# articles

feed_id: https://krebsonsecurity.com/?p=50137
title: Alleged Member of Neo-Nazi Swatting Group Charged
uri: Alleged-Member-of-Neo-Nazi-Swatting-Group-Charged
url: https://krebsonsecurity.com/2020/01/alleged-member-of-neo-nazi-swatting-group-charged/
content:
<p>Federal investigators on Friday arrested a Virginia man accused of being part of a neo-Nazi group that targeted hundreds of people in &#8220;swatting&#8221; attacks, wherein fake bomb threats, hostage situations and other violent scenarios were phoned in to police as part of a scheme to trick them into visiting potentially deadly force on a target&#8217;s address.</p>
<p>In July 2018, KrebsOnSecurity published the story <a href="https://krebsonsecurity.com/2019/07/neo-nazi-swatters-target-dozens-of-journalists/" target="_blank" rel="noopener">Neo-Nazi Swatters Target Dozens of Journalists</a>, which detailed the activities of a loose-knit group of individuals who had targeted hundreds of individuals for swatting attacks, including federal judges, corporate executives and almost three-dozen journalists (myself included).</p>
<div id="attachment_50144" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/34c5f313.dblatest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/dblatest.png"><img class="wp-image-50144" src="media/34c5f313.dblatest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/dblatest.png" alt="" width="592" height="282" /></a><p class="wp-caption-text">A portion of the Doxbin, as it existed in late 2019.</p></div>
<p>An FBI affidavit unsealed this week identifies one member of the group as <strong>John William Kirby Kelley</strong>. According to the affidavit, Kelley was instrumental in setting up and maintaining the Internet Relay Chat (IRC) channel called &#8220;<strong>Deadnet</strong>&#8221; that was used by he and other co-conspirators to plan, carry out and document their swatting attacks.</p>
<p>Prior to his recent expulsion on drug charges, Kelley was a student studying cybersecurity at <strong>Old Dominion University</strong> in Norfolk, Va. Interestingly, investigators allege it was Kelley&#8217;s decision to swat his own school in late November 2018 that got him caught. Using the handle &#8220;Carl,&#8221; Kelley allegedly explained to fellow Deadnet members he hoped the swatting would get him out of having to go to class.</p>
<p>The FBI says Kelley used virtual private networking (VPN) services to hide his true Internet location and various voice-over-IP (VoIP) services to conduct the swatting calls. In the ODU incident, investigators say Kelley told ODU police that someone was armed with an AR-15 rifle and had placed multiple pipe bombs within the campus buildings.</p>
<p>Later that day, Kelley allegedly called ODU police again but forgot to obscure his real phone number on campus, and quickly apologized for making an accidental phone call. When authorities determined that the voice on the second call matched that from the bomb threat earlier in the day, they visited and interviewed the young man.</p>
<p>Investigators say Kelley admitted to participating in swatting calls previously, and consented to a search of his dorm room, wherein they found two phones, a laptop and various electronic storage devices.</p>
<p>The affidavit says one of the thumbs drive included multiple documents that logged statements made on the Deadnet IRC channel, which chronicled &#8220;countless examples of swatting activity over an extended period of time.&#8221; Those included videos Kelley allegedly recorded of his computer screen which showed live news footage of police responding to swatting attacks while he and other Deadnet members discussed the incidents in real-time on their IRC forum.</p>
<p>The FBI believes Kelley also was linked to a bomb threat incident in November 2018 at the predominantly African American Alfred Baptist Church in Old Town Alexandria, an incident that led to the church being evacuated during evening worship services while authorities swept the building for explosives.</p>
<p>The FBI affidavit was based in part on interviews with an unnamed co-conspirator, who told investigators that he and the others on Deadnet IRC are white supremacists and sympathetic to the neo-Nazi movement.</p>
<p>&#8220;The group&#8217;s neo-Nazi ideology is apparent in the racial tones throughout the conversation logs,&#8221; the affidavit reads. &#8220;Kelley and other co-conspirators are affiliated with or have expressed sympathy for Atomwafen Division,&#8221; an extremist group whose members are suspected of having committed multiple murders in the U.S. since 2017.<span id="more-50137"></span></p>
<p>Investigators say on one of Kelley&#8217;s phones they found a photo of he and others in tactical gear holding automatic weapons next to pictures of Atomwaffen recruitment material and the neo-Nazi publication Siege.</p>
<p>As I reported last summer, several Deadnet members maintained a site on the Dark Web called the “<strong>Doxbin</strong>,” which listed the names, addresses, phone number and often known IP addresses, Social Security numbers, dates of birth and other sensitive information on hundreds of people — and in some cases the personal information of the target’s friends and family. After those indexed on the Doxbin were successfully swatted, a blue gun icon would be added next to the person&#8217;s name.</p>
<p>One of the core members of the group on Deadnet &#8212; an individual who used the nickname &#8220;<strong>Chanz</strong>,&#8221; among others &#8212; stated that he was responsible for maintaining SiegeCulture, a white supremacist Web site that glorifies the writings of neo-Nazi James Mason (whose various books call on followers to start a violent race war in the United States).</p>
<p>Deadnet chat logs obtained by KrebsOnSecurity show that another key swatting suspect on Deadnet who used the handle &#8220;<strong>Zheme</strong>&#8221; told other IRC members in March 2019 that one of his friends had recently been raided by federal investigators for allegedly having connections to the person responsible for the <a href="https://en.wikipedia.org/wiki/Pittsburgh_synagogue_shooting" target="_blank" rel="noopener">mass shooting in October 2018 at the Tree of Life Jewish synagogue in Pittsburgh</a>.</p>
<p>At one point last year, Zheme also reminded denizens of Deadnet about a court hearing in <a href="https://www.propublica.org/article/atomwaffen-division-inside-white-hate-group" target="_blank" rel="noopener">the murder trial of Sam Woodward</a>, an alleged Atomwaffen member who&#8217;s been charged with killing a 19-year-old gay Jewish college student.</p>
<p>As reported by this author last year, Deadnet members targeted dozens of journalists whose writings they considered threatening to their worldviews. Indeed, one of the targets successfully swatted by Deadnet members was Pulitzer prize winning columnist <a href="https://eu.usatoday.com/story/news/2019/07/01/fake-911-call-columnist-leonard-pitts-targeted-swatting-incident/1616269001" target="_blank" rel="noopener">Leonard G. Pitts Jr.</a>, whose personal information as listed on the Doxbin was annotated with a blue gun icon and the label &#8220;anti-white race/politics writer.&#8221;</p>
<p>In another Deadnet chat log seen by this author, Chanz admits to <a href="https://www.reddit.com/r/MensRights/comments/4m6wgp/bomb_threat_ends_milo_yiannopoulos_event_at_ucla/" target="_blank" rel="noopener">calling in a bomb threat at the UCLA campus</a> following a speech by <a href="https://en.wikipedia.org/wiki/Milo_Yiannopoulos" target="_blank" rel="noopener">Milo Yiannopoulos</a>. Chanz bragged that he did it to frame feminists at the school for acts of terrorism.</p>
<p>On a personal note, I sincerely hope this arrest is just the first of many to come for those involved in swatting attacks related to Deadnet and the Doxbin. KrebsOnSecurity has obtained information indicating that several members of my family also have been targeted for harassment and swatting by this group.</p>
<p>Finally, it&#8217;s important to note that while many people may assume that murders and mass shootings targeting people because of their race, gender, sexual preference or religion are carried out by so-called &#8220;lone wolf&#8221; assailants, the swatting videos created and shared by Deadnet members are essentially propaganda that hate groups can use to recruit new members to their cause.</p>
<p><em>The Washington Post</em> reports that Kelley had his first appearance in federal court in Alexandria, Va. on Friday.</p>
<p>&#8220;His public defender did not comment on the allegations but said his client has &#8216;very limited funds,'&#8221; The Post&#8217;s courts reporter <strong>Rachel Weiner</strong> <a href="https://www.washingtonpost.com/local/public-safety/doj-says-neo-nazi-group-used-swatting-to-target-officials-journalists-church/2020/01/10/e9692346-33b5-11ea-91fd-82d4e04a3fac_story.html" target="_blank" rel="noopener">wrote</a>.</p>
<p>The charge against Kelley of conspiracy to make threats carries up to five years in prison. The affidavit in Kelley&#8217;s arrest is available <a href="media/4629e6e1.gov.uscourts.vaed.464952.2.0.pdf" data-original-source="https://www.courtlistener.com/recap/gov.uscourts.vaed.464952/gov.uscourts.vaed.464952.2.0.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=50155
title: Phishing for Apples, Bobbing for Links
uri: Phishing-for-Apples-Bobbing-for-Links
url: https://krebsonsecurity.com/2020/01/phishing-for-apples-bobbing-for-links/
content:
<p>Anyone searching for a primer on how to spot clever phishing links need look no further than those targeting customers of <strong>Apple</strong>, whose brand by many measures remains among <a href="https://www.scmagazine.com/home/security-news/apple-most-referenced-brand-in-phishing-attacks-says-area-1/" target="_blank" rel="noopener">the most-targeted</a>. Past stories here have examined how scammers working with organized gangs <a href="https://krebsonsecurity.com/2017/03/if-your-iphone-is-stolen-these-guys-may-try-to-iphish-you/" target="_blank" rel="noopener">try to phish iCloud credentials from Apple customers who have a mobile device that is lost or stolen</a>. Today&#8217;s piece looks at the well-crafted links used in some of these lures.</p>
<p>KrebsOnSecurity heard from a reader in South Africa who recently received a text message stating his lost iPhone X had been found. The message addressed him by name and said he could view the location of his wayward device by visiting the link <strong>https://maps-icloud[.]com</strong> &#8212; which is most definitely not a legitimate Apple or iCloud link and is one of countless spoofing Apple&#8217;s &#8220;Find My&#8221; service for locating lost Apple devices.</p>
<p><img class="aligncenter size-full wp-image-50160" src="media/76e33f79.findmyphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/findmyphish.png" alt="" width="462" height="731" /></p>
<p>While maps-icloud[.]com is not a particularly convincing phishing domain, a review of the Russian server where that domain is hosted reveals a slew of far more persuasive links spoofing Apple&#8217;s brand. Almost all of these include encryption certificates (start with &#8220;https://) and begin with the subdomains &#8220;apple.&#8221; or &#8220;icloud.&#8221; followed by a domain name starting with &#8220;com-&#8220;.</p>
