeze PIN was retrieved, nor did it require the PIN to be sent to an email address already associated with the consumer&#8217;s account.</p>
<p>A few days after that April 2021 story, KrebsOnSecurity broke the news that <a href="https://krebsonsecurity.com/2021/04/experian-api-exposed-credit-scores-of-most-americans/" target="_blank" rel="noopener">an Experian API was exposing the credit scores of most Americans</a>.</p>
<p><strong>Emory Roan</strong>, policy counsel for the <a href="https://www.privacyrights.org" target="_blank" rel="noopener">Privacy Rights Clearinghouse</a>, said Experian not offering multi-factor authentication for consumer accounts is inexcusable in 2022.</p>
<p>&#8220;They compound the problem by gating the recovery process with information that&#8217;s likely available or inferable from third party data brokers, or that could have been exposed in previous data breaches,&#8221; Roan said. &#8220;Experian is one of the largest Consumer Reporting Agencies in the country, trusted as one of the few essential players in a credit system Americans are forced to be part of. For them to not offer consumers some form of (free) MFA is baffling and reflects extremely poorly on Experian.&#8221;</p>
<p><strong>Nicholas Weaver</strong>, a researcher for the <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a> at <strong>University of California, Berkeley</strong>, said Experian has no real incentive to do things right on the consumer side of its business. That is, he said, unless Experian&#8217;s customers &#8212; banks and other lenders &#8212; choose to vote with their feet because too many people with frozen credit files are having to deal with unauthorized applications for new credit.</p>
<p>&#8220;The actual customers of the credit service don&#8217;t realize how much worse Experian is, and this isn&#8217;t the first time Experian has screwed up horribly,&#8221; Weaver said. &#8220;Experian is part of a triopoly, and I&#8217;m sure this is costing their actual customers money, because if you have a credit freeze that gets lifted and somebody loans against it, it&#8217;s the lender who eats that fraud cost.&#8221;</p>
<p>And unlike consumers, he said, lenders do have a choice in which of the triopoly handles their credit checks.</p>
<p>&#8220;I do think it&#8217;s important to point out that their real customers do have a choice, and they should switch to TransUnion and Equifax,&#8221; he added.</p>
<p>More greatest hits from Experian:</p>
<p>2017: <a href="https://krebsonsecurity.com/2017/09/experian-site-can-give-anyone-your-credit-freeze-pin/" target="_blank" rel="noopener">Experian Site Can Give Anyone Your Credit Freeze PIN</a><br />
2015: <a href="https://krebsonsecurity.com/2015/10/experian-breach-affects-15-million-consumers/" target="_blank" rel="noopener">Experian Breach Affects 15 Million Customers</a><br />
2015: <a href="https://krebsonsecurity.com/2014/05/experian-breach-tied-to-ny-nj-id-theft-ring/" target="_blank" rel="noopener">Experian Breach Tied to NY-NJ ID Theft Ring</a><br />
2015: <a href="https://krebsonsecurity.com/2015/10/at-experian-security-attrition-amid-acquisitions/" target="_blank" rel="noopener">At Experian, Security Attrition Amid Acquisitions</a><br />
2015: <a href="https://krebsonsecurity.com/2015/07/experian-hit-with-class-action-over-id-theft-service/" target="_blank" rel="noopener">Experian Hit With Class Action Over ID Theft Service</a><br />
2014: <a href="https://krebsonsecurity.com/2014/03/experian-lapse-allowed-id-theft-service-to-access-200-million-consumer-records/" target="_blank" rel="noopener">Experian Lapse Allowed ID Theft Service Access to 200 Million Consumer Records</a><br />
2013: <a href="https://krebsonsecurity.com/2013/10/experian-sold-consumer-data-to-id-theft-service/" target="_blank" rel="noopener">Experian Sold Consumer Data to ID Theft Service</a></p>


feed_id: https://krebsonsecurity.com/?p=60326
title: Microsoft Patch Tuesday, July 2022 Edition
uri: Microsoft-Patch-Tuesday-July-2022-Edition
url: https://krebsonsecurity.com/2022/07/microsoft-patch-tuesday-july-2022-edition/
content:
<p><strong>Microsoft</strong> today released updates to fix at least 86 security vulnerabilities in its <strong>Windows</strong> operating systems and other software, including a weakness in all supported versions of Windows that Microsoft warns is actively being exploited. The software giant also has made a controversial decision to put the brakes on a plan to block <strong>macros</strong> in <strong>Office</strong> documents downloaded from the Internet.</p>
<p><img class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="748" height="495" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 748px) 100vw, 748px" /></p>
<p>In February, security experts hailed Microsoft&#8217;s decision to block VBA macros in all documents downloaded from the Internet. The company said it would roll out the changes in stages between April and June 2022.</p>
<p>Macros have long been a trusted way for cybercrooks to trick people into running malicious code. Microsoft Office by default warns users that enabling macros in untrusted documents is a security risk, but those warnings can be easily disabled with the click of button. Under Microsoft&#8217;s plan, the new warnings provided no such way to enable the macros.</p>
<p>As <em>Ars Technica</em> veteran reporter <strong>Dan Goodin</strong> <a href="https://arstechnica.com/information-technology/2022/07/microsoft-makes-major-course-reversal-allows-office-to-run-untrusted-macros/" target="_blank" rel="noopener">put it</a>, &#8220;security professionals—some who have spent the past two decades watching clients and employees get infected with ransomware, wipers, and espionage with frustrating regularity—cheered the change.&#8221;</p>
<p>But last week, Microsoft abruptly changed course. As <a href="https://www.bleepingcomputer.com/news/microsoft/microsoft-rolls-back-decision-to-block-office-macros-by-default/" target="_blank" rel="noopener">first reported</a> by <em>BleepingComputer</em>, Redmond said it would roll back the changes based on feedback from users.</p>
<p>&#8220;While Microsoft has not shared the negative feedback that led to the rollback of this change, users have reported that they are unable to find the Unblock button to remove the Mark-of-the-Web from downloaded files, making it impossible to enable macros,&#8221; Bleeping&#8217;s <strong>Sergiu Gatlan</strong> wrote.</p>
<p>Microsoft later said the decision to roll back turning off macros by default was temporary, although it has not indicated when this important change might be made for good.</p>
<p>The zero-day Windows vulnerability already seeing active attacks is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22047" target="_blank" rel="noopener">CVE-2022-22047</a>, which is an elevation of privilege vulnerability in all supported versions of Windows. Trend Micro&#8217;s <strong>Zero Day Initiative</strong> notes that while this bug is listed as being under active attack, there’s no information from Microsoft on where or how widely it is being exploited.</p>
<p>&#8220;The vulnerability allows an attacker to execute code as SYSTEM, provided they can execute other code on the target,&#8221; ZDI&#8217;s Dustin Childs <a href="https://www.zerodayinitiative.com/blog/2022/7/12/the-july-2022-security-update-review" target="_blank" rel="noopener">wrote</a>. &#8220;Bugs of this type are typically paired with a code execution bug, usually a specially crafted Office or Adobe document, to take over a system. These attacks often rely on macros, which is why so many were disheartened to hear Microsoft’s delay in blocking all Office macros by default.&#8221;<span id="more-60326"></span></p>
<p><strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>, said CVE-2022-22047 is the kind of vulnerability is typically seen abused after a target has already been compromised.</p>
<p>&#8220;Crucially, it allows the attacker to escalate their permissions from that of a normal user to the same permissions as the SYSTEM,&#8221; he said. &#8220;With this level of access, the attackers are able to disable local services such as Endpoint Detection and Security tools. With SYSTEM access they can also deploy tools like Mimikatz which can be used to recover even more admin and domain level accounts, spreading the threat quickly.&#8221;</p>
<p>After a brief reprieve from patching serious security problems in the <strong>Windows Print Spooler</strong> service, we are back to business as usual. July&#8217;s patch batch contains fixes for four separate elevation of privilege vulnerabilities in Windows Print Spooler, identified as <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22022" target="_blank" rel="noopener">CVE-2022-22022</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22041" target="_blank" rel="noopener">CVE-2022-22041</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30206" target="_blank" rel="noopener">CVE-2022-30206</a>, and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30226" target="_blank" rel="noopener">CVE-2022-30226</a>. Experts at security firm <strong>Tenable</strong> note that these four flaws provide attackers with the ability to delete files or gain SYSTEM level privileges on a vulnerable system.</p>
<p>Roughly a third of the patches issued today involve weaknesses in Microsoft&#8217;s Azure Site Recovery offering. Other components seeing updates this month include <strong>Microsoft Defender for Endpoint</strong>; <strong>Microsoft Edge</strong> (Chromium-based); <strong>Office</strong>; <strong>Windows BitLocker</strong>; <strong>Windows Hyper-V</strong>; <strong>Skype for Business</strong> and <strong>Microsoft Lync</strong>; and <strong>Xbox</strong>.</p>
<p>Four of the flaws fixed this month address vulnerabilities Microsoft rates &#8220;critical,&#8221; meaning they could be used by malware or malcontents to assume remote control over unpatched Windows systems, usually without any help from users. <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22029" target="_blank" rel="noopener">CVE-2022-22029</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22039" target="_blank" rel="noopener">CVE-2022-22039</a> affect Network File System (NFS) servers, and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-22038" target="_blank" rel="noopener">CVE-2022-22038</a> affects the Remote Procedure Call (RPC) runtime.</p>
<p>&#8220;Although all three of these will be relatively tricky for attackers to exploit due to the amount of sustained data that needs to be transmitted, administrators should patch sooner rather than later,&#8221; said <strong>Greg Wiseman</strong>, product manager at <strong>Rapid7</strong>. &#8220;<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30221" target="_blank" rel="noopener">CVE-2022-30221</a> supposedly affects the Windows Graphics Component, though Microsoft’s FAQ indicates that exploitation requires users to access a malicious RDP server.&#8221;</p>
<p>Separately, Adobe today <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">issued patches</a> to address at least 27 vulnerabilities across multiple products, including <strong>Acrobat</strong> and <strong>Reader</strong>, <strong>Photoshop</strong>, <strong>RoboHelp</strong>, and <strong>Adobe Character Animator</strong>.</p>
<p>For a closer look at the patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft%20July%202022%20Patch%20Tuesday/28838/" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=60347
title: Why 8kun Went Offline During the January 6 Hearings
uri: Why-8kun-Went-Offline-During-the-January-6-Hearings
url: https://krebsonsecurity.com/2022/07/why-8kun-went-offline-during-the-january-6-hearings/
content:
<p>The latest Jan. 6 committee hearing on Tuesday examined the role of conspiracy theory communities like <strong>8kun[.]top</strong> and <strong>TheDonald[.]win </strong>in helping to organize and galvanize supporters who responded to former President Trump&#8217;s invitation to &#8220;be wild&#8221; in Washington, D.C. on that chaotic day. At the same time the committee was hearing video testimony from 8kun founder <strong>Jim Watkins</strong>, 8kun and a slew of similar websites were suddenly yanked offline. Watkins suggested the outage was somehow related to the work of the committee, but the truth is KrebsOnSecurity was responsible and the timing was pure coincidence.</p>
<p><img class="aligncenter wp-image-60355" src="media/23058e0b.j6wide.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/j6wide.png" alt="" width="750" height="422" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/j6wide.png 1412w, https://krebsonsecurity.com/wp-content/uploads/2022/07/j6wide-768x432.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/j6wide-782x440.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>In a follow-up <a href="https://twitter.com/2022_Karma/status/1547215376458469376" target="_blank" rel="noopener">video address to his followers</a>, Watkins said the outage happened shortly after the Jan. 6 committee aired his brief video testimony.</p>
<p>&#8220;Then everything that I have anything to do with seemed to crash, so that there was no way for me to go out and talk to anybody,&#8221; Watkins said. &#8220;The whole network seemed to go offline at the same time, and that affected a lot of people.&#8221;</p>
<p>8kun and many other sites that continue to push the false narrative that the 2020 election was stolen from the 45th president <a href="https://www.bloomberg.com/news/features/2021-04-14/qanon-daily-stormer-far-right-have-been-kept-online-by-nick-lim-s-vanwatech" target="_blank" rel="noopener">have long been connected to the Internet via <strong>VanwaTech</strong></a>, a hosting firm based in Vancouver, Wash. In late October 2020, a phone call to VanwaTech&#8217;s sole provider of connectivity to the Internet resulted in <a href="https://krebsonsecurity.com/2020/10/qanon-8chan-sites-briefly-knocked-offline/" target="_blank" rel="noopener">a similar outage for 8kun</a>.</p>
<div id="attachment_60353" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60353" loading="lazy" class=" wp-image-60353" src="media/cb293e63.watkinsetal.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/watkinsetal.png" alt="" width="750" height="391" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/watkinsetal.png 1062w, https://krebsonsecurity.com/wp-content/uploads/2022/07/watkinsetal-768x401.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/watkinsetal-782x408.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/07/watkinsetal-267x140.png 267w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60353" class="wp-caption-text">Jim Waktins (top right), in a video address to his followers on Tuesday after 8kun was taken offline.</p></div>
<p>Following that 2020 outage, 8kun and a large number of <a href="https://en.wikipedia.org/wiki/QAnon" target="_blank" rel="noopener">QAnon</a> conspiracy sites found refuge a Russian hosting provider. But when the anonymous &#8220;Q&#8221; leader of QAnon <a href="https://www.bloomberg.com/news/newsletters/2022-07-06/qanon-return-comes-as-web-conspiracies-thrive" target="_blank" rel="noopener">suddenly began posting on 8kun again earlier this month</a>, KrebsOnSecurity received a tip that 8kun&#8217;s ISP was once again connected to the larger Internet via a single upstream provider based in the United States.</p>
<p>On Sunday, July 10, KrebsOnSecurity contacted <strong>Psychz Networks</strong>, a hosting provider in Los Angeles, to see if they were aware that they were the sole Internet lifeline for 8kun et. al.  Psychz confirmed that in response to a report from KrebsOnSecurity, VanwaTech was removed from its network around the time of the Jan. 6 hearing on Tuesday.</p>
<p>8kun and its archipelago of conspiracy theory communities have once again drifted back into the arms of a Russian hosting provider (<a href="https://bgp.he.net/AS207651#_graph4" target="_blank" rel="noopener">AS207651</a>), which is connected to the larger Internet via two providers. Those include <a href="https://bgp.he.net/AS31500#_asinfo" target="_blank" rel="noopener">AS31500</a> &#8212; which appears to be owned by Russians but is making a fair pretense at being located in the Caribbean; and <a href="https://bgp.he.net/AS28917#_asinfo" target="_blank" rel="noopener">AS28917</a>, in Vilnius, Lithuania.</p>
<p>8kun&#8217;s newfound Russian connections will likely hold, but that hardly means Lithuania should stand idly by. Late last month, pro-Russian hackers claimed responsibility for an extensive distributed denial-of-service (DDoS) attack against Lithuanian state and private websites, which <a href="https://www.reuters.com/technology/lithuania-hit-by-cyber-attack-government-agency-2022-06-27/" target="_blank" rel="noopener">reportedly</a> was in response to Vilnius&#8217;s decision to cease the transit of some goods under European Union sanctions to Russia&#8217;s Kaliningrad exclave.</p>
<p>The Jan. 6 hearing referenced in this story is available <a href="https://www.c-span.org/video/?521495-1/seventh-hearing-investigation-capitol-attack" target="_blank" rel="noopener">via CSPAN</a>.</p>


feed_id: https://krebsonsecurity.com/?p=60343
title: A Deep Dive Into the Residential Proxy Service ‘911’
uri: A-Deep-Dive-Into-the-Residential-Proxy-Service-911
url: https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/
content:
<div id="attachment_60396" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60396" class=" wp-image-60396" src="media/c4a58664.s5now.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now.png" alt="" width="751" height="423" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now.png 1230w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now-768x433.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now-782x441.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-60396" class="wp-caption-text">The 911 service as it exists today.</p></div>
<p>For the past seven years, an online service known as <strong>911</strong> has sold access to hundreds of thousands of <strong>Microsoft Windows</strong> computers daily, allowing customers to route their Internet traffic through PCs in virtually any country or city around the globe &#8212; but predominantly in the United States. 911 says its network is made up entirely of users who voluntarily install its &#8220;free VPN&#8221; software. But new research shows the proxy service has a long history of purchasing installations via shady &#8220;pay-per-install&#8221; affiliate marketing schemes, some of which 911 operated on its own.</p>
<p>911[.]re is one of the original &#8220;<a href="https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-networks/" target="_blank" rel="noopener">residential proxy</a>&#8221; networks, which allow someone to rent a residential IP address to use as a relay for his/her Internet communications, providing anonymity and the advantage of being perceived as a residential user surfing the web.</p>
<p>From a website&#8217;s perspective, the IP traffic of a residential proxy network user appears to originate from the rented residential IP address, not from the proxy service customer. These services can be used in a legitimate manner for several business purposes &#8212; such as price comparisons or sales intelligence &#8212; but they are massively abused for hiding cybercrime activity because they can make it difficult to trace malicious traffic to its original source.</p>
<p>Residential proxy services are often marketed to people seeking the ability to evade country-specific blocking by the major movie and media streaming providers. But some of them &#8212; like 911 &#8212; build their networks in part by offering &#8220;free VPN&#8221; or &#8220;free proxy&#8221; services that are powered by software which turns the user&#8217;s PC into a traffic relay for other users. In this scenario, users indeed get to use a free VPN service, but they are often unaware that doing so will turn their computer into a proxy that lets others use their Internet address to transact online.</p>