<p>Here are just a few examples (the phishing links in this post have been hobbled with brackets to keep them from being clickable):</p>
<p>apple.com-support[.]id<br />
apple.com-findlocation[.]id<br />
apple.com-sign[.]in<br />
apple.com-isupport[.]in<br />
icloud.com-site-log[.]in</p>
<p>Savvy readers here no doubt already know this, but to find the true domain referenced in a link, look to the right of &#8220;http(s)://&#8221; until you encounter the first forward slash (/). The domain directly to the left of that first slash is the true destination; anything that precedes the second dot to the left of that first slash is a subdomain and should be ignored for the purposes of determining the true domain name.</p>
<p>For instance, in the case of the imaginary link below, example.com is the true destination, not apple.com:</p>
<p>https://www.apple.com.example.com/findmyphone/</p>
<p>Of course, any domain can be used as a redirect to any other domain. Case in point: Targets of the phishing domains above who are undecided on whether the link refers to a legitimate Apple site might seek to load the base domain into a Web browser (minus the customization in the remainder of the link after the first forward slash). To assuage such concerns, the phishers in this case will forward anyone visiting those base domains to Apple&#8217;s legitimate iCloud login page (icloud.com).</p>
<p>The best advice to sidestep phishing scams is to avoid clicking on links that arrive unbidden in emails, text messages and other mediums. Most phishing scams invoke a temporal element that warns of dire consequences should you fail to respond or act quickly. If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually &#8212; ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>


feed_id: https://krebsonsecurity.com/?p=50171
title: Cryptic Rumblings Ahead of First 2020 Patch Tuesday
uri: Cryptic-Rumblings-Ahead-of-First-2020-Patch-Tuesday
url: https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/
content:
<p>Sources tell KrebsOnSecurity that <strong>Microsoft Corp.</strong> is slated to release a software update on Tuesday to fix an extraordinarily serious security vulnerability in a core cryptographic component present in all versions of <strong>Windows</strong>. Those sources say Microsoft has quietly shipped a patch for the bug to branches of the U.S. military and to other high-value customers/targets that manage key Internet infrastructure, and that those organizations have been asked to sign agreements preventing them from disclosing details of the flaw prior to Jan. 14, the first Patch Tuesday of 2020.</p>
<p>According to sources, the vulnerability in question resides in a Windows component known as <a href="https://docs.microsoft.com/en-us/windows/win32/seccrypto/crypt32-dll-versions" target="_blank" rel="noopener">crypt32.dll</a>, a Windows module that Microsoft says handles &#8220;certificate and cryptographic messaging functions in the CryptoAPI.&#8221; The <a href="https://en.wikipedia.org/wiki/Microsoft_CryptoAPI" target="_blank" rel="noopener">Microsoft CryptoAPI</a> provides services that enable developers to secure Windows-based applications using cryptography, and includes functionality for encrypting and decrypting data using digital certificates.</p>
<p>A critical vulnerability in this Windows component could have wide-ranging security implications for a number of important Windows functions, including authentication on Windows desktops and servers, the protection of sensitive data handled by Microsoft&#8217;s Internet Explorer/Edge browsers, as well as a number of third-party applications and tools.</p>
<p>Equally concerning, a flaw in crypt32.dll <em>might also be abused to spoof the digital signature tied to a specific piece of software</em>. Such a weakness could be exploited by attackers to make malware appear to be a benign program that was produced and signed by a legitimate software company.</p>
<p><img class="aligncenter wp-image-50177" src="media/10150a9b.dormanntweet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/dormanntweet.png" alt="" width="592" height="337" /></p>
<p>This component was introduced into Windows more than 20 years ago &#8212; back in <a href="https://en.wikipedia.org/wiki/Windows_NT_4.0" target="_blank" rel="noopener">Windows NT 4.0</a>. Consequently, all versions of Windows are likely affected (including Windows XP, which is no longer being supported with patches from Microsoft).</p>
<p>Microsoft has not yet responded to requests for comment. However, KrebsOnSecurity has heard rumblings from several sources over the past 48 hours that this Patch Tuesday (tomorrow) will include a doozy of an update that will need to be addressed immediately by all organizations running Windows.</p>
<p><strong>Update 7:49 p.m. ET:</strong> Microsoft responded, saying that it does not discuss the details of reported vulnerabilities before an update is available. The company also said it does &#8220;not release production-ready updates ahead of regular Update Tuesday schedule. &#8220;Through our <a href="https://nam02.safelinks.protection.outlook.com/?url=https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fwindows-it-pro-blog%2Fwhat-is-the-security-update-validation-program%2Fba-p%2F275767&amp;data=02%7C01%7Crrichendrfer%40we-worldwide.com%7C7c1962181af14948100008d798881a19%7C3ed60ab455674971a5341a5f0f7cc7f5%7C0%7C0%7C637145582629945152&amp;sdata=1JcBcxNgCssbGwpcMQ6M0tsWdOFn8ZMEYP6H3IRqQdA%3D&amp;reserved=0" target="_blank" rel="noopener">Security Update Validation Program (SUVP)</a>, we release advance versions of our updates for the purpose of validation and interoperability testing in lab environments,&#8221; Microsoft said in a written statement. &#8220;Participants in this program are contractually disallowed from applying the fix to any system outside of this purpose and may not apply it to production infrastructure.&#8221;</p>
<p><span id="more-50171"></span></p>
<p><em>Original story:</em></p>
<p><strong>Will Dormann</strong>, a security researcher who authors many of the vulnerability reports for the <a href="https://en.wikipedia.org/wiki/CERT_Coordination_Center" target="_blank" rel="noopener">CERT Coordination Center</a> (CERT-CC), <a href="https://twitter.com/wdormann/status/1216763957446422528" target="_blank" rel="noopener">tweeted today</a> that &#8220;people should perhaps pay very close attention to installing tomorrow&#8217;s Microsoft Patch Tuesday updates in a timely manner. Even more so than others. I don&#8217;t know&#8230;just call it a hunch?&#8221; Dormann declined to elaborate on that teaser.</p>
<p>It could be that the timing and topic here (<a href="https://en.wikipedia.org/wiki/NSAKEY" target="_blank" rel="noopener">cryptography</a>) is nothing more than a coincidence, but KrebsOnSecurity today received a heads up from the <strong>U.S. National Security Agency</strong> (NSA) stating that NSA&#8217;s Director of Cybersecurity <strong>Anne Neuberger</strong> is slated to host a call on Jan. 14 with the news media that &#8220;will provide advanced notification of a current NSA cybersecurity issue.&#8221;</p>
<p>The NSA&#8217;s public affairs folks did not respond to requests for more information on the nature or purpose of the discussion. The invitation from the agency said only that the call &#8220;reflects NSA&#8217;s efforts to enhance dialogue with industry partners regarding its work in the cybersecurity domain.&#8221;</p>
<p>Stay tuned for tomorrow&#8217;s coverage of Patch Tuesday and possibly more information on this particular vulnerability.</p>


feed_id: https://krebsonsecurity.com/?p=50194
title: Patch Tuesday, January 2020 Edition
uri: Patch-Tuesday-January-2020-Edition
url: https://krebsonsecurity.com/2020/01/patch-tuesday-january-2020-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug 50 security holes in various flavors of <strong>Windows</strong> and related software. The patch batch includes a fix for a flaw in <strong>Windows 10</strong> and server equivalents of this operating system that prompted an unprecedented public warning from the <strong>U.S. National Security Agency</strong>. This month also marks the end of mainstream support for <strong>Windows 7</strong>, a still broadly-used operating system that will no longer be supplied with security updates.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />As <a href="https://krebsonsecurity.com/2020/01/cryptic-rumblings-ahead-of-first-2020-patch-tuesday/" target="_blank" rel="noopener">first reported</a> Monday by KrebsOnSecurity, Microsoft addressed a severe bug (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0601" target="_blank" rel="noopener">CVE-2020-0601</a>) in <strong>Windows 10</strong> and <strong>Windows Server 2016/19</strong> reported by the NSA that allows an attacker to spoof the digital signature tied to a specific piece of software. Such a weakness could be abused by attackers to make malware appear to be a benign program that was produced and signed by a legitimate software company.</p>
<p><a href="media/735b0953.CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF" data-original-source="https://media.defense.gov/2020/Jan/14/2002234275/-1/-1/0/CSA-WINDOWS-10-CRYPT-LIB-20190114.PDF" target="_blank" rel="noopener">An advisory</a> (PDF) released today by the NSA says the flaw may have far more wide-ranging security implications, noting that the &#8220;exploitation of the vulnerability allows attackers to defeat trusted network connections and deliver executable code while appearing as legitimately trusted entities.&#8221;</p>
<p>&#8220;NSA assesses the vulnerability to be severe and that sophisticated cyber actors will understand the underlying flaw very quickly and, if exploited, would render the previously mentioned platforms as fundamentally vulnerable,&#8221; the advisory continues. &#8220;The consequences of not patching the vulnerability are severe and widespread.&#8221;</p>
<p><strong>Matthew Green</strong>, an associate professor in the computer science department at <strong>Johns Hopkins University</strong>, said the flaw involves an apparent implementation weakness in a component of recent Windows versions responsible for validating the legitimacy of authentication requests for a panoply of security functions in the operating system.</p>
<p>Green said attackers can use this weakness to impersonate everything from trusted Web sites to the source of software updates for Windows and other programs.</p>
<p>&#8220;Imagine if I wanted to pick the lock in your front door,&#8221; Green analogized. &#8220;It might be hard for me to come up with a key that will open your door, but what if I could tamper with or present both the key and the lock at the same time?&#8221;</p>
<p><strong>Kenneth White</strong>, security principal at the software company <strong>MongoDB</strong>, equated the vulnerability to a phone call that gets routed to a party you didn&#8217;t intend to reach.</p>
<p>&#8220;You pick up the phone, dial a number and assume you&#8217;re talking to your bank or Microsoft or whomever, but the part of the software that confirms who you&#8217;re talking to is flawed,&#8221; White said. &#8220;That&#8217;s pretty bad, especially when your system is saying download this piece of software or patch automatically and it&#8217;s being done in the background.&#8221;</p>
<p>Both Green and White said it likely will be a matter of hours or days before security researchers and/or bad guys work out ways to exploit this bug, given the stakes involved. Indeed, already this evening KrebsOnSecurity has seen indications that people are teasing out such methods, which will likely be posted publicly online soon.<span id="more-50194"></span></p>
<p>According to security vendor <a href="https://blog.qualys.com/laws-of-vulnerabilities/2020/01/14/january-2020-patch-tuesday-50-vulns-7-critical-adobe-vulns" target="_blank" rel="noopener">Qualys</a>, only eight of the 50 flaws fixed in today&#8217;s patch roundup from Microsoft earned the company&#8217;s most dire &#8220;critical&#8221; rating, a designation reserved for bugs that can be exploited remotely by malware or miscreants to seize complete control over the target computer without any help from users.</p>
<p><a href="https://krebsonsecurity.com/?s=remote+desktop+2019&amp;x=0&amp;y=0" target="_blank" rel="noopener">Once again</a>, some of those critical flaws include security weaknesses in the way Windows implements Remote Desktop connections, a feature that allows systems to be accessed, viewed and controlled as if the user was seated directly in front of the remote computer. Other critical patches include updates for the Web browsers and Web scripting engines built into Windows, as well as fixes for <strong>ASP.NET</strong> and the <strong>.NET Framework</strong>.</p>
<p>The security fix for the CVE-2020-0601 bug and others detailed in this post will be offered to Windows users as part of a bundle of patches released today by Microsoft. To see whether any updates are available for your Windows computer, go to the Start menu and type &#8220;Windows Update,&#8221; then let the system scan for any available patches.</p>
<p>Keep in mind that while staying up-to-date on Windows patches is a must, it’s important to make sure you’re updating only after you’ve backed up your important data and files. A reliable backup means you’re not losing your mind when the odd buggy patch causes problems booting the system. So do yourself a favor and backup your files before installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>Today also marks the last month in which Microsoft will ship security updates for Windows 7 home/personal users. I count myself among some 30 percent of Windows users who still like and (ab)use this operating system in one form or another, and am sad that this day has come to pass. But if you rely on this OS for day-to-day use, it&#8217;s probably time to think about upgrading to something newer.</p>
<p>That might be a computer with Windows 10. Or maybe you have always wanted that shiny MacOS computer. If cost is a primary motivator and the user you have in mind doesn&#8217;t do much with the system other than browsing the Web, perhaps a <strong>Chromebook</strong> or an older machine with a recent version of <strong>Linux</strong> is the answer. Whichever system you choose, it&#8217;s important to pick one that fits the owner&#8217;s needs and provides security updates on an ongoing basis.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips.</p>


feed_id: https://krebsonsecurity.com/?p=50227
title: DDoS Mitigation Firm Founder Admits to DDoS
uri: DDoS-Mitigation-Firm-Founder-Admits-to-DDoS
url: https://krebsonsecurity.com/2020/01/ddos-mitigation-firm-founder-admits-to-ddos/
content:
<p>A Georgia man who co-founded a service designed to protect companies from crippling distributed denial-of-service (DDoS) attacks has pleaded to paying a DDoS-for-hire service to launch attacks against others.</p>
<p><img class="aligncenter  wp-image-36825" src="media/799359f6.ddosbomb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb.png" alt="" width="593" height="365" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb.png 699w, https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb-580x357.png 580w" sizes="(max-width: 593px) 100vw, 593px" /></p>
<p><strong>Tucker Preston</strong>, 22, of Macon, Ga., pleaded guilty last week in a New Jersey court to one count of damaging protected computers by transmission of a program, code or command. DDoS attacks involve flooding a target Web site with so much junk Internet traffic that it can no longer accommodate legitimate visitors.</p>
<p>Preston was featured in the 2016 KrebsOnSecurity story <a href="https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/" target="_blank" rel="noopener">DDoS Mitigation Firm Has History of Hijacks</a>, which detailed how the company he co-founded &#8212; <strong>BackConnect Security LLC</strong> &#8212; had developed the unusual habit of hijacking Internet address space it didn&#8217;t own in a bid to protect clients from attacks.</p>
<p>Preston&#8217;s guilty <a href="media/20ad88d0.preston.information.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/preston.information.pdf" target="_blank" rel="noopener">plea agreement</a> (PDF) doesn&#8217;t specify who he admitted attacking, and refers to the target only as &#8220;Victim 1.&#8221; Preston declined to comment for this story.</p>
<p>But that 2016 story came on the heels of <a href="https://krebsonsecurity.com/2016/09/israeli-online-attack-service-vdos-earned-600000-in-two-years/" target="_blank" rel="noopener">an exclusive about the hacking of <strong>vDOS</strong></a> &#8212; at the time the world&#8217;s most popular and powerful DDoS-for-hire service.</p>
<p>KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/08/alleged-vdos-operators-arrested-charged/" target="_blank" rel="noopener">exposed the co-administrators of vDOS</a> and obtained a copy of the entire vDOS database, including its registered users and a record of the attacks those users had paid vDOS to launch on their behalf.</p>
<p>Those records showed that several email addresses tied to a domain registered by then 19-year-old Preston had been used to create a vDOS account that was active in attacking a large number of targets, including multiple assaults on networks belonging to the <a href="http://www.fsf.org/" target="_blank" rel="noopener">Free Software Foundation</a> (FSF).</p>
<p>The 2016 story on BackConnect featured an interview with a former system administrator at FSF who said the nonprofit briefly considered working with BackConnect, and that the attacks started almost immediately after FSF told the company&#8217;s owners they would need to look elsewhere for DDoS protection.</p>
<p>Perhaps having fun at the expense of the FSF was something of a meme that the accused and his associates seized upon, but it&#8217;s interesting to note that the name of the FSF&#8217;s founder &#8212; <strong>Richard Stallman</strong> &#8212; <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">was used as a nickname by the co-author of <strong>Mirai</strong></a>, a potent malware strain that was created for the purposes of enslaving Internet of Things (IoT) devices for large-scale DDoS attacks.</p>
<p>Ultimately, it was the Mirai co-author&#8217;s use of this nickname that contributed to him getting caught, arrested, and <a href="https://krebsonsecurity.com/2018/10/mirai-co-author-gets-6-months-confinement-8-6m-in-fines-for-rutgers-attacks/" target="_blank" rel="noopener">prosecuted</a> for <a href="https://krebsonsecurity.com/2016/10/source-code-for-iot-botnet-mirai-released/" target="_blank" rel="noopener">releasing Mirai and its source code</a> (as well as for <a href="https://krebsonsecurity.com/2016/09/the-democratization-of-censorship/" target="_blank" rel="noopener">facilitating a record-setting DDoS against this Web site in 2016</a>).</p>
<p>According to a statement from the <strong>U.S. Justice Department</strong>, the count to which he pleaded guilty is punishable by a maximum of 10 years in prison and a fine of up to $250,000, or twice the gross gain or loss from the offense. He is slated to be sentenced on May 7.</p>


feed_id: https://krebsonsecurity.com/?p=50223
title: Apple Addresses iPhone 11 Location Privacy Concern
uri: Apple-Addresses-iPhone-11-Location-Privacy-Concern
url: https://krebsonsecurity.com/2020/01/apple-addresses-iphone-11-location-privacy-concern/
content:
<p><strong>Apple</strong> is rolling out a new update to its iOS operating system that addresses the location privacy issue on iPhone 11 devices that was first detailed here last month.</p>
<p><img class="aligncenter  wp-image-49815" src="media/fcff6064.iphone11pro.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/12/iphone11pro.png" alt="" width="594" height="316" /></p>
<p>Beta versions of <strong>iOS 13.3.1</strong> include a new setting that lets users disable the &#8220;Ultra Wideband&#8221; feature, a short-range technology that lets iPhone 11 users share files locally with other nearby phones that support this feature.</p>
<p>In December, KrebsOnSecurity <a href="https://krebsonsecurity.com/2019/12/the-iphone-11-pros-location-data-puzzler/" target="_blank" rel="noopener">pointed out</a> the new iPhone 11 line queries the user&#8217;s location even when all applications and system services are individually set never to request this data.</p>
<p>Apple initially said the company did not see any privacy concerns and that the location tracking icon (a small, upward-facing arrow to the left of the battery icon) appears for system services that do not have a switch in the iPhone&#8217;s settings menu.</p>
<p>Apple <a href="https://krebsonsecurity.com/2019/12/apple-explains-mysterious-iphone-11-location-requests/" target="_blank" rel="noopener">later acknowledged</a> the mysterious location requests were related to the inclusion of an Ultra Wideband chip in iPhone 11, Pro and Pro Max devices.</p>
<p>The company further explained that the location information indicator appears because the device periodically checks to see whether it is being used in a handful of countries for which Apple hasn’t yet received approval to deploy Ultra Wideband.</p>
<p>Apple also stressed it doesn&#8217;t use the UWB feature to collect user location data, and that this location checking resided &#8220;entirely on the device.&#8221; Still, it&#8217;s nice that iPhone 11 users will now have a disable the feature if they want.</p>
<p>Spotted by journalist <strong>Brandon Butch</strong> and published <a href="https://twitter.com/BrandonButch/status/1218272838181949441?s=20" rel="noreferrer" data-ss1579715333="1">on Twitter</a> last week, the new toggle switch to turn off UWB now exists in the &#8220;Networking &amp; Wireless&#8221; settings in beta versions of iOS 13.3.1, under <strong>Locations Services &gt; System Services. </strong>Beta versions are released early to developers to help iron out kinks in the software, and it&#8217;s not clear yet when 13.3.1 will be released to the general public.</p>


feed_id: https://krebsonsecurity.com/?p=50236
title: Does Your Domain Have a Registry Lock?