<div id="attachment_60398" style="width: 762px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60398" loading="lazy" class=" wp-image-60398" src="media/2dc9c71d.s5prices.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices.png" alt="" width="752" height="431" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices.png 1230w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices-768x440.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5prices-782x448.png 782w" sizes="(max-width: 752px) 100vw, 752px" /><p id="caption-attachment-60398" class="wp-caption-text">The current prices for 911&#8217;s proxies.</p></div>
<p>Researchers at the <strong>University of Sherbrooke</strong> in Canada recently <a href="https://gric.recherche.usherbrooke.ca/rpaas/" target="_blank" rel="noopener">published an analysis of 911</a>, and found there were roughly 120,000 PCs for rent via the service, with the largest number of them located in the United States.</p>
<p>&#8220;The 911[.]re network uses at least two free VPN services to lure its users to install a malware-like software that achieves persistence on the user’s computer,&#8221; the researchers wrote. &#8220;During the research we identified two free VPN services that [use] a subterfuge to lure users to install software that looks legitimate but makes them part of the network. These two software are currently unknown to most if not all antivirus companies.&#8221;</p>
<div id="attachment_60393" style="width: 761px" class="wp-caption aligncenter"><a href="media/111abe37.s5map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5map.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-60393" loading="lazy" class="wp-image-60393" src="media/111abe37.s5map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5map.png" alt="" width="751" height="342" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5map.png 1524w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5map-768x349.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5map-782x356.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-60393" class="wp-caption-text">A depiction of the Proxygate service. Image: University of Sherbrooke.</p></div>
<p>The researchers concluded that 911 is supported by a &#8220;mid scale botnet-like infrastructure that operates in several networks, such as corporate, government and critical infrastructure.&#8221; The Canadian team said they found many of the 911 nodes available for rent were situated within several major US-based universities and colleges, critical infrastructures such as clean water, defense contractors, law enforcement and government networks.</p>
<p>Highlighting the risk that 911 nodes could pose to internal corporate networks, they observed that &#8220;the infection of a node enables the 911.re user to access shared resources on the network such as local intranet portals or other services.&#8221;</p>
<p>&#8220;It also enables the end user to probe the LAN network of the infected node,&#8221; the paper continues. &#8220;Using the internal router, it would be possible to poison the DNS cache of the LAN router of the infected node, enabling further attacks.&#8221;</p>
<p>911 did not respond to multiple requests for comment on this research. A person who responded to an instant message sent to the address listed on its homepage said they could only discuss technical issues with the software.</p>
<p><div id="attachment_60422" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60422" loading="lazy" class=" wp-image-60422" src="media/02f1ea67.911original.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/911original.png" alt="" width="751" height="557" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/911original.png 919w, https://krebsonsecurity.com/wp-content/uploads/2022/07/911original-768x570.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/911original-782x580.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-60422" class="wp-caption-text">The 911 user interface, as it existed when the service first launched in 2016.</p></div><span id="more-60343"></span></p>
<h2>THE INTERNET NEVER FORGETS</h2>
<p>A review of the clues left behind by 911&#8217;s early days on the Internet paint a more complete picture of this long-running proxy network. The domain names used by 911 over the years have a few common elements in their original WHOIS registration records, including the address <strong>ustraffic@qq.com </strong>and a <strong>Yunhe Wang</strong> from Beijing.</p>
<p>That ustraffic email is tied to a small number of interesting domains, including <strong>browsingguard[.]com</strong>, <strong>cleantraffic[.]net</strong>, <strong>execlean[.]net</strong>, <strong>proxygate[.]net</strong>, and <strong>flashupdate[.]net</strong>.</p>
<p>A <a href="https://web.archive.org/web/20160112184652/http://flashupdate.net/" target="_blank" rel="noopener">cached copy of flashupdate[.]net available at the Wayback Machine</a> shows that in 2016 this domain was used for the &#8220;<strong>ExE Bucks</strong>&#8221; affiliate program, a pay-per-install business which catered to people already running large collections of hacked computers or compromised websites. Affiliates were paid a set amount for each installation of the software, with higher commissions for installs in more desirable nations, particularly Europe, Canada and the United States.</p>
<p>&#8220;We load only one software &#8212; it&#8217;s a Socks5 proxy program,&#8221; read the message to ExE Bucks affiliates. The website said affiliates were free to spread the proxy software by any means available (i.e. &#8220;all promotion methods allowed&#8221;). The website&#8217;s copyright suggests the ExE Bucks affiliate program dates back to 2012.</p>
<div id="attachment_60380" style="width: 760px" class="wp-caption aligncenter"><a href="media/7240a3b1.exebucks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-60380" loading="lazy" class="wp-image-60380" src="media/7240a3b1.exebucks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks.png" alt="" width="750" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks.png 917w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-768x539.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-782x549.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-60380" class="wp-caption-text">A cached copy of flashupdate[.]net circa 2016, which shows it was the home of a pay-per-install affiliate program that incentivized the silent installation of its software. &#8220;FUD&#8221; in the ad above refers to software and download links that are &#8220;Fully UnDetectable&#8221; as suspicious or malicious by all antivirus software.</p></div>
<p>Another domain tied to the ustraffic@qq.com email in 2016 was <strong>ExeClean[.]net</strong>, a service that advertised to cybercriminals seeking to obfuscate their malicious software so that it goes undetected by all or at least most of the major antivirus products on the market.</p>
<p>&#8220;Our technology ensures the maximum security from reverse engineering and antivirus detections,&#8221; ExEClean promised.</p>
<div id="attachment_60418" style="width: 760px" class="wp-caption aligncenter"><a href="media/bcad5df4.execlean-2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/execlean-2.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-60418" loading="lazy" class="wp-image-60418" src="media/bcad5df4.execlean-2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/execlean-2.png" alt="" width="750" height="502" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/execlean-2.png 994w, https://krebsonsecurity.com/wp-content/uploads/2022/07/execlean-2-768x514.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/execlean-2-782x523.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-60418" class="wp-caption-text">The Exe Clean service made malware look like goodware to antivirus products.</p></div>
<p>Yet another domain connected to the ustraffic email is <strong>p2pshare[.]net</strong>, which advertised &#8220;free unlimited internet file-sharing platform&#8221; for those who agreed to install their software.</p>
<div id="attachment_60385" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60385" loading="lazy" class=" wp-image-60385" src="media/2b1a91c3.p2pshare.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/p2pshare.png" alt="" width="751" height="457" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/p2pshare.png 1183w, https://krebsonsecurity.com/wp-content/uploads/2022/07/p2pshare-768x467.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/p2pshare-782x476.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-60385" class="wp-caption-text">p2pshare.net, which bundled 911 proxy with an application that promised access to free unlimited internet file-sharing.</p></div>
<p>Still more domains associated with ustraffic@qq.com suggest 911&#8217;s proxy has been disguised as security updates for video player plugins, including flashplayerupdate[.]xyz, mediaplayerupdate[.]xyz, and videoplayerupdate[.]xyz.</p>
<p>The <a href="https://web.archive.org/web/20160408171859/http://911.re/" target="_blank" rel="noopener">earliest version of the 911 website available from the Wayback Machine is from 2016</a>. A sister service called <a href="https://www.hybrid-analysis.com/sample/7fdc35f59fde0095d4352256707e795b4b8b07fafe3f546dca5236cf750746d4?environmentId=1&amp;lang=id" target="_blank" rel="noopener"><strong>proxygate[.]ne</strong>t</a> launched roughly a year prior to 911 as a &#8220;free&#8221; public test of the budding new residential proxy service. &#8220;Basically using clients to route for everyone,&#8221; was how Proxygate described itself in 2016.</p>
<p>For more than a year after its founding, the 911 website was written entirely in Simplified Chinese. The service has only ever accepted payment via virtual currencies such as <strong>Bitcoin</strong> and <strong>Monero</strong>, as well as <strong>Alipay</strong> and <strong>China UnionPay</strong>, both payment platforms based in China.</p>
<p>Initially, the terms and conditions of 911&#8217;s &#8220;End User License Agreement (EULA) named a company called <strong>Wugaa Enterprises LLC</strong>, which was registered in California in 2016. Records from the California Secretary of State office show that in November 2016, Wugaa Enterprises said it was in the Internet advertising business, and had named as its CEO as one <strong>Nicolae Aurelian Mazgarean</strong> of Brasov, Romania.</p>
<p>A search of European VAT numbers shows the same Brasov, RO address tied to an enterprise called <strong>PPC Leads SRL</strong> (in the context of affiliate-based marketing, &#8220;PPC&#8221; generally refers to the term &#8220;pay-per-click&#8221;).</p>
<p>911&#8217;s EULA would later change its company name and address in 2017, to <strong>International Media Ltd</strong>. in the British Virgin Islands. That is the same information currently displayed on the 911 website.</p>
<p>The EULA attached to 911 software downloaded from <strong>browsingguard[.]com</strong> (tied to the same ustraffic@qq email that registered 911) references a company called <strong>Gold Click Limited</strong>. According to the UK Companies House, Gold Click Limited was registered in 2016 to a 34-year-old <strong>Yunhe Wang</strong> from Beijing City. Many of the WHOIS records for the above mentioned domains also include the name Yunhe Wang, or some variation thereof.</p>
<h2>FORUM ACTIVITY?</h2>
<p>911 has remained one of the most popular services among denizens of the cybercrime underground for years, becoming almost shorthand for connecting to that &#8220;last mile&#8221; of cybercrime. Namely, the ability to route one&#8217;s malicious traffic through a computer that is geographically close to the consumer whose credit card they&#8217;re about to charge at some website, or whose bank account they&#8217;re about to empty.</p>
<p>Given the frequency with which 911 has been praised by cybercrooks on the top forums, it was odd to find the proprietors of 911 do not appear to have created any official support account for the service on any of several dozen forums reviewed by this author going back a decade. However there are two cybercriminal identities on the forums that have responded to individual 911 help requests, and who promoted the sale of 911 accounts via their handles.</p>
<p>Both of these identities were active on the crime forum <strong>fl.l33t[.]su</strong> between 2016 and 2019. The user &#8220;<strong>Transfer</strong>&#8221; advertised and sold access to 911 from 2016 to 2018, amid many sales threads where they advertised expensive electronics and other consumer goods that were bought online with stolen credit cards.</p>
<p>In a 2017 discussion on <strong>fl.l33t[.]su</strong>, the user who picked the handle &#8220;<strong>527865713</strong>&#8221; could be seen answering private messages in response to help inquiries seeking someone at 911. That identity is tied to an individual who for years advertised the ability to receive and relay large wire transfers from China.</p>
<p>One ad from this user in 2016 offered a &#8220;China wire service&#8221; focusing on Western Union payments, where &#8220;all transfers are accepted in China.&#8221; The service charged 20 percent of all &#8220;scam wires,&#8221; unauthorized wire transfers resulting from bank account takeovers or scams like <a href="https://krebsonsecurity.com/2015/08/fbi-1-2b-lost-to-business-email-scams/" rel="noopener" target="_blank">CEO impersonation schemes</a>. </p>
<h2>911 TODAY</h2>
<p>In August 2021, 911&#8217;s biggest competitor &#8212; a 15-year-old proxy network built on malware-compromised PCs called <strong>VIP72</strong> &#8212; <a href="https://krebsonsecurity.com/2021/09/15-year-old-malware-proxy-network-vip72-goes-dark/" target="_blank" rel="noopener">abruptly closed up shop</a>. Almost overnight, an overwhelming number of former VIP72 customers began shifting their proxy activities to 911.</p>
<div id="attachment_56769" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56769" loading="lazy" class=" wp-image-56769" src="media/56630187.vip72login.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/09/vip72login.png" alt="" width="750" height="557" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/09/vip72login.png 865w, https://krebsonsecurity.com/wp-content/uploads/2021/09/vip72login-768x570.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/09/vip72login-782x580.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-56769" class="wp-caption-text">The login page for VIP72, until recently 911&#8217;s largest competitor.</p></div>
<p>That&#8217;s according to <strong>Riley Kilmer</strong>, co-founder of <a href="https://www.spur.us" target="_blank" rel="noopener">Spur.us</a> &#8212; a security company that monitors anonymity services. Kilmer said 911 also gained an influx of new customers after the Jan. 2022 <a href="https://www.elliptic.co/blog/russia-seizes-four-major-dark-web-carding-sites-with-263-million-in-crypto-sales" rel="noopener" target="_blank">closure of LuxSocks</a>, another malware-based proxy network. </p>
<p>&#8220;911&#8217;s user base skyrocketed after VIP72 and then LuxSocks went away,&#8221; Kilmer said. &#8220;And it&#8217;s not hard to see why. 911 and VIP72 are both Windows-based apps that operate in a similar way, where you buy private access to IPs.&#8221;</p>
<p>Kilmer said 911 is interesting because it appears to be based in China, while nearly all of the other major proxy networks are Russian-backed or Russian-based.</p>
<p>&#8220;They have two basic methods to get new IPs,&#8221; Kilmer said. &#8220;The free VPN apps, and the other is trojanized torrents. They&#8217;ll re-upload Photoshop and stuff like that so that it&#8217;s backdoored with the 911 proxy. They claim the proxy is bundled with legitimate software and that users all agree to their Terms of Service, meanwhile they can hide behind the claim that it was some affiliate who installed the software, not them.&#8221;</p>
<p>Kilmer said at last count, 911 had nearly 200,000 proxy nodes for sale, spanning more than 200 countries: The largest geographic concentration is the United States, where more than 42,000 proxies are currently for rent by the service.</p>
<h2>PARTING THOUGHTS</h2>
<p>Beware of &#8220;free&#8221; or super low-cost VPN services. Proper VPN services are not cheap to operate, so the revenue for the service has to come from somewhere. And there are countless &#8220;free&#8221; VPN services that are anything but, as we&#8217;ve seen with 911.</p>
<p>In general, the rule of thumb for transacting online is that if you&#8217;re not the paying customer, then you and/or your devices are probably the product that&#8217;s being sold to others. Many free VPN services will enlist users as VPN nodes for others to use, and some even offset costs by collecting and reselling data from their users.</p>
<p>All VPN providers claim to prioritize the privacy of their users, but many then go on to collect and store all manner of personal and financial data from those customers. Others are fairly opaque about their data collection and retention policies.</p>
<p>I&#8217;ve <a href="https://krebsonsecurity.com/2017/03/post-fcc-privacy-rules-should-you-vpn/" rel="noopener" target="_blank">largely avoided</a> wading into the fray about which VPN services are best, but there are so many shady and just plain bad ones out there that I&#8217;d be remiss if I didn&#8217;t mention one VPN provider whose business practices and transparency of operation consistently distinguish them from the rest. If maintaining your privacy and anonymity are primary concerns for you as a VPN user, check out Mullvad.net.</p>
<p>Let me make clear that KrebsOnSecurity does not have any financial or business ties to this company (for the avoidance of doubt, this post doesn&#8217;t even link to them). I mention it only because I&#8217;ve long been impressed with their candor and openness, and because Mullvad goes out of its way to discourage customers from sharing personal or financial data.</p>
<p>To that end, Mullvad will even accept mailed payments of cash to fund accounts, quite a rarity these days. More importantly, the service doesn&#8217;t ask users to share phone numbers, email addresses or any other personal information. Nor does it require customers to create passwords: Each subscription can be activated just by entering a Mullvad account number (woe to those who lose their account number). </p>
<p>I wish more companies would observe this remarkably economical security practice, which boils down to the mantra, &#8220;You don&#8217;t have to protect what you don&#8217;t collect.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=60119
title: Massive Losses Define Epidemic of ‘Pig Butchering’
uri: Massive-Losses-Define-Epidemic-of-Pig-Butchering
url: https://krebsonsecurity.com/2022/07/massive-losses-define-epidemic-of-pig-butchering/
content:
<p>U.S. state and federal investigators are being inundated with reports from people who&#8217;ve lost hundreds of thousands or millions of dollars in connection with a complex investment scam known as &#8220;<strong>pig butchering</strong>,&#8221; wherein people are lured by flirtatious strangers online into investing in cryptocurrency trading platforms that eventually seize any funds when victims try to cash out.</p>
<p><img class="aligncenter  wp-image-59331" src="media/f28497bb.cryptopeople.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/cryptopeople.png" alt="" width="750" height="490" /></p>
<p>The term &#8220;pig butchering&#8221; refers to a time-tested, heavily scripted, and human-intensive process of using fake profiles on dating apps and social media to lure people into investing in elaborate scams. In a more visceral sense, pig butchering means fattening up a prey before the slaughter.</p>
<p>&#8220;The fraud is named for the way scammers feed their victims with promises of romance and riches before cutting them off and taking all their money,&#8221; the <strong>Federal Bureau of Investigation</strong> (FBI) warned in April 2022. &#8220;It’s run by a fraud ring of cryptocurrency scammers who mine dating apps and other social media for victims and the scam is becoming alarmingly popular.&#8221;</p>
<p>As documented in a <a href="https://asia.nikkei.com/Spotlight/The-Big-Story/Cyber-slavery-inside-Cambodia-s-online-scam-gangs" target="_blank" rel="noopener">series</a> of <a href="https://archive.ph/bM6oX#selection-1169.35-1169.48" target="_blank" rel="noopener">investigative reports</a> <a href="https://www.smh.com.au/world/asia/the-next-macau-china-s-big-gamble-in-cambodia-20180615-p4zlqg.html" target="_blank" rel="noopener">published over the past year</a> <a href="https://vodenglish.news/victims-allege-sihanoukville-precincts-with-ties-to-major-businesses-are-sites-of-scams-torture-detention/" target="_blank" rel="noopener">across Asia</a>, the people creating these phony profiles are largely men and women from China and neighboring countries who have been kidnapped and trafficked to places like Cambodia, where they are forced to scam complete strangers over the Internet &#8212; day after day.</p>
<p>The most prevalent pig butchering scam today involves sophisticated cryptocurrency investment platforms, where investors invariably see fantastic returns on their deposits &#8212; until they try to withdraw the funds. At that point, investors are told they owe huge tax bills. But even those who pay the phony levies never see their money again.</p>
<p>The come-ons for these scams are prevalent on dating sites and apps, but they also frequently start with what appears to be a wayward SMS &#8212; such as an instant message about an Uber ride that never showed. Or a reminder from a complete stranger about a planned meetup for coffee. In many ways, the content of the message is irrelevant; the initial goal to simply to get the recipient curious enough to respond in some way.</p>
<p>Those who respond are asked to continue the conversation via <strong>WhatsApp</strong>, where an attractive, friendly profile of the opposite gender will work through a pre-set script that is tailored to their prey&#8217;s apparent socioeconomic situation. For example, a divorced, professional female who responds to these scams will be handled with one profile type and script, while other scripts are available to groom a widower, a young professional, or a single mom.</p>
<h2>&#8216;LIKE NOTHING I&#8217;VE SEEN BEFORE&#8217;</h2>
<p>That&#8217;s according to <strong>Erin West</strong>, deputy district attorney for Santa Clara County in Northern California. West said her office has been fielding a large number of pig butchering inquiries from her state, but also from law enforcement entities around the country that are ill-equipped to investigate such fraud.</p>
<p>&#8220;The people forced to perpetrate these scams have a guide and a script, where if your victim is divorced say this, or a single mom say this,&#8221; West said. &#8220;The scale of this is so massive. It&#8217;s a major problem with no easy answers, but also with victim volumes I&#8217;ve never seen before. With victims who are really losing their minds and in some cases are suicidal.&#8221;</p>
<p>West is a key member of REACT, a task force set up to tackle <a href="https://krebsonsecurity.com/?s=sim-swapping" target="_blank" rel="noopener">especially complex forms of cyber theft involving virtual currencies</a>. West said the initial complaints from pig butchering victims came early this year.</p>
<p>&#8220;I first thought they were one-off cases, and then I realized we were getting these daily,&#8221; West said. &#8220;A lot of them are being reported to local agencies that don&#8217;t know what to do with them, so the cases languish.&#8221;</p>
<p>West said pig butchering victims are often quite sophisticated and educated people.</p>
<p>&#8220;One woman was a university professor who lost her husband to COVID, got lonely and was chatting online, and eventually ended up giving away her retirement,&#8221; West recalled of a recent case. &#8220;There are just horrifying stories that run the gamut in terms of victims, from young women early in their careers, to senior citizens and even to people working in the financial services industry.&#8221;</p>
<p>In some cases reported to REACT, the victims said they spent days or weeks corresponding with the phony WhatsApp persona before the conversation shifted to investing.</p>
<p>&#8220;They&#8217;ll say &#8216;Hey, this is the food I&#8217;m eating tonight&#8217; and the picture they share will show a pretty setting with a glass of wine, where they&#8217;re showcasing an enviable lifestyle but not really mentioning anything about how they achieved that,&#8221; West said. &#8220;And then later, maybe a few hours or days into the conversation, they&#8217;ll say, &#8216;You know I made some money recently investing in crypto,&#8217; kind of sliding into the topic as if this wasn&#8217;t what they were doing the whole time.&#8221;</p>
<p>Curious investors are directed toward elaborate and official-looking online crypto platforms that appear to have thousands of active investors. Many of these platforms include extensive study materials and tutorials on cryptocurrency investing. New users are strongly encouraged to team up with more seasoned investors on the platform, and to make only small investments that they can afford to lose.</p>
<div id="attachment_60514" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60514" loading="lazy" class=" wp-image-60514" src="media/4ee51fb4.xtbhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/xtbhome.png" alt="" width="751" height="428" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/xtbhome.png 1334w, https://krebsonsecurity.com/wp-content/uploads/2022/07/xtbhome-768x438.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/xtbhome-782x446.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-60514" class="wp-caption-text">The now-defunct homepage of xtb-market[.]com, a scam cryptocurrency platform tied to a pig butchering scheme.</p></div>
<p>&#8220;They&#8217;re able to see some value increase, and maybe even be allowed to take out that value increase so that they feel comfortable about the situation,&#8221; West said. Some investors then need little encouragement to deposit additional funds, which usually generate increasingly higher &#8220;returns.&#8221;</p>
<p>West said many crypto trading platforms associated with pig butchering scams appear to have been designed much like a video game, where investor hype is built around upcoming &#8220;trading opportunities&#8221; that hint at even more fantastic earnings.</p>
<p>&#8220;There are bonus levels and VIP levels, and they&#8217;ll build hype and a sense of frenzy into the trading,&#8221; West said. &#8220;There are definitely some psychological mechanisms at work to encourage people to invest more.&#8221;</p>
<p>&#8220;What&#8217;s so devastating about many of the victims is they lose that sense of who they are,&#8221; she continued. &#8220;They thought they were a savvy, sophisticated person, someone who&#8217;s sort of immune to scams. I think the large scale of the trickery and psychological manipulation being used here can&#8217;t be understated. It&#8217;s like nothing I&#8217;ve seen before.&#8221;</p>
<h2>A $5,000,000 LOSS</h2>
<p><strong>Courtney Nolan</strong>, a divorced mother of three daughters, says she lost more than $5 million to a pig butchering scam. Nolan lives in St. Louis and has a background in investment finance, but only started investing in cryptocurrencies in the past year.</p>
<p>Nolan&#8217;s case may be especially bad because she was already interested in crypto investing when the scammer reached out. At the time, Bitcoin was trading at or near all-time highs of nearly $68,000 per coin.</p>
<p>Nolan said her nightmare began in late 2021 with a Twitter direct message from someone who was following many of the same cryptocurrency influencers she followed. Her fellow crypto enthusiast then suggested they continue their discussion on WhatsApp. After much back and forth about his trading strategies, her new friend agreed to mentor her on how to make reliable profits using the crypto trading platform <strong>xtb.com</strong>.</p>
<p>&#8220;I had dabbled in leveraged trading before, but his mentor program gave me over 100 pages of study materials and agreed to walk me through their investment strategies over the course of a year,&#8221; Nolan told KrebsOnSecurity.</p>
<p>Nolan&#8217;s mentor had her create an account website <strong>xtb-market[.]com</strong>, which was made to be confusingly similar to XTB&#8217;s official platform. The site promoted several different investment packages, including a &#8220;starter plan&#8221; that involves a $5,250 up-front investment and promises more than 15 percent return across four separate trading bursts. </p>
<p>Platinum plans on xtb-market promised a whopping 45 percent ROI, with a minimum investment of $265,000. The site also offered a generous seven percent commission for referrals, which encouraged new investors to recruit others.</p>
<div id="attachment_60506" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60506" loading="lazy" class=" wp-image-60506" src="media/9ce2762f.xtb-prices.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/xtb-prices.png" alt="" width="751" height="501" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/xtb-prices.png 1139w, https://krebsonsecurity.com/wp-content/uploads/2022/07/xtb-prices-768x512.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/xtb-prices-782x522.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-60506" class="wp-caption-text">The now-defunct xtb-market[.]com.</p></div>
<p>While chatting via WhatsApp, Nolan and her mentor would trade side by side in xtb-market, initially with small investments ranging from $500 to $5,000. When those generated hefty returns, Nolan made bigger deposits. On several occasions she was able to withdraw amounts ranging from $10,000 to $30,000.</p>
<p>But after investing more than $4.5 million of her own money over nearly four months, Nolan found her account was suddenly frozen. She was then issued a tax statement saying she owed nearly $500,000 in taxes before she could reactivate her account or access her funds.</p>
<p>Nolan said it seems obvious in hindsight that she should never have paid the tax bill. Because xtb-market and her mentor cut all communications with her after that, and the entire website disappeared just a few weeks later.<span id="more-60119"></span></p>
<p><strong>Justin Maile</strong>, an investigation partner manager at <a href="https://www.chainalysis.com/" rel="noopener" target="_blank">Chainalysis</a>, told <em>Vice News</em> that the tax portion of the pig butchering scam relies on the &#8220;sunk costs fallacy,&#8221; when people are reluctant to abandon a failing strategy or course of action because they have already invested heavily in it.</p>
<p>&#8220;Once the victim starts getting skeptical or tries to withdraw their funds, they are often told that they have to pay tax on the gains before funds can be unlocked,” Maile told Vice News. &#8220;The scammers will try to get any last payments out of the victims by exploiting the sunk cost fallacy and dangling huge profits in front of them.&#8221;</p>
<p>Vice recently published <a href="https://www.vice.com/en/article/n7zb5d/pig-butchering-scam-cambodia-trafficking" target="_blank" rel="noopener">an in-depth report on pig butchering&#8217;s link to organized crime gangs</a> in Asia that lure young job seekers with the promise of customer service jobs in call centers. Instead, those who show up at the appointed place and time are taken on long car rides and/or forced hikes across the borders into Cambodia, where they are pressed into indentured servitude.</p>
<p>Vice found many of the people forced to work in pig-butchering scams are being held in Chinese-owned casinos operating in Cambodia. Many of those casinos were newly built when the Covid pandemic hit. As the new casinos and hotels sat empty, organized crime groups saw an opportunity to use these facilities to generate huge income streams, and many foreign travelers stranded in neighboring countries were eventually trafficked to these scam centers.</p>
<p>Vice reports:</p>
<blockquote><p>&#8220;While figures on the number of people in scam centers in Cambodia is unknown, best estimates pieced together from various sources point to the tens of thousands across scam centers in Sihanoukville, Phnom Penh, and sites in border regions Poipet and Bavet. In April, Thailand’s assistant national police commissioner said 800 Thai citizens had been rescued from scam centers in Cambodia in recent months, with a further 1,000 citizens still trapped across the country. One Vietnamese worker estimated 300 of his compatriots were held on just one floor in a tall office block hosting scam operations.&#8221;</p>
<p>&#8220;&#8230;within Victory Paradise Resort alone there were 7,000 people, the majority from mainland China, but also Indonesians, Singaporeans and Filipinos. According to the Khmer Times, one 10-building complex of high-rises in Sihanoukville, known as The China Project, holds between 8,000 to 10,000 people participating in various scams—a workforce that would generate profits around the $1 billion mark each year at $300 per worker per day.&#8221;</p></blockquote>
<h2>THE KILLING FLOOR</h2>
<p>REACTs&#8217; West said while there are a large number of pig butchering victims reporting their victimization to the FBI, very few are receiving anything more than instructions about filing a complaint with the FBI&#8217;s <a href="https://www.ic3.gov" target="_blank" rel="noopener">Internet Crime Complaint Center</a> (IC3), which keeps track of cybercrime losses and victims.</p>
<p>&#8220;There&#8217;s a huge gap in victims that are seeing any kind of service at all, where they&#8217;re reporting to the FBI but not being able to talk to anyone,&#8221; she said. &#8220;They&#8217;re filling out the IC3 form and never hearing back. It sort of feels like the federal government is ignoring this, so people are going to local agencies, which are sending these victims our way.&#8221;</p>
<p>For many younger victims of pig butchering, even losses of a few thousand dollars can be financially devastating. KrebsOnSecurity recently heard from two different readers who said they were in their 20s and lost more than $40,000 each when the investment platforms they were trading on vanished with their money.</p>
<p>The FBI can often bundle numerous IC3 complaints involving the same assailants and victims into a single case for federal prosecutors to pursue the guilty, and/or try to recapture what was stolen. In general, however, victims of crypto crimes rarely see that money again, or if they do it can take many years.</p>
<p>&#8220;The next piece is what can we actually do with these cases,&#8221; West said. &#8220;We used to frame success as getting bad people behind bars, but these cases leave us as law enforcement with not a lot of opportunity there.&#8221;</p>
<p>West said the good news is U.S. authorities are seeing some success in freezing cryptocurrency wallets suspected of being tied to large-scale cybercriminal operations. Indeed, Nolan told KrebsOnSecurity that her losses were substantial enough to warrant an official investigation by the FBI, which she says has since taken steps to freeze at least some of the assets tied to xtb-market[.]com.</p>
<p>Likewise, West said she was recently able to freeze cryptocurrency funds stolen from some pig butchering victims, and now REACT is focusing on helping state and local authorities learn how to do the same.</p>
<p>&#8220;It&#8217;s important to be able to mobilize quickly and know how to freeze and seize crypto and get it back to its rightful owner,&#8221; West said. &#8220;We definitely have made seizures in cases involving pig butchering, but we haven&#8217;t gotten that back to the rightful owners yet.&#8221;</p>
<p>In April, the FBI <a href="https://www.fbi.gov/contact-us/field-offices/portland/news/press-releases/fbi-oregon-tech-tuesday-building-a-digital-defense-against-a-new-cryptocurrency-scam-pig-butchering" target="_blank" rel="noopener">warned Internet users</a> to be on guard against pig butchering scams, which it said attracts victims with &#8220;promises of romance and riches&#8221; before duping them out of their money. The IC3 said it received more than 4,300 complaints related to crypto-romance scams, resulting in losses of more than $429 million.</p>
<p>Here are some common elements of a pig butchering scam:</p>
<p>&#8211;<strong>Dating apps:</strong> Pig-butchering attempts are common on dating apps, but they can begin with almost any type of communication, including SMS text messages.<br />
&#8211;<strong>WhatsApp:</strong> In virtually all documented cases of pig butchering, the target is moved fairly quickly into chatting with the scammer via WhatsApp.<br />
&#8211;<strong>No video:</strong> The scammers will come up with all kinds of excuses not to do a video call. But they will always refuse.<br />
&#8211;<strong>Investment chit-chat:</strong> Your contact (eventually) claims to have inside knowledge about the cryptocurrency market and can help you make money.</p>
<p>The FBI&#8217;s tips on avoiding crypto scams:</p>
<p>-Never send money, trade, or invest based on the advice of someone you have only met online.<br />
-Don&#8217;t talk about your current financial status to unknown and untrusted people.<br />
-Don&#8217;t provide your banking information, Social Security Number, copies of your identification or passport, or any other sensitive information to anyone online or to a site you do not know is legitimate.<br />
-If an online investment or trading site is promoting unbelievable profits, it is most likely that—unbelievable.<br />
-Be cautious of individuals who claim to have exclusive investment opportunities and urge you to act fast.</p>


feed_id: https://krebsonsecurity.com/?p=60558
title: A Retrospective on the 2015 Ashley Madison Breach
uri: A-Retrospective-on-the-2015-Ashley-Madison-Breach
url: https://krebsonsecurity.com/2022/07/a-retrospective-on-the-2015-ashley-madison-breach/
content:
<p>It&#8217;s been seven years since the online cheating site <strong>AshleyMadison.com</strong> was hacked and highly sensitive data about its users posted online. The leak led to the public shaming and extortion of many Ashley Madison users, and to at least two suicides. To date, little is publicly known about the perpetrators or the true motivation for the attack. But a recent review of Ashley Madison mentions across Russian cybercrime forums and far-right underground websites in the months leading up to the hack revealed some previously unreported details that may deserve further scrutiny.</p>
<p><img class="aligncenter wp-image-31652" src="media/6a30d360.ashleymadison.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/ashleymadison.png" alt="" width="751" height="479" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/07/ashleymadison.png 973w, https://krebsonsecurity.com/wp-content/uploads/2015/07/ashleymadison-580x370.png 580w, https://krebsonsecurity.com/wp-content/uploads/2015/07/ashleymadison-940x600.png 940w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>As <a href="https://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/" target="_blank" rel="noopener">first reported by KrebsOnSecurity on July 19, 2015</a>, a group calling itself the &#8220;<strong>Impact Team</strong>&#8221; released data sampled from millions of users, as well as maps of internal company servers, employee network account information, company bank details and salary information.</p>