uri: Does-Your-Domain-Have-a-Registry-Lock
url: https://krebsonsecurity.com/2020/01/does-your-domain-have-a-registry-lock/
content:
<p>If you&#8217;re running a business online, few things can be as disruptive or destructive to your brand as someone stealing your company&#8217;s domain name and doing whatever they wish with it. Even so, most major Web site owners aren&#8217;t taking full advantage of the security tools available to protect their domains from being hijacked. Here&#8217;s the story of one recent victim who was doing <em>almost</em> everything possible to avoid such a situation and still had a key domain stolen by scammers.</p>
<p>On December 23, 2019, unknown attackers began contacting customer support people at <a href="https://openprovider.com/" target="_blank" rel="noopener">OpenProvider</a>, a popular domain name registrar based in The Netherlands. The scammers told the customer representatives they had just purchased from the original owner the domain <strong>e-hawk.net</strong> &#8212; which is part of a service that helps Web sites detect and block fraud &#8212; and that they were having trouble transferring the domain from OpenProvider to a different registrar.</p>
<p>The real owner of e-hawk.net is <strong>Raymond Dijkxhoorn</strong>, a security expert and entrepreneur who has spent much of his career making life harder for cybercrooks and spammers. Dijkxhoorn and E-HAWK&#8217;s <strong>CEO Peter Cholnoky</strong> had already protected their domain with a &#8220;<strong>registrar lock</strong>,&#8221; a service that requires the registrar to confirm any requested changes with the domain owner via whatever communications method is specified by the registrant.</p>
<p>In the case of e-hawk.net, however, the scammers managed to trick an OpenProvider customer service rep into transferring the domain to another registrar with a fairly lame social engineering ruse &#8212; and without triggering any verification to the real owners of the domain.</p>
<p>Specifically, the thieves contacted OpenProvider via <strong>WhatsApp</strong>, said they were now the rightful owners of the domain, and shared a short screen grab video showing the registrar&#8217;s automated system blocking the domain transfer (see video below).</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/Wmc57l1FRuo" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>&#8220;The support agent helpfully tried to verify if what the [scammers] were saying was true, and said, &#8216;Let&#8217;s see if we can move e-hawk.net from here to check if that works&#8217;,&#8221; Dijkxhoorn said. &#8220;But a registrar should not act on instructions coming from a random email address or other account that is not even connected to the domain in question.&#8221;</p>
<p>Dijkxhoorn shared records obtained from OpenProvider showing that on Dec. 23, 2019, the e-hawk.net domain was transferred to a reseller account within OpenProvider. Just three days later, that reseller account moved e-hawk.net to another registrar &#8212; <a href="https://publicdomainregistry.com/" target="_blank" rel="noopener">Public Domain Registry</a> (PDR).</p>
<p>&#8220;Due to the previously silent move to another reseller account within OpenProvider, we were not notified by the registrar about any changes,&#8221; Dijkxhoorn said. &#8220;This fraudulent move was possible due to successful social engineering towards the OpenProvider support team. We have now learned that after the move to the other OpenProvider account, the fraudsters could silently remove the registrar lock and move the domain to PDR.&#8221;</p>
<h4>REGISTRY LOCK</h4>
<p>Dijkxhoorn said one security precaution his company had not taken with their domain prior to the fraudulent transfer was a &#8220;<strong>registry lock</strong>,&#8221; a more stringent, manual (and sometimes offline) process that effectively neutralizes any attempts by fraudsters to social engineer your domain registrar.</p>
<p>With a registry lock in place, your registrar cannot move your domain to another registrar on its own. Doing so requires manual contact verification by the appropriate domain registry, such as <a href="https://www.verisign.com" target="_blank" rel="noopener">Verisign</a> &#8212; which is the authoritative registry for all domains ending in .com, .net, .name, .cc, .tv, .edu, .gov and .jobs. Other registries handle locks for specific top-level or country-code domains, including <a href="https://www.nominet.uk/" target="_blank" rel="noopener">Nominet</a> (for .co.uk or .uk domains), <a href="http://www.eurid.eu/fr/bureaux-denregistrement/devenez-un-bureau-denregistrement-eu/registry-lock" target="_blank" rel="noopener">EURID</a> (for .eu domains), CNNIC for (for .cn) domains, and so on.</p>
<p>According to data provided by digital brand protection firm <a href="https://www.cscglobal.com/service/csc/about/" target="_blank" rel="noopener">CSC</a>, while domains created in the top three most registered top-level domains (.com, .jp and .cn) are eligible for registry locks,<em> just 22 percent of domain names tracked in Forbes&#8217; list of the World&#8217;s Largest Public Companies have secured registry locks.</em></p>
<p>Unfortunately, not all registrars support registry locks (a list of top-level domains that do allow registry locks is <a href="https://docs.google.com/spreadsheets/d/1XjuE0VZdIS3gUJ8t4bpPjhP4SV6WAg0AyALPN_Uxe94/edit?usp=sharing" target="_blank" rel="noopener">here</a>, courtesy of CSC). But as we&#8217;ll see in a moment, there are other security precautions that can and do help if your domain somehow ends up getting hijacked.</p>
<p>Dijkxhoorn said his company first learned of the domain theft on Jan. 13, 2020, which was the date the fraudsters got around to changing the domain name system (DNS) settings for e-hawk.net. That alert was triggered by systems E-HAWK had previously built in-house that continually monitor their stable of domains for any DNS changes.</p>
<p>By the way, this continuous monitoring of one&#8217;s DNS settings is a powerful approach to help blunt attacks on your domains and DNS infrastructure. Anyone curious about why this might be a good approach should have a look at <a href="https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dns-hijacking-attacks/" target="_blank" rel="noopener">this deep-dive from 2019 on &#8220;DNSpionage,&#8221;</a> the name given to the exploits of an Iranian group that has successfully stolen countless passwords and VPN credentials from major companies via DNS-based attacks.<span id="more-50236"></span></p>
<h4>DNSSEC</h4>
<p>Shortly after pointing e-hawk.net&#8217;s DNS settings to a server they controlled, the attackers were able to obtain at least one encryption certificate for the domain, which could have allowed them to intercept and read encrypted Web and email communications tied to e-hawk.net.</p>
<p>But that effort failed because E-HAWK&#8217;s owners also had enabled <a href="https://www.icann.org/resources/pages/dnssec-what-is-it-why-important-2019-03-05-en" target="_blank" rel="noopener">DNSSEC</a> for their domains (a.k.a. “DNS Security Extensions”), which protects applications from using forged or manipulated DNS data by requiring that all DNS queries for a given domain or set of domains be digitally signed.</p>
<p>With DNSSEC properly enabled, if a name server determines that the address record for a given domain has not been modified in transit, it resolves the domain and lets the user visit the site. If, however, that record has been modified in some way or doesn’t match the domain requested, the name server blocks the user from reaching the fraudulent address.</p>
<p>While fraudsters who have hijacked your domain and/or co-opted access to your domain registrar can and usually will try to remove any DNSSEC records associated with the hijacked domain, it generally takes a few days for these updated records to be noticed and obeyed by the rest of the Internet.</p>
<p>As a result, having DNSSEC enabled for its domains bought E-HAWK an additional 48 hours or so with which to regain control over its domain before any encrypted traffic to and from e-hawk.net could have been intercepted.</p>
<p>In the end, E-HAWK was able to wrest back its hijacked domain in less than 48 hours, but only because its owners are on a first-name basis with many of the companies that manage the Internet&#8217;s global domain name system. Perhaps more importantly, they happened to know key people at PDR &#8212; the registrar to which the thieves moved the stolen domain.</p>
<p>Dijkxhoorn said without that industry access, E-HAWK probably would still be waiting to re-assume control over its domain.</p>
<p>&#8220;This process is normally not that quick,&#8221; he said, noting that most domains can&#8217;t be moved for at least 60 days after a successful transfer to another registrar.</p>
<p>In an interview with KrebsOnSecurity, <strong>OpenProvider CEO and Founder</strong> <strong>Arno Vis</strong> said said OpenProvider is reviewing its procedures and building systems to prevent support employees from overriding security checks that come with a registrar lock.</p>
<p>&#8220;We are building an extra layer of approval for things that support engineers shouldn&#8217;t be doing in the first place,&#8221; Vis said. &#8220;As far as I know, this is the first time something like this has happened to us.&#8221;</p>
<p>As in this case, crooks who specialize in stealing domains often pounce during holidays, when many registrars are short on well-trained staff. But Vis said the attack against E-HAWK targeted the company&#8217;s most senior support engineer.</p>
<p>&#8220;This is why social engineering is such a tricky thing, because in the end you still have a person who has to make a decision about something and in some cases they don&#8217;t make the right decision,&#8221; he said.</p>
<p><H4>WHAT CAN YOU DO?</H4></p>
<p>To recap, for maximum security on your domains, consider adopting some or all of the following best practices:</p>
<p>-Use registration features like Registry Lock that can help protect domain names records from being changed. Note that this may increase the amount of time it takes going forward to make key changes to the locked domain (such as DNS changes).</p>
<p>-Use DNSSEC (both signing zones and validating responses).</p>
<p>-Use access control lists for applications, Internet traffic and monitoring.</p>
<p>-Use 2-factor authentication, and require it to be used by all relevant users and subcontractors.</p>
<p>-In cases where passwords are used, pick unique passwords and consider password managers.</p>
<p>-Review the security of existing accounts with registrars and other providers, and make sure you have multiple notifications in place when and if a domain you own is about to expire.</p>
<p>-Monitor the issuance of new SSL certificates for your domains by monitoring, for example, <a href="https://www.certificate-transparency.org/how-ct-works" target="_blank" rel="noopener">Certificate Transparency Logs</a>.</p>


feed_id: https://krebsonsecurity.com/?p=50271
title: Russian Cybercrime Boss Burkov Pleads Guilty
uri: Russian-Cybercrime-Boss-Burkov-Pleads-Guilty
url: https://krebsonsecurity.com/2020/01/russian-cybercrime-boss-burkov-pleads-guilty/
content:
<p><strong>Aleksei Burkov</strong>, an ultra-connected Russian hacker once described as &#8220;an asset of supreme importance&#8221; to Moscow, has pleaded guilty in a U.S. court to running a site that sold stolen payment card data and to administering a highly secretive crime forum that counted among its members some of the most elite Russian cybercrooks.</p>
<div id="attachment_49530" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-49530" src="media/a23ec59c.burkov-jerusalem-getty.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/burkov-jerusalem-getty.png" alt="" width="595" height="375" /><p class="wp-caption-text">Aleksei Burkov, seated second from right, attends a hearing in Jerusalem in 2015. Andrei Shirokov / Tass via Getty Images.</p></div>