<p>The Impact Team said it decided to publish the information because ALM &#8220;profits on the pain of others,&#8221; and in response to alleged lies that Ashley Madison parent firm <strong>Avid Life Media</strong> allegedly told its customers <a href="http://arstechnica.com/business/2014/08/cheaters-hook-up-site-ashley-madison-makes-account-deletion-confusing/" target="_blank" rel="noopener">about a service that allows members to completely erase their profile information for a $19 fee</a>.</p>
<p>According to the hackers, although the &#8220;full delete&#8221; feature that Ashley Madison advertises promised &#8220;removal of site usage history and personally identifiable information from the site,&#8221; users’ purchase details — including real name and address — aren’t actually scrubbed.<span id="more-31650"></span></p>
<p>&#8220;Full Delete netted ALM $1.7mm in revenue in 2014. It’s also a complete lie,&#8221; the hacking group wrote. &#8220;Users almost always pay with credit card; their purchase details are not removed as promised, and include real name and address, which is of course the most important information the users want removed.&#8221;</p>
<div id="attachment_31653" style="width: 701px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-31653" loading="lazy" class=" wp-image-31653" src="media/01af327f.impactteam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam.png" alt="" width="691" height="783" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam.png 671w, https://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam-580x657.png 580w" sizes="(max-width: 691px) 100vw, 691px" /><p id="caption-attachment-31653" class="wp-caption-text">A snippet of the message left behind by the Impact Team.</p></div>
<p>The Impact Team said ALM had one month to take Ashley Madison offline, along with a sister property called Established Men. The hackers promised that if a month passed and the company did not capitulate, it would release &#8220;all customer records, including profiles with all the customers’ secret sexual fantasies and matching credit card transactions, real names and addresses, and employee documents and emails.&#8221;</p>
<p>Exactly 30 days later, on Aug. 18, 2015, the Impact Team posted a &#8220;Time&#8217;s up!&#8221; message online, along with links to 60 gigabytes of Ashley Madison user data.</p>
<h2>AN URGE TO DESTROY ALM</h2>
<p>One aspect of the Ashley Madison breach that&#8217;s always bothered me is how the perpetrators largely cast themselves as defenders against crooked companies that break their privacy promises, and how this narrative was sustained at least until the Impact Team decided to leak all of the stolen user account data in August 2015.</p>
<p>Granted, ALM had a lot to answer for. For starters, after the breach it became clear that a great many of the female Ashley Madison profiles were either bots or created once and never used again. Experts combing through the leaked user data <a href="https://gizmodo.com/the-fembots-of-ashley-madison-1726670394" target="_blank" rel="noopener">determined</a> that fewer than one percent of the female profiles on Ashley Madison had been used on a regular basis, and the rest were used just once &#8212; on the day they were created. On top of that, researchers <a href="https://www.smh.com.au/technology/ashley-madison-made-a-lot-of-money-and-created-very-few-affairs-20150824-gj6er7.html" target="_blank" rel="noopener">found 84 percent of the profiles were male</a>.</p>
<p>But the Impact Team had to know that ALM would never comply with their demands to dismantle Ashley Madison and Established Men. In 2014, ALM reported revenues of $115 million. There was little chance the company was going to shut down some of its biggest money machines.</p>
<p>Hence, it appears the Impact Team&#8217;s goal all along was to create prodigious amounts of drama and tension by announcing the hack of a major cheating website, and then letting that drama play out over the next few months as millions of exposed Ashley Madison users freaked out and <a href="https://krebsonsecurity.com/2015/08/extortionists-target-ashley-madison-users/" target="_blank" rel="noopener">became the targets of extortion attacks and public shaming</a>.</p>
<p><strong>Robert Graham</strong>, CEO of Errata Security, penned <a href="https://blog.erratasec.com/2015/08/notes-on-ashley-madison-dump.html#.VdeFVyRiM20" target="_blank" rel="noopener">a blog post in 2015</a> concluding that the moral outrage professed by the Impact Team was pure posturing.</p>
<p>&#8220;They appear to be motivated by the immorality of adultery, but in all probability, their motivation is that #1 it&#8217;s fun and #2 because they can,&#8221; Graham wrote.</p>
<p><strong>Per Thorsheim</strong>, a security researcher in Norway, told <em>Wired</em> at the time that he believed the Impact Team was motivated by an urge to destroy ALM with as much aggression as they could muster.</p>
<p>&#8220;It&#8217;s not just for the fun and &#8216;because we can,&#8217; nor is it just what I would call &#8216;moralistic fundamentalism,'&#8221; Thorsheim <a href="https://www.wired.com/2015/08/ashley-madison-hack-everything-you-need-to-know-your-questions-explained/" target="_blank" rel="noopener">told Wired</a>. &#8220;Given that the company had been moving toward an IPO right before the hack went public, the timing of the data leaks was likely no coincidence.&#8221;</p>
<h2>NEO-NAZIS TARGET ASHLEY MADISON CEO</h2>
<p>As the seventh anniversary of the Ashley Madison hack rolled around, KrebsOnSecurity went back and looked for any mentions of Ashley Madison or ALM on cybercrime forums in the months leading up to the Impact Team&#8217;s initial announcement of the breach on July 19, 2015. There wasn&#8217;t much, except a Russian guy offering to sell payment and contact information on 32 million AshleyMadison users, and a bunch of Nazis upset about a successful Jewish CEO promoting adultery.<span id="more-60558"></span></p>
<p><img loading="lazy" class="aligncenter wp-image-60580" src="media/ac0194a1.ashmadbill.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/ashmadbill.png" alt="" width="750" height="408" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/ashmadbill.png 616w, https://krebsonsecurity.com/wp-content/uploads/2022/07/ashmadbill-370x200.png 370w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> recorded a series of posts by a user with the handle &#8220;<strong>Brutium</strong>&#8221; on the Russian-language cybercrime forum <strong>Antichat</strong> between 2014 and 2016. Brutium routinely advertised the sale of large, hacked databases, and on Jan. 24, 2015, this user posted a thread offering to sell data on 32 million Ashley Madison users:</p>
<p>&#8220;Data from July 2015<br />
Total ~32 Million contacts:<br />
full name; email; phone numbers; payment, etc.&#8221;</p>
<p>It&#8217;s unclear whether the postdated &#8220;July 2015&#8221; statement was a typo, or if Brutium updated that sales thread at some point. There is also no indication whether anyone purchased the information. Brutium&#8217;s profile has since been removed from the Antichat forum.</p>
<p><a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> is a threat intelligence company in New York City that keeps tabs on hundreds of cybercrime forums, as well as extremist and hate websites. A search in Flashpoint for mentions of Ashley Madison or ALM prior to July 19, 2015 shows that in the six months leading up to the hack, Ashley Madison and its then-CEO <strong>Noel Biderman</strong> became a frequent subject of derision across multiple neo-Nazi websites.</p>
<p>On Jan. 14, 2015, a member of the neo-Nazi forum Stormfront posted a lively thread about Ashley Madison in the general discussion area titled, &#8220;Jewish owned dating website promoting adultery.&#8221;</p>
<p>On July 3, 2015, <a href="https://en.wikipedia.org/wiki/Andrew_Anglin" target="_blank" rel="noopener">Andrew Anglin</a>, the editor of the alt-right publication <a href="https://www.splcenter.org/fighting-hate/extremist-files/individual/andrew-anglin" target="_blank" rel="noopener">Daily Stormer</a>, posted excerpts about Biderman from a story titled, &#8220;Jewish Hyper-Sexualization of Western Culture,&#8221; which referred to Biderman as the &#8220;Jewish King of Infidelity.&#8221;</p>
<p>On July 10, a mocking montage of Biderman photos with racist captions was posted to the extremist website <a href="https://www.splcenter.org/hatewatch/2014/04/14/vanguard-news-network-track-record-violence" target="_blank" rel="noopener">Vanguard News Network</a>, as part of a thread called &#8220;Jews normalize sexual perversion.&#8221;</p>
<p>&#8220;Biderman himself says he&#8217;s a happily married father of two and does not cheat,&#8221; reads the story posted by Anglin on the Daily Stormer. &#8220;In an interview with the &#8216;Current Affair&#8217; program in Australia, he admitted that if he found out his own wife was accessing his cheater&#8217;s site, &#8216;I would be devastated.'&#8221;</p>
<p>The leaked AshleyMadison data included more than <a href="https://krebsonsecurity.com/2015/08/leaked-ashleymadison-emails-suggest-execs-hacked-competitors/" target="_blank" rel="noopener">three years&#8217; worth of emails stolen from Biderman</a>. The hackers <a href="https://www.vice.com/en/article/bmjqyz/ashley-madison-hackers-speak-out-nobody-was-watching" target="_blank" rel="noopener">told <em>Motherboard</em> in 2015</a> they had 300 GB worth of employee emails, but that they saw no need to dump the inboxes of other company employees.</p>
<p>Several media outlets pounced on salacious exchanges in Biderman&#8217;s emails as proof he had carried on multiple affairs. Biderman resigned as CEO on Aug. 28, 2015. The last message in the archive of Biderman&#8217;s stolen emails was dated July 7, 2015 &#8212; almost two weeks before the Impact Team would announce their hack.</p>
<p>Biderman told KrebsOnSecurity on July 19, 2015 that the company believed the hacker was some type of insider.</p>
<p>&#8220;We&#8217;re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,&#8221; Biderman said. &#8220;I’ve got their profile right in front of me, all their work credentials. It was definitely a person here that was not an employee but certainly had touched our technical services.&#8221;</p>
<p>Certain language in the Impact Team&#8217;s manifesto seemed to support this theory, such as the line: &#8220;For a company whose main promise is secrecy, it&#8217;s like you didn&#8217;t even try, like you thought you had never pissed anyone off.&#8221;</p>
<p>But despite ALM offering <a href="https://krebsonsecurity.com/2015/08/ashleymadison-500k-bounty-for-hackers/" target="_blank" rel="noopener">a belated $500,000 reward</a> for information leading to the arrest and conviction of those responsible, to this day no one has been charged in connection with the hack.</p>


feed_id: https://krebsonsecurity.com/?p=60300
title: Breach Exposes Users of Microleaves Proxy Service
uri: Breach-Exposes-Users-of-Microleaves-Proxy-Service
url: https://krebsonsecurity.com/2022/07/breach-exposes-users-of-microleaves-proxy-service/
content:
<p><strong>Microleaves</strong>, a ten-year-old proxy service that lets customers route their web traffic through millions of Microsoft Windows computers, recently fixed a vulnerability in their website that exposed their entire user database. Microleaves claims its proxy software is installed with user consent, but data exposed in the breach shows the service has a lengthy history of being supplied with new proxies by affiliates incentivized to distribute the software any which way they can &#8212; such as by secretly bundling it with other titles.</p>
<div id="attachment_60605" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60605" class=" wp-image-60605" src="media/370f3a8f.microleaves.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves.png" alt="" width="750" height="459" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves.png 1445w, https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves-768x470.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves-782x479.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60605" class="wp-caption-text">The Microleaves proxy service, which is in the process of being rebranded to Shifter[.[io.</p></div>
<p>Launched in 2013, Microleaves is a service that allows customers to route their Internet traffic through PCs in virtually any country or city around the globe. Microleaves works by changing each customer&#8217;s Internet Protocol (IP) address every five to ten minutes. </p>
<p>The service, which accepts PayPal, Bitcoin and all major credit cards, is aimed primarily at enterprises engaged in repetitive, automated activity that often results in an IP address being temporarily blocked &#8212; such as data scraping, or mass-creating new accounts at some service online.</p>
<p>In response to a report about the data exposure from KrebsOnSecurity, Microleaves said it was grateful for being notified about a &#8220;very serious issue regarding our customer information.&#8221;</p>
<p><strong>Abhishek Gupta</strong> is the PR and marketing manager for Microleaves, which he said in the process of being rebranded to &#8220;<strong>Shifter.io.&#8221;</strong> Gupta said the report qualified as a &#8220;medium&#8221; severity security issue in Shifter&#8217;s brand new bug bounty program (the site makes no mention of a bug bounty), which he said offers up to $2,000 for reporting data exposure issues like the one they just fixed. KrebsOnSecurity declined the offer and requested that Shifter donate the amount to the <a href="https://www.eff.org" target="_blank" rel="noopener">Electronic Frontier Foundation</a> (EFF), a digital rights group.</p>
<p>From its inception nearly a decade ago, Microleaves has claimed to lease between 20-30 million IPs via its service at any time. <strong>Riley Kilmer</strong>, co-founder of the proxy-tracking service <a href="https://www.spur.us" rel="noopener" target="_blank">Spur.us</a>, said that 20-30 million number might be accurate for Shifter if measured across a six-month time frame. Currently, Spur is tracking roughly a quarter-million proxies associated with Microleaves/Shifter each day, with a high rate of churn in IPs. </p>
<p>Early on, this rather large volume of IP addresses led many to speculate that Microleaves was just a botnet which was being resold as a commercial proxy service.</p>
<div id="attachment_60620" style="width: 760px" class="wp-caption aligncenter"><a href="media/9444cdfb.microleaves-stats.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves-stats.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-60620" loading="lazy" class="wp-image-60620" src="media/9444cdfb.microleaves-stats.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves-stats.png" alt="" width="750" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves-stats.png 1230w, https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves-stats-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/microleaves-stats-782x517.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-60620" class="wp-caption-text">Proxy traffic related to top Microleaves users, as exposed by the website&#8217;s API.</p></div>
<p>The very first discussion thread started by the new user <strong>Microleaves</strong> on the forum <strong>BlackHatWorld</strong> in 2013 sought forum members who could help test and grow the proxy network. At the time, the Microleaves user said their proxy network had 150,000 IPs globally, and was growing quickly.</p>
<p>One of BlackHatWorld&#8217;s moderators asked the administrator of the forum to review the Microleaves post.</p>
<p>&#8220;User states has 150k proxies,&#8221; the forum skeptic wrote. &#8220;No seller on BHW has 150k working daily proxies none of us do. Which hints at a possible BOTNET. That&#8217;s the only way you will get 150k.&#8221;</p>
<p>Microleaves has long been classified by antivirus companies as adware or as a &#8220;potentially unwanted program&#8221; (PUP), the euphemism that antivirus companies use to describe executable files that get installed with ambiguous consent at best, and are often part of a bundle of software tied to some &#8220;free&#8221; download. Security vendor <strong>Kaspersky</strong> flags the Microleaves family of software as a trojan horse program that commandeers the user&#8217;s Internet connection as a proxy without notifying the user.</p>
<p>&#8220;While working, these Trojans pose as Microsoft Windows Update,&#8221; Kaspersky <a href="https://threats.kaspersky.com/en/threat/Trojan-Proxy.Win64.Microleaves/" target="_blank" rel="noopener">wrote</a>.</p>
<p>In a February 2014 post to BlackHatWorld, Microleaves announced that its sister service &#8212; <strong>reverseproxies[.]com</strong> &#8212; was now offering an &#8220;<strong>Auto CAPTCHA Solving Service</strong>,&#8221; which automates the solving of those squiggly and sometimes frustrating puzzles that many websites use to distinguish bots from real visitors. The CAPTCHA service was offered as an add-on to the Microleaves proxy service, and ranged in price from $20 for a 2-day trial to $320 for solving up to 80 captchas simultaneously.</p>
<p>&#8220;We break normal Recaptcha with 60-90% success rate, recaptcha with blobs 30% success, and 500+ other captcha,&#8221; Microleaves wrote. &#8220;As you know all success rate on recaptcha depends very much on good proxies that are fresh and not spammed!&#8221;<span id="more-60300"></span></p>
<h2>WHO IS ACIDUT?</h2>
<p>The exposed Microleaves user database shows that the first user created on the service &#8212; username &#8220;admin&#8221; &#8212; used the email address <strong>alex.iulian@aol.com</strong>. A search on that email address in <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a service that tracks breached data, reveals it was used to create an account at the link shortening service bit.ly under the name <strong>Alexandru Florea</strong>, and the username &#8220;<strong>Acidut</strong>.&#8221; [Full disclosure: Constella is currently an advertiser on this website].</p>
<p>According to the cyber intelligence company <a href="http://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, a user named Acidut with the email address <strong>iulyan87_4u@gmail.com</strong> had an active presence on almost a dozen shadowy money-making and cybercrime forums from 2010 to 2017, including <strong>BlackHatWorld</strong>, <strong>Carder[.]pro</strong>, <strong>Hackforums</strong>, <strong>OpenSC</strong>, and <strong>CPAElites</strong>.</p>
<div id="attachment_60613" style="width: 760px" class="wp-caption aligncenter"><a href="media/578ef236.shifter-bhw.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/shifter-bhw.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-60613" loading="lazy" class="wp-image-60613" src="media/578ef236.shifter-bhw.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/shifter-bhw.png" alt="" width="750" height="507" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/shifter-bhw.png 1085w, https://krebsonsecurity.com/wp-content/uploads/2022/07/shifter-bhw-768x519.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/shifter-bhw-782x528.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-60613" class="wp-caption-text">The user Microleaves (later &#8220;Shifter.io&#8221;) advertised on BlackHatWorld the sale of 31 million residential IPs for use as proxies, in late 2013. The same account continues to sell subscriptions to Shifter.io.</p></div>
<p>In a 2011 post on Hackforums, Acidut said they were building a botnet using an &#8220;exploit kit,&#8221; a set of browser exploits made to be stitched into hacked websites and foist malware on visitors. Acidut claimed their exploit kit was generating 3,000 to 5,000 new bots each day. OpenSC was hacked at one point, and its private messages show Acidut purchased a license from <strong>Exmanoize</strong>, the handle used by the creator of the <a href="https://krebsonsecurity.com/2010/01/a-peek-inside-the-eleonore-browser-exploit-kit/" target="_blank" rel="noopener">Eleonore Exploit Kit</a>.</p>
<p>By November 2013, Acidut was advertising the sale of &#8220;26 million SOCKS residential proxies.&#8221; In a March 2016 post to CPAElites, Acidut said they had a worthwhile offer for people involved in <a href="https://krebsonsecurity.com/2011/06/pay-per-install-a-major-source-of-badness/" target="_blank" rel="noopener">pay-per-install or &#8220;PPI&#8221; schemes</a>, which match criminal gangs who pay for malware installs with enterprising hackers looking to sell access to compromised PCs and websites.</p>
<p>Because pay-per-install affiliate schemes rarely impose restrictions on how the software can be installed, such programs can be appealing for cybercriminals who already control large collections of hacked machines and/or compromised websites. Indeed, Acidut went a step further, adding that their program could be quietly and invisibly nested inside of other programs.</p>
<p>&#8220;For those of you who are doing PPI I have a global offer that you can bundle to your installer,&#8221; Acidut wrote. &#8220;I am looking for many installs for an app that will generate website visits. The installer has a silence version which you can use inside your installer. I am looking to buy as many daily installs as possible worldwide, except China.&#8221;</p>
<p>Asked about the source of their proxies in 2014, the Microleaves user responded that it was &#8220;something related to a PPI network. I can&#8217;t say more and I won&#8217;t get into details.&#8221;</p>
<p>Acidut authored a similar message on the forum BlackHatWorld in 2013, where they encouraged users to contact them on Skype at the username &#8220;<strong>nevo.julian</strong>.&#8221; That same Skype contact address was listed prominently on the Microleaves homepage <a href="https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-networks/" rel="noopener" target="_blank">up until about a week ago</a> when KrebsOnSecurity first reached out to the company.</p>
<h2>ONLINE[.]IO (NOW MERCIFULLY OFFLINE)</h2>
<p>There is a Facebook <a href="https://www.facebook.com/acidut" target="_blank" rel="noopener">profile</a> for an <strong>Alexandru Iulian Florea</strong> from Constanta, Romania, whose username on the social media network is Acidut. Prior to KrebsOnSecurity alerting Shifter of its data breach, the Acidut profile page associated Florea with the websites microleaves.com, shrooms.io, <strong>leftclick[.]io</strong>, and <strong>online[.]io</strong>. Mr. Florea did not respond to multiple requests for comment, and his Facebook page no longer mentions these domains.</p>
<p>Leftclick and online[.]io emerged as subsidiaries of Microleaves between 2017 and 2018. According to a help wanted ad posted in 2018 for a developer position at online[.]io, the company&#8217;s services were brazenly pitched to investors as &#8220;a cybersecurity and privacy tool kit, offering extensive protection using advanced adblocking, anti-tracking systems, malware protection, and revolutionary VPN access based on residential IPs.&#8221;</p>
<div id="attachment_60606" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60606" loading="lazy" class=" wp-image-60606" src="media/71a285c6.floreaonlineio.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/floreaonlineio.png" alt="" width="754" height="422" /><p id="caption-attachment-60606" class="wp-caption-text">A teaser from Irish Tech News.</p></div>
<p>&#8220;Online[.]io is developing the first fully decentralized peer-to-peer networking technology and revolutionizing the browsing experience by making it faster, ad free, more reliable, secure and non-trackable, thus freeing the Internet from annoying ads, malware, and trackers,&#8221; reads the rest of that help wanted ad.</p>
<p>Microleaves CEO Alexandru Florea gave an &#8220;interview&#8221; to the website <a href="https://irishtechnews.ie/interview-with-online-io-ceo-alexandru-florea/" target="_blank" rel="noopener">Irishtechnews.ie in 2018</a>, in which he explained how Online[.]io (OIO) was going to upend the online advertising and security industries with its initial coin offering (ICO). The word interview is in air quotes because the following statements by Florea deserved some serious pushback by the interviewer.</p>
<p>&#8220;Online[.]io solution, developed using the Ethereum blockchain, aims at disrupting the digital advertising market valued at more than $1 trillion USD,&#8221; Alexandru enthused. &#8220;By staking OIO tokens and implementing our solution, the website operators will be able to access a new non-invasive revenue stream, which capitalizes on time spent by users online.&#8221;</p>
<p>&#8220;At the same time, internet users who stake OIO tokens will have the opportunity to monetize on the time spent online by themselves and their peers on the World Wide Web,&#8221; he continued. &#8220;The time spent by users online will lead to ICE tokens being mined, which in turn can be used in the dedicated merchant system or traded on exchanges and consequently changed to fiat.&#8221;</p>
<p><em>Translation: If you install our proxy bot/CAPTCHA-solver/ad software on your computer &#8212; or as an exploit kit on your website &#8212; we&#8217;ll make millions hijacking ads and you will be rewarded with heaps of soon-to-be-worthless shitcoin. Oh, and all your security woes will disappear, too.</em></p>
<p>It&#8217;s unclear how many Internet users and websites willingly agreed to get bombarded with Online[.]io&#8217;s annoying ads and search hijackers &#8212; and to have their PC turned into a proxy or CAPTCHA-solving zombie for others. But that is exactly what multiple security companies said happened when users encountered online[.]io, which operated using the Microsoft Windows process name of &#8220;<strong>online-guardian.exe</strong>.&#8221;</p>
<p>Incredibly, <strong>Crunchbase </strong>says Online[.]io raised $6 million in funding for an initial coin offering in 2018, based on the plainly ludicrous claims made above. Since then, however, online[.]io seems to have gone&#8230;offline, for good.</p>
<h2>SUPER TECH VENTURES?</h2>
<p>Until this week, Shifter.io&#8217;s website also exposed information about its customer base and most active users, as well as how much money each client has paid over the lifetime of their subscription. The data indicates Shifter has earned more than $11.7 million in direct payments, although it&#8217;s unclear how far back in time those payment records go, or how complete they are.</p>
<p>The bulk of Shifter customers who spent more than $100,000 at the proxy service appear to be digital advertising companies, including some located in the United States. None of the several Shifter customers approached by KrebsOnSecurity agreed to be interviewed.</p>
<p>Shifter&#8217;s Gupta said he&#8217;d been with the company for three years, since the new owner took over the company and made the rebrand to Shifter.</p>
<p>&#8220;The company has been on the market for a long time, but operated under a different brand called Microleaves, until new ownership and management took over the company started a reorganization process that is still on-going,&#8221; Gupta said. &#8220;We are fully transparent. Mostly [our customers] work in the data scraping niche, this is why we actually developed more products in this zone and made a big shift towards APIs and integrated solutions in the past year.&#8221;</p>
<p>Ah yes, the same APIs and integrated solutions that were found exposed to the Internet and leaking all of Shifter&#8217;s customer information.</p>
<p>Gupta said the original founder of Microleaves was a man from India, who later sold the business to Florea. According to Gupta, the Romanian entrepreneur had multiple issues in trying to run the company, and then sold it three years ago to the current owner &#8212; <strong>Super Tech Ventures</strong>, a private equity company based in Taiwan.</p>
<p>&#8220;Our CEO is <strong>Wang Wei</strong>, he has been with the company since 3 years ago,&#8221; Gupta said. &#8220;Mr. Florea left the company two years ago after ending this transition period.&#8221;</p>
<p>Google and other search engines seem to know nothing about a Super Tech Ventures based in Taiwan. Incredibly, Shifter&#8217;s own PR person claimed that he, too, was in the dark on this subject.</p>
<p>&#8220;I would love to help, but I really don&#8217;t know much about the mother company,&#8221; Gupta said, essentially walking back his &#8220;fully transparent&#8221; statement. &#8220;I know they are a branch of the bigger group of asian investment firms focused on private equity in multiple industries.&#8221;</p>
<p>Adware and proxy software are often bundled together with &#8220;free&#8221; software utilities online, or with popular software titles that have been pirated and quietly fused with installers tied to various PPI affiliate schemes.</p>
<p>But just as often, these intrusive programs will include some type of notice &#8212; even if installed as part of a software bundle &#8212; that many users simply do not read and click &#8220;Next&#8221; to get on with installing whatever software they&#8217;re seeking to use. In these cases, selecting the &#8220;basic&#8221; or &#8220;default&#8221; settings while installing usually hides any per-program installation prompts, and assumes you agree to all of the bundled programs being installed. It&#8217;s always best to opt for the &#8220;custom&#8221; installation mode, which can give you a better idea of what is actually being installed, and can let you control certain aspects of the installation.</p>
<p>Either way, it&#8217;s best to start with the assumption that if a software or service online is &#8220;free,&#8221; that there is likely some component involved that allows the provider of that service to monetize your activity. As KrebsOnSecurity noted at the conclusion of <a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" target="_blank" rel="noopener">last week&#8217;s story on a China-based proxy service called 911</a>, the rule of thumb for transacting online is that if you’re not the paying customer, then you and/or your devices are probably the product that’s being sold to others.</p>
<p>Further reading on proxy services:</p>
<p>July 18, 2022: <a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" rel="noopener" target="_blank">A Deep Dive Into the Residential Proxy Service &#8216;911&#8217;</a><br />
June 28, 2022: <a href="https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/" rel="noopener" target="_blank">The Link Between AWM Proxy &#038; the Glupteba Botnet</a><br />
June 22, 2022: <a href="https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/" rel="noopener" target="_blank">Meet the Administrators of the RSOCKS Proxy Botnet</a><br />
Sept. 1, 2021: <a href="https://krebsonsecurity.com/2021/09/15-year-old-malware-proxy-network-vip72-goes-dark/" rel="noopener" target="_blank">15-Year-Old Malware Proxy Network VIP72 Goes Dark</a><br />
Aug. 19, 2019: <a href="https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-networks/" rel="noopener" target="_blank">The Rise of &#8220;Bulletproof&#8221; Residential Networks</a></p>


feed_id: https://krebsonsecurity.com/?p=60655
title: 911 Proxy Service Implodes After Disclosing Breach
uri: 911-Proxy-Service-Implodes-After-Disclosing-Breach
url: https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/
content:
<div id="attachment_60396" style="width: 1240px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60396" class="size-full wp-image-60396" src="media/c4a58664.s5now.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now.png" alt="" width="1230" height="693" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now.png 1230w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now-768x433.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/s5now-782x441.png 782w" sizes="(max-width: 1230px) 100vw, 1230px" /><p id="caption-attachment-60396" class="wp-caption-text">The 911 service as it existed until July 28, 2022.</p></div>
<p>911[.]re, a proxy service that since 2015 has sold access to hundreds of thousands of <strong>Microsoft Windows</strong> computers daily, announced this week that it is shutting down in the wake of a data breach that destroyed key components of its business operations. The abrupt closure comes ten days after KrebsOnSecurity published an in-depth look at 911 and its connections to shady pay-per-install affiliate programs that secretly bundled 911&#8217;s proxy software with other titles, including &#8220;free&#8221; utilities and pirated software.</p>
<p>911[.]re <del>is</del> was one of the original &#8220;residential proxy&#8221; networks, which allow someone to rent a residential IP address to use as a relay for his/her Internet communications, providing anonymity and the advantage of being perceived as a residential user surfing the web.</p>
<p>Residential proxy services are often marketed to people seeking the ability to evade country-specific blocking by the major movie and media streaming providers. But some of them — like 911 — build their networks in part by offering “free VPN” or “free proxy” services that are powered by software which turns the user’s PC into a traffic relay for other users. In this scenario, users indeed get to use a free VPN service, but they are often unaware that doing so will turn their computer into a proxy that lets others use their Internet address to transact online.</p>
<p>From a website’s perspective, the IP traffic of a residential proxy network user appears to originate from the rented residential IP address, not from the proxy service customer. These services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they can make it difficult to trace malicious traffic to its original source.</p>
<p>As noted in <a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" target="_blank" rel="noopener">KrebsOnSecurity&#8217;s July 19 story on 911</a>, the proxy service operated multiple pay-per-install schemes that paid affiliates to surreptitiously bundle the proxy software with other software, continuously generating a steady stream of new proxies for the service.</p>
<div id="attachment_60380" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60380" loading="lazy" class=" wp-image-60380" src="media/7240a3b1.exebucks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks.png" alt="" width="750" height="527" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks.png 917w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-768x539.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-782x549.png 782w, https://krebsonsecurity.com/wp-content/uploads/2022/07/exebucks-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60380" class="wp-caption-text">A cached copy of flashupdate[.]net circa 2016, which shows it was the homepage of a pay-per-install affiliate program that incentivized the silent installation of 911&#8217;s proxy software.</p></div>
<p>Within hours of that story, 911 posted a notice at the top of its site, saying, &#8220;We are reviewing our network and adding a series of security measures to prevent misuse of our services. Proxy balance top-up and new user registration are closed. We are reviewing every existing user, to ensure their usage is legit and [in] compliance with our Terms of Service.&#8221;</p>
<p>At this announcement, all hell broke loose on various cybercrime forums, where many longtime 911 customers reported they were unable to use the service. Others affected by the outage said it seemed 911 was trying to implement some sort of &#8220;know your customer&#8221; rules &#8212; that maybe 911 was just trying to weed out those customers using the service for high volumes of cybercriminal activity.</p>
<p>Then on July 28, the 911 website began redirecting to a notice saying, &#8220;We regret to inform you that we permanently shut down 911 and all its services on July 28th.&#8221;</p>
<p>According to 911, the service was hacked in early July, and it was discovered that someone manipulated the balances of a large number of user accounts. 911 said the intruders abused an application programming interface (API) that handles the topping up of accounts when users make financial deposits with the service.</p>
<p>&#8220;Not sure how did the hacker get in,&#8221; the 911 message reads. &#8220;Therefore, we urgently shut down the recharge system, new user registration, and an investigation started.&#8221;</p>
<div id="attachment_60659" style="width: 760px" class="wp-caption aligncenter"><a href="media/63f3b3a6.rip911.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/rip911.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-60659" loading="lazy" class="wp-image-60659" src="media/63f3b3a6.rip911.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/rip911.png" alt="" width="750" height="563" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/rip911.png 1108w, https://krebsonsecurity.com/wp-content/uploads/2022/07/rip911-768x577.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/rip911-782x587.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-60659" class="wp-caption-text">The parting message from 911 to its users, posted to the homepage July 28, 2022.</p></div>
<p>However the intruders got in, 911 said, they managed to also overwrite critical 911[.]re servers, data and backups of that data.<span id="more-60655"></span></p>
<p>&#8220;On July 28th, a large number of users reported that they could not log in the system,&#8221; the statement continues. &#8220;We found that the data on the server was maliciously damaged by the hacker, resulting in the loss of data and backups. Its [sic] confirmed that the recharge system was also hacked the same way. We were forced to make this difficult decision due to the loss of important data that made the service unrecoverable.&#8221;</p>
<p>Operated largely out of China, 911 was an enormously popular service across many cybercrime forums, and it became something akin to critical infrastructure for this community after two of 911&#8217;s longtime competitors &#8212; malware-based proxy services <strong>VIP72</strong> and <strong>LuxSocks</strong> &#8212; <a href="https://krebsonsecurity.com/2021/09/15-year-old-malware-proxy-network-vip72-goes-dark/" target="_blank" rel="noopener">closed their doors in the past year</a>.</p>
<p>Now, many on the crime forums who relied on 911 for their operations are wondering aloud whether there are any alternatives that match the scale and utility that 911 offered. The consensus seems to be a resounding &#8220;no.&#8221;</p>
<p>I&#8217;m guessing we may soon learn more about the security incidents that caused 911 to implode. And perhaps other proxy services will spring up to meet what appears to be a burgeoning demand for such services at the moment, with comparatively little supply.</p>
<p>In the meantime, 911&#8217;s absence may coincide with a measurable (if only short-lived) reprieve in unwanted traffic to top Internet destinations, including banks, retailers and cryptocurrency platforms, as many former customers of the proxy service scramble to make alternative arrangements.</p>
<p><strong>Riley Kilmer</strong>, co-founder of the proxy-tracking service <a href="https://www.spur.us" rel="noopener" target="_blank">Spur.us</a>, said 911&#8217;s network will be difficult to replicate in the short run.</p>
<p>&#8220;My speculation is [911&#8217;s remaining competitors] are going to get a major boost in the short term, but a new player will eventually come along,&#8221; Kilmer said. &#8220;None of those are good replacements for LuxSocks or 911. However, they will all allow anyone to use them. For fraud rates, the attempts will continue but through these replacement services which should be easier to monitor and stop. 911 had some very clean IP addresses.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=60690
title: No SOCKS, No Shoes, No Malware Proxy Services!