<p>Burkov, 29, admitted to running <strong>CardPlanet</strong>, a site that sold more than 150,000 stolen credit card accounts, and to being the founder and administrator of <strong>DirectConnection</strong> &#8212; a closely guarded underground community that attracted some of the world&#8217;s most-wanted Russian hackers. He <a href="https://www.justice.gov/usao-edva/pr/russian-national-pleads-guilty-running-online-criminal-marketplace" target="_blank" rel="noopener">pleaded guilty last week</a> in a Virginia court to access device fraud and conspiracy to commit computer intrusion, identity theft, wire fraud and money laundering.</p>
<p>As KrebsOnSecurity noted in <a href="https://krebsonsecurity.com/2019/11/why-were-the-russians-so-set-against-this-hacker-being-extradited/" target="_blank" rel="noopener">a November 2019 profile of Burkov&#8217;s hacker nickname &#8216;k0pa,&#8217;</a> &#8220;a deep dive into the various pseudonyms allegedly used by Burkov suggests this individual may be one of the most connected and skilled malicious hackers ever apprehended by U.S. authorities, and that the Russian government is probably concerned that he simply knows too much.&#8221;</p>
<p>Membership in the DirectConnection fraud forum was heavily restricted. New members had to be native Russian speakers, provide a $5,000 deposit, and be vouched for by three existing crime forum members. Also, members needed to have a special encryption certificate installed in their Web browser before the forum&#8217;s login page would even load.</p>
<p>DirectConnection was something of a Who&#8217;s Who of major cybercriminals, and many of its most well-known members have likewise been extradited to and prosecuted by the United States. Those include <strong>Sergey &#8220;Fly&#8221; Vovnenko</strong>, who was sentenced to 41 months in prison for operating a botnet and stealing login and payment card data. Vovnenko also served as administrator of his own cybercrime forum, which <a href="https://krebsonsecurity.com/2019/09/interview-with-the-guy-who-tried-to-frame-me-for-heroin-possession/" target="_blank" rel="noopener">he used in 2013 to carry out a plan to have Yours Truly framed for heroin possession</a>.</p>
<p>As noted in last year&#8217;s profile of Burkov, an early and important member of DirectConnection was a hacker who went by the moniker &#8220;<strong>aqua</strong>&#8221; and ran the banking sub-forum on Burkov&#8217;s site. In December 2019, The <strong>FBI</strong> has <a href="https://www.fbi.gov/wanted/cyber/maksim-viktorovich-yakubets" target="_blank" rel="noopener">offered a $5 million bounty</a> leading to the arrest and conviction of aqua, who&#8217;s been identified as <strong>Maksim Viktorovich Yakubets</strong>. The Justice Department says Yakubets/aqua <a href="https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/" target="_blank" rel="noopener">ran a transnational cybercrime organization called &#8220;Evil Corp.&#8221;</a> that stole roughly $100 million from victims.</p>
<div id="attachment_49556" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-49556" src="media/ae7b3c84.jz-dc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/jz-dc.png" alt="" width="596" height="215" /><p class="wp-caption-text">In this 2011 screenshot of DirectConnection, we can see the nickname of &#8220;aqua,&#8221; who ran the &#8220;banking&#8221; sub-forum on DirectConecttion. Aqua, a.k.a. Maksim V. Yakubets of Russia, now has a $5 million bounty on his head from the FBI.</p></div>
<p><span id="more-50271"></span>According to a statement of facts in Burkov&#8217;s case, the author of the <a href="https://krebsonsecurity.com/?s=spyeye&amp;x=0&amp;y=0" target="_blank" rel="noopener">infamous SpyEye banking trojan</a> &#8212; <strong><a href="https://krebsonsecurity.com/2016/04/spyeye-makers-get-24-years-in-prison/" target="_blank" rel="noopener">Aleksandr &#8220;Gribodemon&#8221; Panin</a> </strong>&#8212; was personally vouched for by Burkov. Panin was sentenced in 2016 to 24 years in prison.</p>
<p>Other top DirectConnection members include convicted credit card fraudsters <a href="https://www.wired.com/2010/08/badb-rbs-worldpay-hack/" target="_blank" rel="noopener">Vladislav “Badb” Horohorin</a> and <a href="https://krebsonsecurity.com/?s=zo0mer&amp;x=0&amp;y=0" target="_blank" rel="noopener">Sergey “zo0mer” Kozerev</a>, as well as the infamous spammer and botnet master <a href="https://krebsonsecurity.com/?s=severa+waledac&amp;x=0&amp;y=0" target="_blank" rel="noopener">Peter “Severa” Levashov</a>.</p>
<p>Burkov was arrested in 2015 on an international warrant while he was visiting Israel, and over the ensuing four years the Russian government aggressively sought to keep him from being extradited to the United States. When Israeli authorities turned down requests to send him back to Russia — supposedly to face separate hacking charges there — the Russians then imprisoned a young Israeli woman on trumped-up drug charges in a bid to trade prisoners.</p>
<p>As the news outlet <a href="https://www.haaretz.com/israel-news/.premium-the-russian-hacker-who-just-became-one-of-israel-s-most-famous-prisoners-1.7972490" target="_blank" rel="noopener"><em>Haaretz</em> reported in October</a>, <strong>Naama Issachar</strong> was arrested while changing planes in Russia on her way home from a yoga course in India. Russian police said they found approximately 10 grams of marijuana in Issachar&#8217;s bag. Issachar denied smuggling drugs, saying she had not sought to enter Russia during her layover and had no access to her luggage during her brief stay in the Russian airport.</p>
<p><em>Haaretz</em> noted that the Russian government pressed Israel to exchange Burkov for Issachar. When Israel&#8217;s supreme court cleared the way for Burkov&#8217;s extradition to the United States, Issachar was found guilty of drug smuggling and sentenced to 7.5 years in jail.</p>
<p>But according to <a href="https://www.timesofisrael.com/putin-to-decide-soon-on-pardon-for-jailed-israeli-kremlin-says/" target="_blank" rel="noopener">a story today</a> in <em>The Times of Israel</em>, the Kremlin has signaled that <strong>Russian President Vladimir Putin</strong> may make a decision &#8220;in the near future,&#8221; on a possible pardon for Issachar, whose mother reportedly met with Putin while the Russian leader was visiting Israel last week.</p>
<p>Burkov currently is scheduled to be sentenced on May 8. He faces a maximum sentence of 15 years in prison.</p>


feed_id: https://krebsonsecurity.com/?p=50274
title: Wawa Breach May Have Compromised More Than 30 Million Payment Cards
uri: Wawa-Breach-May-Have-Compromised-More-Than-30-Million-Payment-Cards
url:
https://krebsonsecurity.com/2020/01/wawa-breach-may-have-compromised-more-than-30-million-payment-cards/

content:
<p>In late December 2019, fuel and convenience store chain <strong>Wawa Inc.</strong> said a nine-month-long breach of its payment card processing systems may have led to the theft of card data from customers who visited any of its 850 locations nationwide. Now, fraud experts say the first batch of card data stolen from Wawa customers is being sold at one of the underground&#8217;s most popular crime shops, which claims to have 30 million records to peddle from a new nationwide breach.</p>
<p>On the evening of Monday, Jan. 27, a popular fraud bazaar known as <a href="https://krebsonsecurity.com/2016/03/carders-park-piles-of-cash-at-jokers-stash/" target="_blank" rel="noopener">Joker&#8217;s Stash</a> began selling card data from &#8220;a new huge nationwide breach&#8221; that purportedly includes more than 30 million card accounts issued by thousands of financial institutions across 40+ U.S. states.</p>
<div id="attachment_50292" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-50292" src="media/d23dd600.badaboom.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/badaboom.png" alt="" width="599" height="494" /><p class="wp-caption-text">The fraud bazaar Joker&#8217;s Stash on Monday began selling some 30 million stolen payment card accounts that experts say have been tied back to a breach at Wawa in 2019.</p></div>
<p>Two sources that work closely with financial institutions nationwide tell KrebsOnSecurity the new batch of cards that went on sale Monday evening &#8212; dubbed &#8220;BIGBADABOOM-III&#8221; by Joker&#8217;s Stash &#8212; map squarely back to cardholder purchases at Wawa.</p>
<p>On Dec. 19, 2019, Wawa <a href="https://www.wawa.com/alerts/data-security" target="_blank" rel="noopener">sent a notice to customers</a> saying the company had discovered card-stealing malware installed on in-store payment processing systems and fuel dispensers at potentially all Wawa locations.</p>
<p>Pennsylvania-based Wawa says it discovered the intrusion on Dec. 10 and contained the breach by Dec. 12, but that the malware was thought to have been installed more than nine months earlier, around March 4. The exposed information includes debit and credit card numbers, expiration dates, and cardholder names. Wawa said the breach did not expose personal identification numbers (PINs) or CVV records (the three-digit security code printed on the back of a payment card).</p>
<p>A spokesperson for Wawa confirmed that the company today became aware of reports of criminal attempts to sell some customer payment card information potentially involved in the data security incident announced by Wawa on December 19, 2019.</p>
<p>&#8220;We have alerted our payment card processor, payment card brands, and card issuers to heighten fraud monitoring activities to help further protect any customer information,&#8221; Wawa said in a statement released to KrebsOnSecurity. &#8220;We continue to work closely with federal law enforcement in connection with their ongoing investigation to determine the scope of the disclosure of Wawa-specific customer payment card data.&#8221;</p>
<p>&#8220;We continue to encourage our customers to remain vigilant in reviewing charges on their payment card statements and to promptly report any unauthorized use to the bank or financial institution that issued their payment card by calling the number on the back of the card,&#8221; the statement continues. &#8220;Under federal law and card company rules, customers who notify their payment card issuer in a timely manner of fraudulent charges will not be responsible for those charges. In the unlikely event any individual customer who has promptly notified their card issuer of fraudulent charges related to this incident is not reimbursed, Wawa will work with them to reimburse them for those charges.&#8221;</p>
<p><strong>Gemini Advisory</strong>, a New York-based fraud intelligence company, said the biggest concentrations of stolen cards for sale in the BIGBADABOOM-III batch map back to Wawa customer card use in Florida and Pennsylvania, the two most populous states where Wawa operates. Wawa also has locations in Delaware, Maryland, Virginia and the District of Columbia.</p>
<p>According to Gemini, Joker&#8217;s Stash has so far released only a small portion of the claimed 30 million. However, this is not an uncommon practice: Releasing too many stolen cards for sale at once tends to have the effect of depressing the overall price of stolen cards across the underground market.</p>
<p>&#8220;Based on Gemini’s analysis, the initial set of bases linked to “BIGBADABOOM-III” consisted of nearly 100,000 records,&#8221; Gemini <a href="https://geminiadvisory.io/breached-wawa-payment-card-records-reach-dark-web/" target="_blank" rel="noopener">observed</a>. &#8220;While the majority of those records were from US banks and were linked to US-based cardholders, some records also linked to cardholders from Latin America, Europe, and several Asian countries. Non-US-based cardholders likely fell victim to this breach when traveling to the United States and utilizing Wawa gas stations during the period of exposure.&#8221;</p>