uri: No-SOCKS-No-Shoes-No-Malware-Proxy-Services
url: https://krebsonsecurity.com/2022/08/no-socks-no-shoes-no-malware-proxy-services/
content:
<p>With the recent demise of several popular &#8220;proxy&#8221; services that let cybercriminals route their malicious traffic through hacked PCs, there is now something of a supply chain crisis gripping the underbelly of the Internet. Compounding the problem, several remaining malware-based proxy services have chosen to block new registrations to avoid swamping their networks with a sudden influx of customers.</p>
<p><img class="aligncenter wp-image-31323" src="media/2591b79f.proxy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/06/proxy.png" alt="" width="753" height="315" /></p>
<p>Last week, a seven-year-old proxy service called <strong>911[.]re</strong> abruptly announced it was permanently closing after <a href="https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/" target="_blank" rel="noopener">a cybersecurity breach allowed unknown intruders to trash its servers and delete customer data and backups</a>. 911 was already akin to critical infrastructure for many in the cybercriminal community after its top two competitors &#8212; <strong>VIP72</strong> and <strong>LuxSocks</strong> &#8212; closed or were shut down by authorities over the past 10 months.</p>
<p>The underground cybercrime forums are now awash in pleas from people who are desperately seeking a new supplier of abundant, cheap, and reliably clean proxies to restart their businesses. The consensus seems to be that those days are now over, and while there are many smaller proxy services remaining, few of them on their own are capable of absorbing anywhere near the current demand.</p>
<p>&#8220;Everybody is looking for an alternative, bro,&#8221; wrote a <strong>BlackHatForums</strong> user on Aug. 1 in response to one of many &#8220;911 alternative&#8221; discussion threads. &#8220;No one knows an equivalent alternative to 911[.]re. Their service in terms of value and accessibility compared to other proxy providers was unmatched. Hopefully someone comes with a great alternative to 911[.]re.&#8221;</p>
<h2>NEW SOCKS, SAME OLD SHOES</h2>
<p>Among the more frequently recommended alternatives to 911 is <strong>SocksEscort[.]com</strong>, a malware-based proxy network that has been in existence since at least 2010. Here&#8217;s what part of their current homepage looks like:</p>
<div id="attachment_60702" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60702" loading="lazy" class=" wp-image-60702" src="media/6395f428.socksescort-home.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/socksescort-home.png" alt="" width="750" height="677" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/socksescort-home.png 884w, https://krebsonsecurity.com/wp-content/uploads/2022/08/socksescort-home-768x693.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/socksescort-home-782x706.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60702" class="wp-caption-text">The SocksEscort home page says its services are perfect for people involved in automated online activity that often results in IP addresses getting blocked or banned, such as Craigslist and dating scams, search engine results manipulation, and online surveys.</p></div>
<p>But faced with a deluge of new signups in the wake of 911&#8217;s implosion, SocksEscort was among the remaining veteran proxy services that opted to close its doors to new registrants, replacing its registration page with the message:</p>
<p>&#8220;Due to unusual high demand, and heavy load on our servers, we had to block all new registrations. We won&#8217;t be able to support our proxies otherwise, and close SocksEscort as a result. We will resume registrations right after demand drops. Thank you for understanding, and sorry for the inconvenience.&#8221;</p>
<p>According to <a href="https://www.spur.us" target="_blank" rel="noopener">Spur.us</a>, a startup that tracks proxy services, SocksEscort is a malware-based proxy offering, which means the machines doing the proxying of traffic for SocksEscort customers have been infected with malicious software that turns them into a traffic relay.</p>
<p>Spur says SocksEscort&#8217;s proxy service relies on software designed to run on Windows computers, and is currently leasing access to more than 14,000 hacked computers worldwide. That is a far cry from the proxy inventory advertised by 911, which stood at more than 200,000 IP addresses for rent just a few days ago.</p>
<div id="attachment_60695" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60695" loading="lazy" class=" wp-image-60695" src="media/466f5f64.spur-socksescort.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/spur-socksescort.png" alt="" width="754" height="568" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/spur-socksescort.png 968w, https://krebsonsecurity.com/wp-content/uploads/2022/08/spur-socksescort-768x578.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/spur-socksescort-782x589.png 782w" sizes="(max-width: 754px) 100vw, 754px" /><p id="caption-attachment-60695" class="wp-caption-text">Image: Spur.us</p></div>
<p>SocksEscort is what&#8217;s known as a &#8220;SOCKS Proxy&#8221; service. The SOCKS (or SOCKS5) protocol allows Internet users to channel their Web traffic through a proxy server, which then passes the information on to the intended destination. From a website’s perspective, the traffic of the proxy network customer appears to originate from a rented/malware-infected PC tied to a residential ISP customer, not from the proxy service customer.</p>
<p>These services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they make it difficult to trace malicious traffic to its original source.</p>
<p>The disruption at 911[.]re came days after KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" target="_blank" rel="noopener">published an in-depth look at the long-running proxy service</a>, which showed that 911 had a history of incentivizing the installation of its proxy software without user notice or consent, and that it actually ran some of these &#8220;pay-per-install&#8221; schemes on its own to guarantee a steady supply of freshly-hacked PCs.</p>
<p>That story also showed once again that the people who are building and leasing these botnets are surprisingly easy to identify in real life, particularly given that they operate malware-based anonymity services that enable a great deal of cybercrime activity.</p>
<p>Such was the case again with SocksEscort. Hilariously, the common link that exposed the real-life identities of the people running this SOCKS service was that <em>they all worked for the same online shoe store</em>.<span id="more-60690"></span></p>
<h2>ANGRY CODERS</h2>
<p>SocksEscort[.]com was originally registered to the email address &#8220;<strong>michdomain@gmail.com</strong>,&#8221; which according to <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> was used to register a handful of related domains, including <a href="https://web.archive.org/web/20101020124825/http://www.super-socks.com/" target="_blank" rel="noopener">its previous incarnation &#8212; super-socks[.]biz</a>. Cached versions of the site show that in 2010 the software which powers the network was produced with a copyright of &#8220;<strong>Escort Software</strong>.&#8221;</p>
<p>Super-socks[.]biz came online around the same time as another domain registered to that &#8220;michdomain&#8221; email: <strong>ip-score[.]com</strong>, which soon became shorthand on several cybercrime forums for a service that could tell visitors whether their Internet address  &#8212; or more precisely, the proxy they were using &#8212;  was flagged by any security software or services as compromised or malicious.</p>
<p>IP-score offered a revenue sharing program for websites that chose to embed its IP-scoring code, and <a href="https://web.archive.org/web/20120501202514/http://www.ip-score.com/userbar" target="_blank" rel="noopener">the copyright on that userbar program</a> was &#8220;<strong>Angry Coders</strong>.&#8221;</p>
<div id="attachment_60739" style="width: 763px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60739" loading="lazy" class="wp-image-60739" src="media/61ecd45c.copyrightac.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/copyrightac.png" alt="" width="753" height="87" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/copyrightac.png 857w, https://krebsonsecurity.com/wp-content/uploads/2022/08/copyrightac-768x89.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/copyrightac-782x90.png 782w" sizes="(max-width: 753px) 100vw, 753px" /><p id="caption-attachment-60739" class="wp-caption-text">A copy of ip-score.com, as indexed by Archive.org.</p></div>
<p>A review of the Internet addresses historically used by Super-socks[.]biz and SocksEscort[.]com reveals that these domains at various times over the years shared an Internet address with a small of other domains, including <strong>angrycoders[.]net</strong>, <strong>iskusnyh[.]pro</strong>, and <strong>kc-shoes[.]ru</strong>.</p>
<p>Cached copies of angrycoders[.]net from the Wayback Machine don&#8217;t reveal much about this particular group of irate programmers, but a search on the domain brings up several now-dormant listings for an Angry Coders based in <a href="https://en.wikipedia.org/wiki/Omsk" target="_blank" rel="noopener">Omsk</a>, a large city in the Siberian region of Russia. The domain was registered in 2010 to an <strong>Oleg Iskushnykh</strong> from Omsk, who used the email address <strong>iboss32@ro.ru</strong>.</p>
<p>According to <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> [currently an advertiser on KrebsOnSecurity], Oleg used the same password from his iboss32@ro.ru account for a slew of other &#8220;iboss&#8221; themed email addresses, one of which is tied to <a href="https://www.linkedin.com/in/oleg-iskusnyh-40300b30/" target="_blank" rel="noopener">a LinkedIn profile for an Oleg Iskhusnyh</a>, who describes himself as a senior web developer living in Nur-Sultan, Kazakhstan.</p>
<p>Iskusnyh&#8217;s <a href="https://github.com/olegisk" target="_blank" rel="noopener">Github profile</a> shows he has contributed code to a number of online payment-related technologies and services, including Ingenico ePayments, Swedbank WooCommerce, Mondido Payments, and Reepay.</p>
<h2>DON&#8217;T JUDGE A MAN UNTIL YOU&#8217;VE WALKED A MILE IN HIS SOCKS</h2>
<p>The various &#8220;iboss&#8221; email accounts appear to have been shared by multiple parties. A search in Constella&#8217;s database of breached entities on &#8220;iboss32@gmail.com&#8221; reveals someone using the name Oleg Iskusnyh registered an online profile using a phone number in Bronx, New York. Pivoting on that phone number &#8212; <strong>17187154415</strong> &#8212; reveals a profile <a href="https://www.wired.com/story/apollo-breach-linkedin-salesforce-data/" target="_blank" rel="noopener">exposed in the breach at sales intelligence firm Apollo</a> with the first name &#8220;Dmitry&#8221; who used the email address <strong>chepurko87@gmail.com</strong>.</p>
<p>That email is connected to <a href="https://www.linkedin.com/in/dmitry-chepurko-043a1283/" target="_blank" rel="noopener">a LinkedIn profile</a> for a <strong>Dmitry Chepurko</strong> in Pavlodar, Kazakhstan. Chepurko&#8217;s resume says he&#8217;s a full stack developer, who most recently worked in the Omsk offices of a German shoe company called <strong>KC Shoes</strong> (the aforementioned kc-shoes.ru]. Chepurko&#8217;s resume says before that he worked on his own for a decade using the freelancing platform <strong>Upwork.</strong></p>
<p>The <a href="https://www.upwork.com/freelancers/~01057453d46a12c8e9" target="_blank" rel="noopener">Upwork profile listed in Chepurko&#8217;s LinkedIn C.V.</a> is no longer active. But that same now-defunct Upwork account link is still listed as the profile of a &#8220;Dmitry C.&#8221; in <a href="https://www.upwork.com/o/companies/~010140e325be1273db/" target="_blank" rel="noopener">an UpWork profile page for the Angry Coders team in Omsk, Russia</a>.</p>
<div id="attachment_60699" style="width: 846px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60699" loading="lazy" class="size-full wp-image-60699" src="media/ebf737f1.angrycoders-upwork.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/angrycoders-upwork.png" alt="" width="836" height="746" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/angrycoders-upwork.png 836w, https://krebsonsecurity.com/wp-content/uploads/2022/08/angrycoders-upwork-768x685.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/angrycoders-upwork-782x698.png 782w" sizes="(max-width: 836px) 100vw, 836px" /><p id="caption-attachment-60699" class="wp-caption-text">The UpWork profile page for the Angry Coders programming team from Omsk, RU.</p></div>
<p>Who is the &#8220;<strong>Alexander S</strong>.&#8221; listed above under the &#8220;Agency members&#8221; heading in the Upwork profile for Angry Coders? Historical DNS records from <a href="https://www.farsightsecurity.com" target="_blank" rel="noopener">Farsight Security</a> show angrycoders.net formerly included the subdomain &#8220;smollalex.angrycoders[.]net&#8221;.</p>
<p>A simple Internet search on &#8220;kc-shoes&#8221; reveals <a href="https://github.com/smollalex?tab=repositories" target="_blank" rel="noopener">a Github account</a> for a user from Omsk with the first name Alexander and the account name &#8220;Smollalex.&#8221; Alexander&#8217;s Github account indicates he has contributed code to the kc-shoes website as well.</p>
<p>Constella&#8217;s service shows that &#8220;Smollalex&#8221; was a favorite handle chosen by an <strong>Alexandr Smolyaninov</strong> from Omsk. The Smollalex Github account associates this individual with <a href="https://web.archive.org/web/20181001232926/http://smollalex.myjino.ru/" target="_blank" rel="noopener">a company in Omsk that sells parts for oil and gas pipelines</a>.</p>
<p>That shoes are apparently the common link among the Angry Coders responsible for SocksEscort is doubly amusing because &#8212; at least according to the posts on some cybercrime forums &#8212; one big reason people turn to these proxy services is for <a href="https://krebsonsecurity.com/2019/08/the-rise-of-bulletproof-residential-networks/" target="_blank" rel="noopener">&#8220;shoe botting&#8221; or &#8220;sneaker bots,&#8221;</a> which refers to the use of automated bot programs and services that aid in the rapid acquisition of limited-release, highly-sought-after designer athletic shoes that can then be resold at huge markups on secondary markets.</p>
<p>It&#8217;s not clear if the Angry Coders team members remain affiliated with SocksEscort; none of them responded to requests for comment. There were certain connections made clear throughout the research mentioned above that the Angry Coders outsourced much of the promotion and support of their proxy service to programmers based in India and Indonesia, where apparently a large chunk of its customers currently reside.</p>
<p>Further reading:</p>
<p>July 29, 2022: <a href="https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/" target="_blank" rel="noopener">911 Proxy Service Implodes After Disclosing Breach</a></p>
<p>July 28, 2022: <a href="https://krebsonsecurity.com/2022/07/breach-exposes-users-of-microleaves-proxy-service/" target="_blank" rel="noopener">Breach Exposes Users of Microleaves Proxy Service</a></p>
<p>July 18, 2022: <a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" target="_blank" rel="noopener">A Deep Dive Into the Residential Proxy Service &#8216;911&#8217;</a></p>
<p>June 28, 2022: <a href="https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/" target="_blank" rel="noopener">The Link Between AWM Proxy &amp; the Glupteba Botnet</a></p>
<p>June 22, 2022: <a href="https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/" target="_blank" rel="noopener">Meet the Administrators of the RSOCKS Proxy Botnet</a></p>
<p>Sept. 1, 2021: <a href="https://krebsonsecurity.com/2021/09/15-year-old-malware-proxy-network-vip72-goes-dark/" target="_blank" rel="noopener">15-Year-Old Malware Proxy Network VIP72 Goes Dark</a></p>


feed_id: https://krebsonsecurity.com/?p=60742
title: Scammers Sent Uber to Take Elderly Lady to the Bank
uri: Scammers-Sent-Uber-to-Take-Elderly-Lady-to-the-Bank
url: https://krebsonsecurity.com/2022/08/scammers-sent-uber-to-take-elderly-lady-to-the-bank/
content:
<p><img src="media/d499e4b5.rideawaits.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/rideawaits.jpg" alt="" width="1000" height="556" class="aligncenter size-full wp-image-60747" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/rideawaits.jpg 1000w, https://krebsonsecurity.com/wp-content/uploads/2022/08/rideawaits-768x427.jpg 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/rideawaits-782x435.jpg 782w" sizes="(max-width: 1000px) 100vw, 1000px" /></p>
<p>Email scammers sent an Uber to the home of an 80-year-old woman who responded to a well-timed email scam, in a bid to make sure she went to the bank and wired money to the fraudsters.  In this case, the woman figured out she was being scammed before embarking for the bank, but her story is a chilling reminder of how far crooks will go these days to rip people off.</p>
<p><strong>Travis Hardaway</strong> is a former music teacher turned <a href="https://readaheadapp.com/" rel="noopener" target="_blank">app developer</a> from Towson, Md. Hardaway said his mother last month replied to an email she received regarding an appliance installation from BestBuy/GeekSquad. Hardaway said the timing of the scam email couldn&#8217;t have been worse: His mom&#8217;s dishwasher had just died, and she&#8217;d paid to have a new one delivered and installed.</p>
<p>&#8220;I think that&#8217;s where she got confused, because she thought the email was about her dishwasher installation,&#8221; Hardaway told KrebsOnSecurity.</p>
<p>Hardaway said his mom initiated a call to the phone number listed in the phony BestBuy email, and that the scammers told her she owed $160 for the installation, which seemed right at the time. Then the scammers asked her to install remote administration software on her computer so that they could control the machine from afar and assist her in making the payment.</p>
<p>After she logged into her bank and savings accounts with scammers watching her screen, the fraudster on the phone claimed that instead of pulling $160 out of her account, they accidentally transferred $160,000 to her account. They said they they needed her help to make sure the money was &#8220;returned.&#8221;</p>
<p>&#8220;They took control of her screen and said they had accidentally transferred $160,000 into her account,&#8221; Hardaway said. &#8220;The person on the phone told her he was going to lose his job over this transfer error, that he didn&#8217;t know what to do. So they sent her some information about where to wire the money, and asked her to go to the bank. But she told them, &#8216;I don&#8217;t drive,&#8217; and they told her, &#8220;No problem, we&#8217;re sending an Uber to come help you to the bank.'&#8221;<span id="more-60742"></span></p>
<p>Hardaway said he was out of town when all this happened, and that thankfully his mom eventually grew exasperated and gave up trying to help the scammers.</p>
<p>&#8220;They told her they were sending an Uber to pick her up and that it was on its way,&#8221; Hardaway said. &#8220;I don&#8217;t know if the Uber ever got there. But my mom went over to the neighbor&#8217;s house and they saw it for what it was &#8212; a scam.&#8221;</p>
<p>Hardaway said he has since wiped her computer, reinstalled the operating system and changed her passwords. But he says the incident has left his mom rattled.</p>
<p>&#8220;She&#8217;s really second-guessing herself now,&#8221; Hardaway said. &#8220;She&#8217;s not computer-savvy, and just moved down here from Boston during COVID to be near us, but she&#8217;s living by herself and feeling isolated and vulnerable, and stuff like this doesn&#8217;t help.&#8221;</p>
<p>According to the <strong>Federal Bureau of Investigation</strong> (FBI), seniors are often targeted because they tend to be trusting and polite. More importantly, they also usually have financial savings, own a home, and have good credit—all of which make them attractive to scammers.</p>
<p>&#8220;Additionally, seniors may be less inclined to report fraud because they don’t know how, or they may be too ashamed of having been scammed,&#8221; the <a href="https://www.fbi.gov/contact-us/field-offices/houston/news/press-releases/elder-fraud-if-a-former-fbicia-director-can-be-targeted-so-can-you" rel="noopener" target="_blank">FBI warned in May</a>. &#8220;They might also be concerned that their relatives will lose confidence in their abilities to manage their own financial affairs. And when an elderly victim does report a crime, they may be unable to supply detailed information to investigators.&#8221;</p>
<p>In 2021, more than 92,000 victims over the age of 60 reported losses of $1.7 billion to the FBI&#8217;s Internet Crime Complaint Center (IC3). The FBI says that represents a 74 percent increase in losses over losses reported in 2020.</p>


feed_id: https://krebsonsecurity.com/?p=60777
title: Class Action Targets Experian Over Account Security
uri: Class-Action-Targets-Experian-Over-Account-Security
url: https://krebsonsecurity.com/2022/08/class-action-targets-experian-over-account-security/
content:
<p>A class action lawsuit has been filed against big-three consumer credit bureau <strong>Experian</strong> over reports that the company did little to prevent identity thieves from hijacking consumer accounts. The legal filing cites liberally from an investigation KrebsOnSecurity published in July, which found that identity thieves were able to assume control over existing Experian accounts simply by signing up for new accounts using the victim’s personal information and a different email address.</p>
<p><img class="aligncenter size-full wp-image-60781" src="media/813a86a4.exp-ca.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/exp-ca.png" alt="" width="700" height="822" /></p>
<p>The lawsuit, filed July 28, 2022 in California Central District Court, argues that Experian&#8217;s documented practice of allowing the re-registration of existing Experian accounts without first verifying that the existing account holder authorized the changes violates the</p>
<p>In July&#8217;s <a href="https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/" target="_blank" rel="noopener">Experian, You Have Some Explaining to Do</a>, we heard from two different readers who had security freezes on their credit files with Experian and who also recently received notifications from Experian that the email address on their account had been changed. So had their passwords and account PIN and secret questions. Both had used password managers to pick and store complex, unique passwords for their accounts.</p>
<p>Both were able to recover access to their Experian account simply by recreating it &#8212; sharing their name, address, phone number, social security number, date of birth, and successfully gleaning or guessing the answers to four multiple choice questions that are almost entirely based on public records (or else information that is not terribly difficult to find).</p>
<p>Here&#8217;s the bit from that story that got excerpted in the class action lawsuit:</p>
<blockquote><p>KrebsOnSecurity sought to replicate Turner and Rishi’s experience — to see if Experian would allow me to re-create my account using my personal information but a different email address. The experiment was done from a different computer and Internet address than the one that created the original account years ago.</p>
<p>After providing my Social Security Number (SSN), date of birth, and answering several multiple choice questions whose answers are derived almost entirely from public records, Experian promptly changed the email address associated with my credit file. It did so without first confirming that new email address could respond to messages, or that the previous email address approved the change.</p>
<p>Experian’s system then sent an automated message to the original email address on file, saying the account’s email address had been changed. The only recourse Experian offered in the alert was to sign in, or send an email to an Experian inbox that replies with the message, “this email address is no longer monitored.”</p>
<p>After that, Experian prompted me to select new secret questions and answers, as well as a new account PIN — effectively erasing the account’s previously chosen PIN and recovery questions. Once I’d changed the PIN and security questions, Experian’s site helpfully reminded me that I have a security freeze on file, and would I like to remove or temporarily lift the security freeze?</p>
<p>To be clear, Experian does have a business unit that sells one-time password services to businesses. While Experian’s system did ask for a mobile number when I signed up a second time, at no time did that number receive a notification from Experian. Also, I could see no option in my account to enable multi-factor authentication for all logins.</p></blockquote>
<p>In response to my story, Experian suggested the reports from readers were isolated incidents, and that the company does all kinds of things it can&#8217;t talk about publicly to prevent bad people from abusing its systems.</p>
<p>“We believe these are isolated incidents of fraud using stolen consumer information,” Experian’s statement reads. “Specific to your question, once an Experian account is created, if someone attempts to create a second Experian account, our systems will notify the original email on file.”</p>
<p>“We go beyond reliance on personally identifiable information (PII) or a consumer’s ability to answer knowledge-based authentication questions to access our systems,” the statement continues. “We do not disclose additional processes for obvious security reasons; however, our data and analytical capabilities verify identity elements across multiple data sources and are not visible to the consumer. This is designed to create a more positive experience for our consumers and to provide additional layers of protection. We take consumer privacy and security seriously, and we continually review our security processes to guard against constant and evolving threats posed by fraudsters.”</p>
<p>That sounds great, but since that story ran I&#8217;ve heard from several more readers who were doing everything right and still had their Experian accounts hijacked, with little left to show for it except an email alert from Experian saying they had changed the address on file for the account.<span id="more-60777"></span></p>
<p>I&#8217;d like to believe this class action lawsuit will change things, but I do not. Likely, the only thing that will come from this lawsuit &#8212; if it is not dismissed outright &#8212; is a fat payout for the plaintiffs&#8217; attorneys and &#8220;free&#8221; credit monitoring for a few years compliments of Experian.</p>
<p>Credit bureaus do not view consumers as customers, who are instead the product that is being sold to third party companies. Often that data is sold based on the interests of the entity purchasing the data, wherein consumer records can be packaged into categories like &#8220;dog owner,&#8221; &#8220;expectant parent,&#8221; or &#8220;diabetes patient.&#8221;</p>
<div id="attachment_60791" style="width: 534px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60791" loading="lazy" class="wp-image-60791 size-full" src="media/f8a85011.expsupport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/expsupport.png" alt="" width="524" height="828" /><p id="caption-attachment-60791" class="wp-caption-text">A chat conversation between the plaintiff and Experian&#8217;s support staff shows he experienced the same account hijack as described by our readers, despite his use of a computer-generated, unique password for his Experian account.</p></div>
<p>Nevertheless, most lenders rely on the big-three consumer credit reporting bureaus, including Equifax, Experian and Trans Union &#8212; to determine everyone&#8217;s credit score, fluctuations in which can make or break one&#8217;s application for a loan or job.</p>
<p>On Tuesday, <em>The Wall Street Journal</em> <a href="https://www.wsj.com/articles/equifax-sent-lenders-inaccurate-credit-scores-on-millions-of-consumers-11659467483" target="_blank" rel="noopener">broke a story</a> saying Equifax sent lenders incorrect credit scores for millions of consumers this spring.</p>
<p>Meanwhile, the credit bureaus keep enjoying record earnings. For its part, Equifax reported <a href="https://www.yahoo.com/now/equifax-delivers-record-revenue-eighth-214000015.html" target="_blank" rel="noopener">a record fourth quarter 2021 revenue of 1.3 billion</a>. Much of that revenue came from its Workforce Solutions business, which <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">sells information about consumer salary histories to a variety of customers</a>.</p>
<p>The Biden administration reportedly wants to create a public entity within the <strong>Consumer Financial Protection Bureau</strong> (CFPB) that would incorporate factors like rent and utility payments into lending decisions. Such a move would require congressional approval but CFPB officials are already discussing how it might be set up, Reuters <a href="https://www.reuters.com/article/us-usa-consumers-credit-scores/fixing-the-credit-catch-22-how-biden-wants-to-make-credit-scores-fairer-idUSKBN2BV1DE" target="_blank" rel="noopener">reported</a>.</p>
<p>&#8220;Credit reporting firms oppose the move, saying they are already working to provide fair and affordable credit to all consumers,&#8221; Reuters wrote. &#8220;A public credit bureau would be bad for consumers because it would expand the government’s power in an inappropriate way and its goals would shift with political winds, the Consumer Data Industry Association (CDIA), which represents private rating firms, said in a statement.&#8221;</p>
<p>A public credit bureau is likely to meet fierce resistance from the Congress&#8217;s most generous constituents &#8212; the banking industry &#8212; which detests rapid change and is heavily reliant on the credit bureaus.</p>
<p>And there is a preview of that fight going on right now over the bipartisan <a href="https://www.congress.gov/bill/117th-congress/house-bill/8152" target="_blank" rel="noopener">American Data Privacy and Protection Act</a>, which <em>The Hill </em>described as one of the most lobbied bills in Congress. The idea behind the bill is that companies can&#8217;t collect any more information from you than they need to provide you with the service you&#8217;re seeking.</p>
<p>&#8220;The bipartisan bill, which represents a breakthrough for lawmakers after years of negotiations, would restrict the kind of data companies can collect from online users and the ways they can use that data,&#8221; <em>The Hill</em> reported Aug. 3. &#8220;Its provisions would impact companies in every consumer-centric industry — including retailers, e-commerce giants, telecoms, credit card companies and tech firms — that compile massive amounts of user data and rely on targeted ads to attract customers.&#8221;</p>
<p>According to the <strong>Electronic Frontier Foundation</strong>, a nonprofit digital rights group, the bill as drafted <a href="https://www.eff.org/deeplinks/2022/07/americans-deserve-more-current-american-data-privacy-protection-act" target="_blank" rel="noopener">falls short in protecting consumers in several areas</a>. For starters, it would override or preempt many kinds of state privacy laws. The EFF argues the bill also would block the <strong>Federal Communications Commission</strong> (FCC) from enforcing federal privacy laws that now apply to cable and satellite TV, and that consumers should still be allowed to sue companies that violate their privacy.</p>
<p>A copy of the class action complaint against Experian is available <a href="media/be527907.DE-1-COMPLAINT.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/DE-1-COMPLAINT.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=60839
title: Microsoft Patch Tuesday, August 2022 Edition
uri: Microsoft-Patch-Tuesday-August-2022-Edition
url: https://krebsonsecurity.com/2022/08/microsoft-patch-tuesday-august-2022-edition/
content:
<p><strong>Microsoft</strong> today released updates to fix a record 141 security vulnerabilities in its <strong>Windows</strong> operating systems and related software. Once again, Microsoft is patching a zero-day vulnerability in the <strong>Microsoft Support Diagnostics Tool</strong> (MSDT), a service built into Windows. Redmond also addressed multiple flaws in <strong>Exchange Server</strong> &#8212; including one that was disclosed publicly prior to today &#8212; and it is urging organizations that use Exchange for email to update as soon as possible and to enable additional protections.</p>
<p><img class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="766" height="507" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 766px) 100vw, 766px" /></p>
<p>In June, Microsoft patched a vulnerability in MSDT dubbed &#8220;<strong>Follina</strong>&#8221; that had been <a href="https://krebsonsecurity.com/2022/06/microsoft-patch-tuesday-june-2022-edition/" target="_blank" rel="noopener">used in active attacks for at least three months prior</a>. This latest MSDT bug &#8212; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-34713" target="_blank" rel="noopener">CVE-2022-34713</a> &#8212; is a remote code execution flaw that requires convincing a target to open a booby-trapped file, such as an Office document. Microsoft this month also issued a different patch for another MSDT flaw, tagged as <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-35743" target="_blank" rel="noopener">CVE-2022-35743</a>.</p>
<p>The publicly disclosed Exchange flaw is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30134" target="_blank" rel="noopener">CVE-2022-30134</a>, which is an information disclosure weakness. Microsoft also released fixes for three other Exchange flaws that rated a &#8220;critical&#8221; label, meaning they could be exploited remotely to compromise the system and with no help from users. Microsoft says addressing some of the Exchange vulnerabilities fixed this month requires administrators to enable Windows Extended protection on Exchange Servers. See <a href="https://techcommunity.microsoft.com/t5/exchange-team-blog/released-august-2022-exchange-server-security-updates/ba-p/3593862" target="_blank" rel="noopener">Microsoft&#8217;s blog post on the Exchange Server updates</a> for more details.</p>
<p>&#8220;If your organization runs local exchange servers, this trio of CVEs warrant an urgent patch,&#8221; said <strong>Kevin Breen</strong>, director of cyber threat research for <strong>Immerse Labs</strong>. &#8220;Exchanges can be treasure troves of information, making them valuable targets for attackers. With <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24477" target="_blank" rel="noopener">CVE-2022-24477</a>, for example, an attacker can gain initial access to a user&#8217;s host and could take over the mailboxes for all exchange users, sending and reading emails and documents. For attackers focused on Business Email Compromise this kind of vulnerability can be extremely damaging.&#8221;</p>
<p>The other two critical Exchange bugs are tracked as <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-24516" target="_blank" rel="noopener">CVE-2022-24516</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21980" target="_blank" rel="noopener">CVE-2022-21980</a>. It&#8217;s difficult to believe it&#8217;s only been a little more than a year since <a href="https://krebsonsecurity.com/2021/03/a-basic-timeline-of-the-exchange-mass-hack/" target="_blank" rel="noopener">malicious hackers worldwide pounced in a bevy of zero-day Exchange vulnerabilities</a> to remotely compromise the email systems for hundreds of thousands of organizations running Exchange Server locally for email. That lingering catastrophe is reminder enough that critical Exchange bugs deserve immediate attention.<span id="more-60839"></span></p>
<p>The <strong>SANS Internet Storm Center</strong>&#8216;s <a href="https://isc.sans.edu/forums/diary/Microsoft%20August%202022%20Patch%20Tuesday/28924/" target="_blank" rel="noopener">rundown on Patch Tuesday</a> warns that a critical remote code execution bug in the Windows Point-to-Point Protocol (<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30133" target="_blank" rel="noopener">CVE-2022-30133</a>) could become &#8220;wormable&#8221; &#8212; a threat capable of spreading across a network without any user interaction.</p>
<p>&#8220;Another critical vulnerability worth mentioning is an elevation of privilege affecting Active Directory Domain Services (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2022-34691">CVE-2022-34691</a>),&#8221; SANS wrote. &#8220;According to the advisory, &#8216;An authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow elevation of privilege to System.&#8217; A system is vulnerable only if Active Directory Certificate Services is running on the domain. <strong>The CVSS for this vulnerability is 8.8</strong>.&#8221;</p>
<p>Breen highlighted a set of four vulnerabilities in <strong>Visual Studio</strong> that earned Microsoft&#8217;s less-dire &#8220;important&#8221; rating but that nevertheless could be vitally important for the security of developer systems.</p>
<p>&#8220;Developers are empowered with access to API keys and deployment pipelines that, if compromised, could be significantly damaging to organizations,&#8221; he said. &#8220;So it’s no surprise they are often targeted by more advanced attackers. Patches for their tools should not be overlooked. We’re seeing a continued trend of supply-chain compromise too, making it vital that we ensure developers, and their tools, are kept up-to-date with the same rigor we apply to standard updates.&#8221;</p>
<p><strong>Greg Wiseman</strong>, product manager at <strong>Rapid7</strong>, pointed to an interesting bug Microsoft patched in <strong>Windows Hello</strong>, the biometric authentication mechanism for Windows 10.  Microsoft notes that the successful exploitation of the weakness requires physical access to the target device, but would allow an attacker to bypass a facial recognition check.</p>
<p>Wiseman said despite the record number of vulnerability fixes from Redmond this month, the numbers are slightly less dire.</p>
<p>&#8220;20 CVEs affect their <strong>Chromium-based Edge</strong> browser and 34 affect <strong>Azure Site Recovery</strong> (up from 32 CVEs affecting that product last month),&#8221; Wiseman wrote. &#8220;As usual, OS-level updates will address a lot of these, but note that some extra configuration is required to fully protect Exchange Server this month.&#8221;</p>
<p>As it often does on Patch Tuesday, <strong>Adobe</strong> has also released security updates for many of its products, including <strong>Acrobat</strong> and <strong>Reader</strong>, <strong>Adobe Commerce</strong> and <strong>Magento Open Source</strong>. More details <a href="https://helpx.adobe.com/security.html" target="_blank" rel="noopener">here</a>.</p>
<div class="entry-content">
<p>Please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.</p>
</div>


feed_id: https://krebsonsecurity.com/?p=60800
title: The Security Pros and Cons of Using Email Aliases
uri: The-Security-Pros-and-Cons-of-Using-Email-Aliases
url: https://krebsonsecurity.com/2022/08/the-security-pros-and-cons-of-using-email-aliases/
content:
<p>One way to tame your email inbox is to get in the habit of using unique email aliases when signing up for new accounts online. Adding a &#8220;+&#8221; character after the username portion of your email address &#8212; followed by a notation specific to the site you&#8217;re signing up at &#8212; lets you create an infinite number of unique email addresses tied to the same account. Aliases can help users detect breaches and fight spam. But not all websites allow aliases, and they can complicate account recovery. Here&#8217;s a look at the pros and cons of adopting a unique alias for each website.</p>