<p>Gemini&#8217;s director of research <strong>Stas Alforov</strong> stressed that some of the 30 million cards advertised for sale as part of this BIGBADABOOM batch may in fact be sourced from breaches at other retailers, something Joker&#8217;s Stash has been known to do in previous large batches.</p>
<p>Gemini monitors multiple carding sites like Joker&#8217;s Stash. The company found the median price of U.S.-issued records in the new Joker&#8217;s Stash batch is currently $17, with some of the international records priced as high as $210 per card.</p>
<p>&#8220;Apart from banks with a nationwide presence, only financial institutions along the East Coast had significant exposure,&#8221; Gemini concluded.</p>
<p>Representatives from <strong>MasterCard</strong> did not respond to requests for comment. <strong>Visa</strong> declined to comment for this story, but pointed to a series of alerts it issued in <a href="media/890b0df5.security-alert-attacks-targeting-fuel-dispenser-merchant-pos.pdf" data-original-source="https://usa.visa.com/dam/VCOM/global/support-legal/documents/visa-security-alert-attacks-targeting-fuel-dispenser-merchant-pos.pdf" target="_blank" rel="noopener">November</a> and <a href="media/ed63f923.cybercrime-groups-targeting-fuel-dispenser-merchants.pdf" data-original-source="https://usa.visa.com/dam/VCOM/global/support-legal/documents/cybercrime-groups-targeting-fuel-dispenser-merchants.pdf" target="_blank" rel="noopener">December</a> 2019 about cybercrime groups increasingly targeting fuel dispenser merchants.<span id="more-50274"></span></p>
<p>A number of recent high-profile nationwide card breaches at main street merchants have been linked to large numbers of cards for sale at Joker&#8217;s Stash, including breaches at <a href="https://krebsonsecurity.com/2019/08/breach-at-hy-vee-supermarket-chain-tied-to-sale-of-5m-stolen-credit-debit-cards/" target="_blank" rel="noopener">supermarket chain Hy-Vee</a>, restaurant chains <a href="https://krebsonsecurity.com/2017/09/breach-at-sonic-drive-in-may-have-impacted-millions-of-credit-debit-cards/" target="_blank" rel="noopener">Sonic</a>, <a href="https://krebsonsecurity.com/2019/11/sale-of-4-million-stolen-cards-tied-to-breaches-at-4-restaurant-chains/" target="_blank" rel="noopener">Buca di Beppo, Krystal, Moe&#8217;s, McAlister&#8217;s Deli, and Schlotzsky&#8217;s,</a> retailers like <a href="http://krebsonsecurity.com/2014/12/bebe-stores-confirms-credit-card-breach/" target="_blank" rel="noopener">Bebe Stores</a>, and hospitality brands such as <a href="http://krebsonsecurity.com/?s=hilton+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">Hilton Hotels</a>.</p>
<p>Most card breaches at restaurants and other brick-and-mortar stores occur when cybercriminals manage to remotely install malicious software on the retailer’s card-processing systems. This type of point-of-sale malware is capable of copying data stored on a credit or debit card’s magnetic stripe when those cards are swiped at compromised payment terminals, and that data can then be used to create counterfeit copies of the cards.</p>
<p>The United States is the last of the G20 nations to make the shift to more secure chip-based cards, which are far more expensive and difficult for criminals to counterfeit. Unfortunately, many merchants have not yet shifted to using chip-based card readers and still swipe their customers’ cards.</p>
<p>According to <a href="https://usa.visa.com/visa-everywhere/blog/bdp/2019/11/25/shopping-instore-during-1574711146771.html" target="_blank" rel="noopener">stats released in November</a> by <strong>Visa</strong>, more than 3.7 million merchant locations are now accepting chip cards. Visa says for merchants who have completed the chip upgrade, counterfeit fraud dollars dropped 81 percent in June 2019 compared to September 2015. This may help explain why card thieves <a href="https://krebsonsecurity.com/2019/04/data-e-retail-hacks-more-lucrative-than-ever/" target="_blank" rel="noopener">increasingly are shifting their attention to compromising e-commerce merchants</a>, a trend seen in virtually every country that has already made the switch to chip-based cards.</p>
<p>Many filling stations are <a href="https://krebsonsecurity.com/2018/06/how-to-avoid-card-skimmers-at-the-pump/" target="_blank" rel="noopener">upgrading their pumps to include more cyber and physical security</a> — such as end-to-end encryption of card data, custom locks and security cameras. In addition, newer pumps can accommodate more secure chip-based payment cards that are already in use and in some cases mandated by other G20 nations.</p>
<p>But these upgrades are disruptive and expensive, and many fuel station owners are putting them off until it is absolutely necessary. Prior to late 2016, fuel station owners in the United States had until October 1, 2017 to install chip-capable readers at their pumps. Station owners that didn’t have chip-ready readers in place by then would have been on the hook to absorb 100 percent of the costs of fraud associated with transactions in which the customer presented a chip-based card yet was not asked or able to dip the chip.</p>
<p>Yet in December 2016, Visa &#8212; by far the largest credit card network in the United States &#8212; <a href="https://krebsonsecurity.com/2016/12/visa-delays-chip-deadline-for-pumps-to-2020/" target="_blank" rel="noopener">delayed the requirements</a>, saying fuel station owners would be given until October 1, 2020 to meet the liability shift deadline.</p>
<p>Either way, Wawa could be facing steep fines for failing to protect customer card data traversing its internal payment card networks. In addition, at least <a href="https://www.cisomag.com/wawa-faces-class-action-lawsuit-after-reporting-data-breach/" target="_blank" rel="noopener">one class action lawsuit</a> has already been filed against the company.</p>
<p>Finally, it&#8217;s important to note that even if all 30 million of the cards that Joker&#8217;s Stash is selling as part of this batch do in fact map back to Wawa locations, it&#8217;s highly unlikely that more than a small percentage of these cards will actually be purchased and used by fraudsters. In the 2013 megabreach at <strong>Target Corp.</strong>, for example, fraudsters stole roughly 40 million cards <a href="https://krebsonsecurity.com/2014/05/the-target-breach-by-the-numbers/" target="_blank" rel="noopener">but only ended up selling between one to three million of those cards</a>.</p>


feed_id: https://krebsonsecurity.com/?p=50215
title: Sprint Exposed Customer Support Site to Web
uri: Sprint-Exposed-Customer-Support-Site-to-Web
url: https://krebsonsecurity.com/2020/01/sprint-exposed-customer-support-site-to-web/
content:
<p>Fresh on the heels of a disclosure that <strong>Microsoft Corp. </strong>leaked internal customer support data to the Internet, mobile provider <strong>Sprint</strong> has addressed a mix-up in which posts to a private customer support community were exposed to the Web.</p>
<p>KrebsOnSecurity recently contacted Sprint to let the company know that an internal customer support forum called &#8220;Social Care&#8221; was being indexed by search engines, and that several months worth of postings about customer complaints and other issues were viewable without authentication to anyone with a Web browser.</p>
<div id="attachment_50320" style="width: 594px" class="wp-caption aligncenter"><img class=" wp-image-50320" src="media/65f2d47c.sprint-apple.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/sprint-apple.png" alt="" width="584" height="683" /><p class="wp-caption-text">A redacted screen shot of one Sprint customer support thread exposed to the Web.</p></div>
<p>A Sprint spokesperson responded that the forum was indeed intended to be a private section of its support community, but that an error caused the section to become public.</p>
<p>&#8220;These conversations include minimal customer information and are used for frontline reps to escalate issues to managers,&#8221; said <strong>Lisa Belot</strong>, Sprint&#8217;s communications manager.</p>
<p>A review of the exposed support forum by this author suggests that while none of the posts exposed customer information such as payment card data, a number of them did include customer account information, such customer names, device identifiers and in some cases location information.</p>
<p>Perhaps more importantly for Sprint and its customers, the forum also included numerous links and references to internal tools and procedures. This sort of information would no doubt be of interest to scammers seeking to conduct social engineering attacks against Sprint employees as way to perpetrate other types of fraud, including <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">unauthorized SIM swaps</a> or in gleaning more account information from targeted customers.<span id="more-50215"></span></p>
<p><img class="aligncenter size-full wp-image-50321" src="media/ca74b752.sprint4plus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/sprint4plus.png" alt="" width="529" height="803" /></p>
<p>Earlier this week, <a href="https://www.vice.com/en_us/article/v74b4d/sim-swappers-phishing-verizon-sprint-tmobile-to-access-internal-tools" target="_blank" rel="noopener">vice.com reported</a> that hackers are phishing workers at major U.S. telecommunications companies to gain access to internal company tools. That news followed <a href="https://www.vice.com/en_us/article/5dmbjx/how-hackers-are-breaking-into-att-tmobile-sprint-to-sim-swap-yeh" target="_blank" rel="noopener">a related Vice report earlier this month</a> which found ne&#8217;er-do-wells are now getting telecom employees to run software that lets the hackers directly reach into the internal systems of U.S. telecom companies to take over customer cell phone numbers.</p>
<p>The misstep by Sprint comes just days after Microsoft acknowledged that a database containing &#8220;a subset of information related to customer support interactions was accessible to the internet between the dates of Dec. 5 and Dec. 31, 2019.&#8221; Microsoft said it was alerting individuals whose information was exposed, which included location information, email and IP addresses, telephone numbers and descriptions of technical issues.</p>
<div id="attachment_50322" style="width: 549px" class="wp-caption aligncenter"><img class="size-full wp-image-50322" src="media/6d4cf682.msazuredisclosure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/msazuredisclosure.png" alt="" width="539" height="708" /><p class="wp-caption-text">A message Microsoft sent to customers affected by their recent leak of customer support data.</p></div>
<p>This week marked the annual observance of <a href="https://staysafeonline.org/data-privacy-day/" target="_blank" rel="noopener">Data Privacy Day</a>, an occasion in which we are reminded to be more judicious about the types of personal information we voluntarily share on social media and other Web sites. But both the Microsoft and Sprint stumbles are a reminder that billion-dollar companies <a href="media/2c8bcf2c.leakhackloselift.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/10/leakhackloselift.png" target="_blank" rel="noopener">very often expose this information on our behalf</a>, even when we are doing everything within our power to safeguard it.</p>


feed_id: https://krebsonsecurity.com/?p=50334
title: Iowa Prosecutors Drop Charges Against Men Hired to Test Their Security
uri: Iowa-Prosecutors-Drop-Charges-Against-Men-Hired-to-Test-Their-Security
url:
https://krebsonsecurity.com/2020/01/iowa-prosecutors-drop-charges-against-men-hired-to-test-their-security/

content:
<p>On Sept. 11, 2019, two security experts at a company that had been hired by the state of Iowa to test the physical and network security of its judicial system were arrested while probing the security of an Iowa county courthouse, jailed in orange jumpsuits, charged with burglary, and held on $100,000 bail. On Thursday Jan. 30, prosecutors in Iowa announced they had dropped the criminal charges. The news came while KrebsOnSecurity was conducting a video interview with the two accused (featured below).</p>
<div id="attachment_50353" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-50353" src="media/f9efd485.dallascountycourthouse.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/dallascountycourthouse.png" alt="" width="591" height="353" /><p class="wp-caption-text">The courthouse in Dallas County, Iowa. Image: Wikipedia.</p></div>
<p><strong>Gary DeMercurio</strong>, 43 of Seattle, and <strong>Justin Wynn</strong>, 29 of Naples, Fla., are both professional <a href="https://en.wikipedia.org/wiki/Penetration_test" target="_blank" rel="noopener">penetration testers</a> employed by <a href="https://www.coalfire.com" target="_blank" rel="noopener">Coalfire Labs</a>, a security firm based in Westminster, Colo. Iowa&#8217;s State Court Administration had hired the company to test the security of its judicial buildings.</p>
<p>Under <a href="media/e6618863.rules-of-engagement.pdf" data-original-source="https://cms.arstechnica.com/wp-content/uploads/2019/11/rules-of-engagement.pdf" target="_blank" rel="noopener">the terms of their contract</a> (PDF), DeMercurio and Wynn were permitted to impersonate staff and contractors, provide false pretenses to gain physical access to facilities, &#8220;tailgate&#8221; employees into buildings, and access restricted areas of those facilities. The contract said the men could not attempt to subvert alarm systems, force-open doors, or access areas that require protective equipment.</p>
<p>When the duo&#8217;s early-morning Sept. 11 test of the security at the courthouse in Dallas County, Iowa set off an audible security alarm, they followed procedure and waited on-site for the police. DeMercurio and Wynn said when the county&#8217;s sheriff deputies arrived on the scene just a few minutes later, they told the officers who they were and why they were there, and that they&#8217;d obtained entry to the premises via an unlocked door.</p>
<p>&#8220;They said they found a courthouse door unlocked, so they closed it from the outside and let it lock,&#8221; <strong>Dan Goodin</strong> of Ars Technica <a href="https://arstechnica.com/information-technology/2019/11/how-a-turf-war-and-a-botched-contract-landed-2-pentesters-in-iowa-jail/" target="_blank" rel="noopener">wrote</a> of the ordeal in November. &#8220;Then they slipped a plastic cutting board through a crack in the door and manipulated its locking mechanism. (Pentesters frequently use makeshift or self-created tools in their craft to flip latches, trigger motion-detected mechanisms, and test other security systems.) The deputies seemed impressed.&#8221;</p>
<p>To assuage concerns they might be burglars, DeMercurio and Wynn produced an authorization letter detailing the job they&#8217;d been hired to do and listing the names and mobile phone numbers of Iowa state employees who could verify their story.</p>
<p>After contacting some of the court officials listed in the letter, the deputies seemed satisfied that the men weren&#8217;t thieves. That is, until <strong>Dallas County Sheriff Chad Leonard</strong> showed up.</p>
<p>&#8220;The pentesters had already said they used a tool to open the front door,&#8221; Goodin recounted. &#8220;Leonard took that to mean the men had violated the restriction against forcing doors open. Leonard also said the men attempted to turn off the alarm—something Coalfire officials vehemently deny. In Leonard’s mind that was a second violation. Another reason for doubt: one of the people listed as a contact on the get-out-of-jail-free letter didn’t answer the deputies’ calls, while another said he didn’t believe the men had permission to conduct physical intrusions.&#8221;</p>
<p>DeMercurio and Wynn were arrested, jailed, and held for nearly 24 hours before being released on a $100,000 bail. Initially they were charged with felony third-degree burglary and possessing burglary tools, although those charges were later downgraded to misdemeanor trespass.</p>
<p>What initially seemed to Coalfire as a momentary lapse of judgment by Iowa authorities quickly morphed into the surreal when state lawmakers held hearings questioning why and how someone in the state&#8217;s employ could have so recklessly endangered the safety and security of its citizens.</p>
<div id="attachment_50365" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-50365" src="media/1e576dbb.demercurio-wynn.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/01/demercurio-wynn.png" alt="" width="591" height="300" /><p class="wp-caption-text">DeMercurio and Wynn, minus the orange jumpsuits.</p></div>
<p>Judicial Branch officials in Dallas County said in response to this grilling that they didn&#8217;t expect Coalfire&#8217;s physical penetration testing to be conducted outside of business hours. <a href="https://www.legis.iowa.gov/legislators/legislator?ga=88&amp;personID=10729" target="_blank" rel="noopener">State Sen. Amy Sinclair</a> was quoted as telling her colleagues that &#8220;the hiring of an outside company to break into the courthouses in September created &#8216;significant danger, not only to the contractors, but to local law enforcement, and members of the public.'&#8221;</p>
<p>&#8220;Essentially a branch of government has contracted with a company to commit crimes, and that’s very troubling,&#8221; lamented Iowa state <a href="https://www.legis.iowa.gov/legislators/legislator?ga=88&amp;personID=26997" target="_blank" rel="noopener">Sen. Zach Whiting</a>. &#8220;I want to find out who needs to be held accountable for this and how we can do that.&#8221;</p>
<p>Those strong words clashed with a joint statement released Thursday by Coalfire and <strong>Dallas County Attorney Charles Sinnard</strong>:</p>
<p>&#8220;Ultimately, the long-term interests of justice and protection of the public are not best served by continued prosecution of the trespass charges,&#8221; the statement reads. &#8220;Those interests are best served by all the parties working together to ensure that there is clear communication on the actions to be taken to secure the sensitive information maintained by the judicial branch, without endangering the life or property of the citizens of Iowa, law enforcement or the persons carrying out the testing.</p>
<p><strong>Matthew Linholm</strong>, an attorney representing DeMercurio and Wynn in the case, said the justice system ceases to serve its crucial function and loses credibility when criminal accusations are used to advance personal or political agendas.</p>
<p>&#8220;Such a practice endangers the effective administration of justice and our confidence in the criminal justice system,&#8221; Linholm told <em>The Des Moines Register</em>, which <a href="https://www.desmoinesregister.com/story/news/crime-and-courts/2020/01/30/courthouse-break-ins-charges-dropped-against-coalfire-employees/4611574002/" target="_blank" rel="noopener">broke the news</a> of the dropped charges.<span id="more-50334"></span></p>
<p>While the case against Coalfire&#8217;s employees has rallied many in the cybersecurity community around the accused, not everyone sees this dispute in black-and-white. <a href="https://www.linkedin.com/in/nickersonlares/" target="_blank" rel="noopener">Chris Nickerson</a>, a digital intrusion specialist and founder of <strong>LARES Consulting</strong>, said in <a href="https://twitter.com/indi303/status/1223063446708723712" target="_blank" rel="noopener">a Twitter post Thursday</a> that &#8220;when a company puts us in harm&#8217;s way due to their poor planning, failed sales education, inadequate project management and deplorable contract management&#8230;We shouldn&#8217;t celebrate them. We should hold them accountable.&#8221;</p>
<p>Asked to elaborate, Nickerson referred to <a href="https://www.youtube.com/watch?v=NsAuDlfbm_4&amp;feature=youtu.be" target="_blank" rel="noopener">a recent podcast</a> which touched on the arrests.</p>
<p>&#8220;The things that concern me about this situation are more of the pieces of safety that exist across how the industry instruments doing these types of engagements,&#8221; Nickerson said. &#8220;They seem very, very reasonable and obvious once they become obvious but until then they&#8217;re completely foreign to people.&#8221;</p>
<p>&#8220;It&#8217;s really on the owners of the organization to educate the customer of those potential pitfalls,&#8221; Nickerson continued. &#8220;Because there isn&#8217;t a good standard. We haven&#8217;t all gotten together and institutionalized the knowledge that we have in our heads and dump it down to paper so that someone who is new to the field being tasked with this can go through and say, &#8216;Hey, did you ask them if the city versus the state versus the building owner and the real estate people&#8230;are all of these people in lock step?'&#8221;</p>
<p><strong>Coalfire</strong> <strong>CEO Tom McAndrew</strong> seemed to address this point in our interview Thursday, saying there were two unique aspects of this particular engagement. First, although the client in this case said they did not want Coalfire to make local law enforcement aware of the ongoing engagement prior to testing the physical security of the site, it was clear after the fact that state officials never did that on their own.</p>
<p>More importantly, McAndrew said, there was ambiguity around who actually owned the buildings that they were hired to test.</p>
<p>&#8220;If you&#8217;re doing a test for the state and you walk into the building and it&#8217;s the courthouse and you&#8217;re doing a test for the court system, you&#8217;d think that they would have jurisdiction or own it, and that turned out not to be the case in this scenario because there&#8217;s some things the state owns and some things the county owns, and that was something we weren&#8217;t aware of as we did some of this work,&#8221; he said. &#8220;We didn&#8217;t understand the nuances.&#8221;</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/mYy3ZfpL4BE" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Asked what Coalfire has learned from this ordeal, McAndrew said his company is likely to insist that local, state and even federal law enforcement be informed in advance of any penetration tests, at least as far as those engagements relate to public entities.</p>
<p>&#8220;When we look at the contracts and we look at who&#8217;s authorized to do what&#8230;typically, if a [chief security officer] says test these IP addresses, we would say okay that&#8217;s enough,&#8221; he said. &#8220;But we&#8217;re questioning from a legal perspective at what point does that need to have legal counsel review.&#8221;</p>
<p>McAndrew said it&#8217;s probably time for experts from various corners of the pen testing community to collaborate in documenting best practices that might help others avoid a repeat of the scenario in Dallas County.</p>
<p>&#8220;There&#8217;s no standard in the industry,&#8221; he said. &#8220;When it comes to these sorts of issues in red teaming &#8212; the legal challenges and the contracts &#8212; there&#8217;s really nothing out there. There are some things that can&#8217;t be undone. There&#8217;s the mugshots that are out there forever, but even as we get the charges dropped, these are permanently going to be in the federal database. This is a permanent thing that will reside with them and there&#8217;s no legal way we&#8217;re aware of to get these charges removed from the federal database.&#8221;</p>
<p>McAndrew said while he remains frustrated that it took so long to resolve this dispute, he doesn&#8217;t believe anyone involved acted with malicious intent.</p>