<p><img class="aligncenter size-full wp-image-60853" src="media/4d779dc0.emailplus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/emailplus.png" alt="" width="587" height="586" /></p>
<p>What is an email alias? When you sign up at a site that requires an email address, think of a word or phrase that represents that site for you, and then add that prefaced by a &#8220;+&#8221; sign just to the left of the “@” sign in your email address. For instance, if I were signing up at example.com, I might give my email address as krebsonsecurity+example@gmail.com. Then, I simply go back to my inbox and create a corresponding folder called &#8220;Example,&#8221; along with a new filter that sends any email addressed to that alias to the Example folder.</p>
<p>Importantly, you don&#8217;t ever use this alias anywhere else. That way, if anyone other than example.com starts sending email to it, it is reasonable to assume that example.com either shared your address with others or that it got hacked and relieved of that information. Indeed, security-minded readers have often alerted KrebsOnSecurity about spam to specific aliases that suggested a breach at some website, and usually they were right, even if the company that got hacked didn&#8217;t realize it at the time.</p>
<p><strong>Alex Holden</strong>, founder of the Milwaukee-based cybersecurity consultancy <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, said many threat actors will scrub their distribution lists of any aliases because there is a perception that these users are more security- and privacy-focused than normal users, and are thus more likely to report spam to their aliased addresses.</p>
<p>Holden said freshly-hacked databases also are often scrubbed of aliases before being sold in the underground, meaning the hackers will simply remove the aliased portion of the email address.</p>
<p>&#8220;I can tell you that certain threat groups have rules on &#8216;+*@&#8217; email address deletion,&#8221; Holden said. &#8220;We just got the largest credentials cache ever &#8212; 1 billion new credentials to us &#8212; and most of that data is altered, with aliases removed. Modifying credential data for some threat groups is normal. They spend time trying to understand the database structure and removing any red flags.&#8221;</p>
<p>Why might spamming aliases be a bad idea? According to the breach tracking site <strong>HaveIBeenPwned.com</strong>, <a href="https://haveibeenpwned.uservoice.com/forums/275398-general/suggestions/6774229-enable-search-and-notifications-for-email-addresse" target="_blank" rel="noopener">only about .03 percent of the breached records in circulation today include an alias</a>. </p>
<p>Email aliases are rare enough that seeing just a few email addresses with the same alias in a breached database can make it trivial to identify which company likely got hacked and leaked said database. That&#8217;s because the most common aliases are simply the name of the website where the signup takes place, or some abbreviation or shorthand for it.</p>
<p>Hence, for a given database, if there are more than a handful of email addresses that have the same alias, the chances are good that whatever company or website corresponds to that alias has been hacked. <span id="more-60800"></span></p>
<p>That might explain the actions of <strong>Allekabels</strong>, a large Dutch electronics web shop that suffered a data breach in 2021. Allekabels said a former employee had stolen data on 5,000 customers, and that those customers were then informed about the data breach by Allekabels.</p>
<p>But Dutch publication <em>RTL Nieuws</em> said it obtained a copy of the Allekabels user database from a hacker who was selling information on 3.6 million customers at the time, and found that the 5,000 number cited by the retailer corresponded to the number of customers who&#8217;d signed up using an alias. In essence, RTL argued, the company had notified only those most likely to notice and complain that their aliased addresses were suddenly receiving spam.</p>
<p>&#8220;RTL Nieuws has called more than thirty people from the database to check the leaked data,&#8221; the publication <a href="https://www.rtlnieuws.nl/tech/artikel/5212318/allekabels-gehackt-privegegevens-miljoenen-nederlanders-op-straat" target="_blank" rel="noopener">explained</a>. &#8220;The customers with such a unique email address have all received a message from Allekabels that their data has been leaked &#8211; according to Allekabels they all happened to be among the 5000 data that this ex-employee had stolen.&#8221;</p>
<p>HaveIBeenPwned&#8217;s Hunt arrived at the conclusion that aliases account for about .03 percent of registered email addresses by studying <a href="https://krebsonsecurity.com/2013/10/adobe-breach-impacted-at-least-38-million-users/" target="_blank" rel="noopener">the data leaked in the 2013 breach at Adobe</a>, which affected at least 38 million users. Allekabels&#8217;s ratio of aliased users was considerably higher than Adobe&#8217;s &#8212; .14 percent &#8212; but then again European Internet users tend to be more privacy-conscious.</p>
<p>While overall adoption of email aliases is still quite low, that may be changing. Apple customers who use iCloud to sign up for new accounts online automatically are prompted to use Apple&#8217;s <a href="https://support.apple.com/en-us/HT210425" target="_blank" rel="noopener">Hide My Email</a> feature, which creates the account using a unique email address that automatically forwards to a personal inbox.</p>
<p>What are the downsides to using email aliases, apart from the hassle of setting them up? The biggest downer is that many sites won&#8217;t let you use a &#8220;+&#8221; sign in your email address, even though this functionality is clearly spelled out in the email standard.</p>
<p>Also, if you use aliases, it helps to have a reliable mnemonic to remember the alias used for each account (this is a non-issue if you create a new folder or rule for each alias). That&#8217;s because knowing the email address for an account is generally a prerequisite for resetting the account&#8217;s password, and if you can&#8217;t remember the alias you added way back when you signed up, you may have limited options for recovering access to that account if you at some point forget your password.</p>
<p>What about you, Dear Reader? Do you rely on email aliases? If so, have they been useful? Did I neglect to mention any pros or cons? Feel free to sound off in the comments below.</p>


feed_id: https://krebsonsecurity.com/?p=60877
title: It Might Be Our Data, But It’s Not Our Breach
uri: It-Might-Be-Our-Data-But-It-s-Not-Our-Breach
url: https://krebsonsecurity.com/2022/08/it-might-be-our-data-but-its-not-our-breach/
content:
<div id="attachment_60910" style="width: 739px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60910" class="size-full wp-image-60910" src="media/1caa2de7.mysterydb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/mysterydb.png" alt="" width="729" height="414" /><p id="caption-attachment-60910" class="wp-caption-text">Image: Shutterstock.</p></div>
<p>A cybersecurity firm says it has intercepted a large, unique stolen data set containing the names, addresses, email addresses, phone numbers, Social Security Numbers and dates of birth on nearly 23 million Americans. The firm&#8217;s analysis of the data suggests it corresponds to current and former customers of <strong>AT&amp;T</strong>. The telecommunications giant stopped short of saying the data wasn&#8217;t theirs, but it maintains the records do not appear to have come from its systems and may be tied to a previous data incident at another company.</p>
<p>Milwaukee-based cybersecurity consultancy <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a> said it intercepted a 1.6 gigabyte compressed file on a popular dark web file-sharing site. The largest item in the archive is a 3.6 gigabyte file called &#8220;dbfull,&#8221; and it contains 28.5 million records, including 22.8 million unique email addresses and 23 million unique SSNs. There are no passwords in the database.</p>
<p>Hold Security founder <strong>Alex Holden</strong> said a number of patterns in the data suggest it relates to AT&amp;T customers. For starters, email addresses ending in &#8220;<strong>att.net</strong>&#8221; accounted for 13.7 percent of all addresses in the database, with addresses from <strong>SBCGLobal.net</strong> and <strong>Bellsouth.net </strong>&#8212; both AT&amp;T companies &#8212; making up another seven percent. In contrast, <strong>Gmail</strong> users made up more than 30 percent of the data set, with <strong>Yahoo</strong> addresses accounting for 24 percent. More than 10,000 entries in the database list &#8220;none@att.com&#8221; in the email field.</p>
<div id="attachment_60881" style="width: 563px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60881" loading="lazy" class="size-full wp-image-60881" src="media/747a67dc.emailbyprovider.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/emailbyprovider.png" alt="" width="553" height="331" /><p id="caption-attachment-60881" class="wp-caption-text">Hold Security found these email domains account for 87% of all domains in the data set. Nearly 21% belonged to AT&amp;T customers.</p></div>
<p>Holden&#8217;s team also examined the number of email records that <a href="https://krebsonsecurity.com/2022/08/the-security-pros-and-cons-of-using-email-aliases/" target="_blank" rel="noopener">included an alias in the username portion of the email</a>, and found 293 email addresses with plus addressing. Of those, 232 included an alias that indicated the customer had signed up at some AT&amp;T property; 190 of the aliased email addresses were &#8220;<strong>+att@&#8221;; </strong>42 were &#8220;<strong>+uverse@</strong>,&#8221; an oddly specific reference to a DirecTV/AT&amp;T entity that included broadband Internet. In September 2016, AT&amp;T <a href="https://www.att.com/internet/u-verse/" target="_blank" rel="noopener">rebranded U-verse</a> as <strong>AT&amp;T Internet</strong>.</p>
<p>According to its website, AT&amp;T Internet is offered <a href="https://www.att.com/local/internet" target="_blank" rel="noopener">in 21 states</a>, including Alabama, Arkansas, California, Florida, Georgia, Indiana, Kansas, Kentucky, Louisiana, Michigan, Missouri, Nevada, North Carolina, Ohio, Oklahoma, Tennessee, Texas and Wisconsin. Nearly all of the records in the database that contain a state designation corresponded to those 21 states; all other states made up just 1.64 percent of the records, Hold Security found.</p>
<div id="attachment_60882" style="width: 273px" class="wp-caption alignright"><img aria-describedby="caption-attachment-60882" loading="lazy" class="size-full wp-image-60882" src="media/777df31f.data-states.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/data-states.png" alt="" width="263" height="501" /><p id="caption-attachment-60882" class="wp-caption-text">Image: Hold Security.</p></div>
<p>The vast majority of records in this database belong to consumers, but almost 13,000 of the entries are for corporate entities. Holden said 387 of those corporate names started with &#8220;ATT,&#8221; with various entries like &#8220;ATT PVT XLOW&#8221; appearing 81 times. And most of the addresses for these entities are AT&amp;T corporate offices.</p>
<p>How old is this data? One clue may be in the dates of birth exposed in this database. There are very few records in this file with dates of birth after 2000.</p>
<p>&#8220;Based on these statistics, we see that the last significant number of subscribers born in March of 2000,&#8221; Holden told KrebsOnSecurity, noting that AT&amp;T requires new account holders to be 18 years of age or older. &#8220;Therefore, it makes sense that the dataset was likely created close to March of 2018.&#8221;</p>
<p>There was also this anomaly: Holden said one of his analysts is an AT&amp;T customer with a 13-letter last name, and that her AT&amp;T bill has always had the same unique misspelling of her surname (they added yet another letter). He said the analyst&#8217;s name is identically misspelled in this database.</p>
<p>KrebsOnSecurity shared the large data set with AT&amp;T, as well as Hold Security&#8217;s analysis of it. AT&amp;T ultimately declined to say whether all of the people in the database are or were at some point AT&amp;T customers. The company said the data appears to be several years old, and that &#8220;it&#8217;s not immediately possible to determine the percentage that may be customers.&#8221;</p>
<p>&#8220;This information does not appear to have come from our systems,&#8221; AT&amp;T said in a written statement. &#8220;It may be tied to a previous data incident at another company. It is unfortunate that data can continue to surface over several years on the dark web. However, customers often receive notices after such incidents, and advice for ID theft is consistent and can be found online.&#8221;</p>
<p>The company declined to elaborate on what they meant by &#8220;a previous data incident at another company.&#8221;</p>
<p>But it seems likely that this database is related to one that went up for sale on a hacker forum on August 19, 2021. That auction ran with the title &#8220;<strong>AT&amp;T Database +70M (SSN/DOB)</strong>,&#8221; and was offered by <a href="https://en.wikipedia.org/wiki/ShinyHunters" target="_blank" rel="noopener">ShinyHunters</a>, a well-known threat actor with a long history of compromising websites and developer repositories to steal credentials or API keys.<span id="more-60877"></span></p>
<div id="attachment_60893" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60893" loading="lazy" class=" wp-image-60893" src="media/25b796dc.shinyatt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/shinyatt.png" alt="" width="749" height="634" /><p id="caption-attachment-60893" class="wp-caption-text">Image: BleepingComputer</p></div>
<p>ShinyHunters established the starting price for the auction at $200,000, but set the &#8220;flash&#8221; or &#8220;buy it now&#8221; price at $1 million. The auction also included a small sampling of the stolen information, but that sample is no longer available. The hacker forum where the ShinyHunters sales thread existed <a href="https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/" target="_blank" rel="noopener">was seized by the FBI in April, and its alleged administrator arrested</a>.</p>
<p>But cached copies of the auction, as recorded by cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, show ShinyHunters received bids of up to $230,000 for the entire database before they suspended the sale.</p>
<p>&#8220;This thread has been deleted several times,&#8221; ShinyHunters wrote in their auction discussion on Sept. 6, 2021. &#8220;Therefore, the auction is suspended. AT&amp;T will be available on WHM as soon as they accept new vendors.&#8221;</p>
<p>The WHM initialism was a reference to the <strong>White House Market</strong>, a dark web marketplace that <a href="https://therecord.media/dark-web-marketplace-white-house-market-shuts-down/" target="_blank" rel="noopener">shut down in October 2021</a>.</p>
<p>&#8220;In many cases, when a database is not sold, ShinyHunters will release it for free on hacker forums,&#8221; wrote BleepingComputer&#8217;s <strong>Lawrence Abrams</strong>, who <a href="https://www.bleepingcomputer.com/news/security/atandt-denies-data-breach-after-hacker-auctions-70-million-user-database/" target="_blank" rel="noopener">broke the news of the auction</a> last year and confronted AT&amp;T about the hackers&#8217; claims.</p>
<p>AT&amp;T gave Abrams a similar statement, saying the data didn&#8217;t come from their systems.</p>
<p>&#8220;When asked whether the data may have come from a third-party partner, AT&amp;T chose not to speculate,&#8221; Abrams wrote. &#8220;&#8216;Given this information did not come from us, we can&#8217;t speculate on where it came from or whether it is valid,'&#8221; AT&amp;T told BleepingComputer.</p>
<p>Asked to respond to AT&amp;T&#8217;s denial, ShinyHunters told BleepingComputer at the time, &#8220;I don&#8217;t care if they don&#8217;t admit. I&#8217;m just selling.&#8221;</p>
<p>On June 1, 2022, a 21-year-old Frenchman <a href="https://www.databreaches.net/alleged-member-of-shinyhunters-held-in-morocco-on-interpol-red-notice-u-s-seeking-extradition-reports/" target="_blank" rel="noopener">was arrested in Morocco</a> for allegedly being a member of ShinyHunters. Databreaches.net <a href="https://www.databreaches.net/members-of-gnosticplayers-arrested-and-charged-as-members-of-shinyhunters/" target="_blank" rel="noopener">reports</a> the defendant was arrested on an Interpol &#8220;Red Notice&#8221; at the request of a U.S. federal prosecutor from Washington state.</p>
<p>Databreaches.net suggests the warrant could be tied to a ShinyHunters theft in May 2020, when the group announced they had <a href="https://www.wired.com/story/shinyhunters-hacking-group-data-breach-spree/" target="_blank" rel="noopener">exfiltrated 500 GB of Microsoft&#8217;s source code from Microsoft&#8217;s private GitHub repositories</a>.</p>
<p>&#8220;Researchers assess that Shiny Hunters gained access to roughly 1,200 private repositories around March 28, 2020, which have since been secured,&#8221; reads <a href="https://www.cyber.nj.gov/alerts-advisories/microsoft-github/" target="_blank" rel="noopener">a May 2020 alert</a> posted by the <strong>New Jersey Cybersecurity &amp; Communications Integration Cell</strong>, a component within the New Jersey Office of Homeland Security and Preparedness.</p>
<p>&#8220;Though the breach was largely dismissed as insignificant, some images of the directory listing appear to contain source code for Azure, Office, and some Windows runtimes, and concerns have been raised regarding access to private API keys or passwords that may have been mistakenly included in some private repositories,&#8221; the alert continues. &#8220;Additionally, Shiny Hunters is flooding dark web marketplaces with breached databases.&#8221;</p>
<p>Last month, <strong>T-Mobile</strong> <a href="https://techcrunch.com/2022/07/22/t-mobile-will-pay-out-350m-to-customers-in-data-breach-settlement/" target="_blank" rel="noopener">agreed to pay $350 million</a> to settle a consolidated class action lawsuit over <a href="https://krebsonsecurity.com/2021/08/t-mobile-investigating-claims-of-massive-data-breach/" target="_blank" rel="noopener">a breach in 2021 that affected 40 million current and former customers</a>. The breach came to light on Aug. 16, 2021, when someone starting selling tens of millions of SSN/DOB records from T-Mobile on the same hacker forum where the ShinyHunters would post their auction for the claimed AT&amp;T database just three days later.</p>
<p>T-Mobile has not disclosed many details about the &#8220;how&#8221; of last year&#8217;s breach, but it <a href="https://www.t-mobile.com/news/network/cyberattack-against-tmobile-and-our-customers" target="_blank" rel="noopener">said</a> the intruder(s) &#8220;leveraged their knowledge of technical systems, along with specialized tools and capabilities, to gain access to our testing environments and then used brute force attacks and other methods to make their way into other IT servers that included customer data.&#8221;</p>
<div id="attachment_56617" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-56617" loading="lazy" class=" wp-image-56617" src="media/42ff915a.tmob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/08/tmob.png" alt="" width="750" height="719" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/08/tmob.png 855w, https://krebsonsecurity.com/wp-content/uploads/2021/08/tmob-768x737.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/08/tmob-782x750.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-56617" class="wp-caption-text">A sales thread tied to the stolen T-Mobile customer data.</p></div>