<p>&#8220;I don&#8217;t think there were any bad people,&#8221; he said. &#8220;Everyone was trying to do the right things &#8212; from law enforcement to the sheriff to the judges to the county &#8212; they all had the right intentions. But they didn&#8217;t necessarily all have the right information, and possibly people made decisions at levels they weren&#8217;t really authorized to do. Normally that&#8217;s not really our call, but I think people need to be thinking about that.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=50383
title: Booter Boss Busted By Bacon Pizza Buy
uri: Booter-Boss-Busted-By-Bacon-Pizza-Buy
url: https://krebsonsecurity.com/2020/02/booter-boss-busted-by-bacon-pizza-buy/
content:
<p>A Pennsylvania man who operated one of the Internet&#8217;s longest-running online attack-for-hire or &#8220;booter&#8221; services was sentenced to five years probation today. While the young man&#8217;s punishment was heavily tempered by his current poor health, the defendant&#8217;s dietary choices may have contributed to both his capture and the lenient sentencing: Investigators say the onetime booter boss&#8217;s identity became clear after he ordered a bacon and chicken pizza delivered to his home using the same email address he originally used to register his criminal attack service.</p>
<p><strong>David Bukoski</strong>, 24, of Hanover Township, Pa., pleaded guilty to running <strong>Quantum Stresser</strong>, an attack-for-hire business &#8212; also known as a &#8220;booter&#8221; or &#8220;stresser&#8221; service &#8212; that helped paying customers launch tens of thousands of digital sieges capable of knocking Web sites and entire network providers offline.</p>
<div id="attachment_50388" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-50388" src="media/fb9f5ae8.quantumstresser.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/quantumstresser.png" alt="" width="594" height="233" /><p class="wp-caption-text">The landing page for the Quantum Stresser attack-for-hire service.</p></div>
<p>Investigators say Bukoski’s booter service was among the longest running services targeted by the FBI, operating since at least 2012. The government says Quantum Stresser had more than 80,000 customer subscriptions, and that during 2018 the service was used to conduct approximately 50,000 actual or attempted attacks targeting people and networks worldwide.</p>
<p>The Quantum Stresser Web site &#8212; <strong>quantumstress[.]net</strong> &#8212; was among 15 booter services that were seized by U.S. and international authorities in December 2018 <a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" target="_blank" rel="noopener">as part of a coordinated takedown targeting attack-for-hire services</a>.</p>
<p>Federal prosecutors in Alaska said search warrants served on the email accounts Bukoski used in conjunction with Quantum Stresser revealed that he was banned from several companies he used to advertise and accept payments for the booter service.</p>
<p>The government&#8217;s sentencing memorandum says Bukoski&#8217;s replies demanding to know the reasons for the suspensions were instrumental in discovering his real name.  FBI agents were able to zero in on Bukoski&#8217;s real-life location after a review of his email account showed a receipt from May 2018 in which he&#8217;d gone online and ordered a handmade pan pizza to be delivered to his home address.</p>
<div id="attachment_50390" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-50390" src="media/56fe010b.pizzados.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/pizzados.png" alt="" width="593" height="417" /><p class="wp-caption-text">When an online pizza delivery order brings FBI agents to raid your home.</p></div>
<p>While getting busted on account of ordering a pizza online might sound like a bone-headed or rookie mistake for a cybercriminal, it is hardly unprecedented. In 2012 KrebsOnSecurity <a href="https://krebsonsecurity.com/2012/05/microsoft-to-botmasters-abandon-your-inboxes/" target="_blank" rel="noopener">wrote about the plight of Yuriy &#8220;Jtk&#8221; Konovalenko</a>, a then 30-year-old Ukrainian man who was rounded up as part of an international crackdown on an organized crime gang that used the ZeuS malware to steal tens of millions of dollars from companies and consumers. In that case, Konovalenko ultimately unmasked himself because he used his Internet connection to order the delivery of a &#8220;Veggie Roma&#8221; pizza to his apartment in the United Kingdom.<span id="more-50383"></span></p>
<p>Interestingly, the feds say their examination of Bukoski&#8217;s Internet browsing records showed he knew full well that running a booter service was punishable under federal law (despite disclaimers published on Quantum Stresser stating that the site&#8217;s owners weren&#8217;t responsible for how clients used the service).</p>
<p>&#8220;The defendant’s web browsing history was significant to investigators for a number of reasons, including the fact that it shows that the defendant browsed an article written by a prominent security researcher referencing both the defendant’s enterprise along with a competing service, including a link provided by the researcher in the article to an advisory posted by the FBI warning that the operation of booter services was potentially punishable under federal law,&#8221; reads the sentencing memo from <strong>Assistant U.S. Attorney Adam Alexander</strong>.</p>
<p>That&#8217;s interesting because the article in question was actually <a href="https://krebsonsecurity.com/2017/11/ddos-for-hire-service-launches-mobile-app/" target="_blank" rel="noopener">a 2017 KrebsOnSecurity story</a> about a mobile app tied to a competing booter service that happened to share some of the same content as Quantum Stresser.</p>
<p>That 2017 story referenced <a href="https://www.ic3.gov/media/2017/171017-2.aspx" target="_blank" rel="noopener">an FBI advisory</a> that had just been issued warning the use of booter services is punishable under the Computer Fraud and Abuse Act, and may result in arrest and criminal prosecution.</p>
<p>Bukoski was sentenced to five years of probation and six months of &#8220;community confinement.&#8221; The government suggested a lenient sentence considering the defendant&#8217;s ongoing health complications, which include liver failure.</p>


feed_id: https://krebsonsecurity.com/?p=50373
title: When Your Used Car is a Little Too ‘Mobile’
uri: When-Your-Used-Car-is-a-Little-Too-Mobile
url: https://krebsonsecurity.com/2020/02/when-your-used-car-is-a-little-too-mobile/
content:
<p>Many modern vehicles let owners use the Internet or a mobile device to control the car&#8217;s locks, track location and performance data, and start the engine. But who exactly owns that control is not always clear when these smart cars are sold or leased anew. Here&#8217;s the story of one former electric vehicle owner who discovered he could still gain remote, online access to his old automobile years after his lease ended.</p>
<p><strong>Mathew Marulla</strong> began leasing a <strong>Ford Focus</strong> electric vehicle in 2013, but turned the car back in to Ford at the end of his lease in 2016. So Marulla was surprised when he recently received an email from Ford.com stating that the clock in his car was set incorrectly.</p>
<p><a class="lightbox" href="media/b9dd0781.fordmobile.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/fordmobile.png"><img class="aligncenter wp-image-50420" src="media/b9dd0781.fordmobile.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/fordmobile.png" alt="" width="597" height="100" /></a></p>
<p>Out of curiosity, Marulla decided to check if his old MyFordMobile.com credentials from 2016 still worked. They did, and Marulla was presented with an online dashboard showing the current location of his old ride and its mileage statistics.</p>
<p>The dashboard also allowed him to remotely start the vehicle, as well as lock and unlock its doors.</p>
<div id="attachment_50416" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-50416" src="media/2b0fe9c1.fordss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/fordss.png" alt="" width="598" height="529" /><p class="wp-caption-text">Mathew Marulla turned in his leased Ford EV to Ford 4 years ago, so he is no longer the legal owner of the car. But he can still remotely track its location and usage, lock and unlock it, and start the engine.</p></div>
<p>&#8220;It was a three-year lease from Ford and I turned it in to Ford four years ago, so Ford definitely knows I am no longer the owner,&#8221; Marulla said, noting that the dashboard also included historic records showing where the Focus had been driven in days prior.</p>
<p>&#8220;I can track its movements, see where it plugs in,&#8221; he said. &#8220;Now I know where the current owner likely lives, and if I watch it tomorrow I can probably figure out where he works. I have not been the owner of this vehicle for four years, <span class="il">Ford</span> knows this, yet they took no action whatsoever to remove me as the owner in this application.&#8221;</p>
<p>Asked to comment on Marulla&#8217;s experience, a spokesperson for Ford said all Ford dealerships are supposed to perform a &#8220;master reset&#8221; as part of their used car checklist prior to the resale of a vehicle. A master reset (carried out via the vehicle&#8217;s SYNC infotainment screen by a customer or dealer) disassociates the vehicle from all current accounts.<span id="more-50373"></span></p>
<p>&#8220;A master reset cleans phone data and removes previous Ford Pass and My Ford Mobile connections,&#8221; the company said in a statement released to KrebsOnSecurity. &#8220;Once complete, a previous owner will no longer be able to connect to the vehicle when they log in to My Ford Mobile or Ford Pass.&#8221;</p>
<p>As Marulla&#8217;s experience shows, if you&#8217;re in the market for a used car you should probably check whether it&#8217;s possible to reset the previous owner&#8217;s control and/or information before purchasing it, or at least ask the dealership to help you ensure this gets done once the purchase is made.</p>
<p>And if you&#8217;re thinking of selling your car, it&#8217;s a good idea to clear your personal data from the vehicle first. As the <strong>U.S. Federal Trade Commission</strong> advises, some cars have a factory reset option that will return the settings and data to their original state.</p>
<p>&#8220;But even after a factory reset, you may still have work to do,&#8221; reads <a href="https://www.consumer.ftc.gov/blog/2018/08/selling-your-car-clear-your-personal-data-first" target="_blank" rel="noopener">an FTC consumer privacy notice from 2018</a>. &#8220;For example, your old car may still be connected to subscription services like satellite radio, mobile Wi-Fi hotspots, and data services. You need to cancel these services or have them transferred to your new vehicle.&#8221;</p>
<p>By the way, this issue of de-provisioning is something of a sticky wicket, and it potentially extends well beyond vehicles to a number of other &#8220;smart&#8221; devices that end up being resold or refurbished. This is doubly so for Internet-connected/capable devices whose design may give the previous owner a modicum of access to or control over the device in question regardless of what steps the new owner takes to limit such access (particularly some types of security cameras).</p>


feed_id: https://krebsonsecurity.com/?p=50407
title: Dangerous Domain Corp.com Goes Up for Sale
uri: Dangerous-Domain-Corp-com-Goes-Up-for-Sale
url: https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/
content:
<p>As an early domain name investor, <strong>Mike O&#8217;Connor</strong> had by 1994 snatched up several choice online destinations, including bar.com, cafes.com, grill.com, place.com, pub.com and television.com. Some he sold over the years, but for the past 26 years O&#8217;Connor refused to auction perhaps the most sensitive domain in his stable &#8212; <strong>corp.com</strong>. It is sensitive because years of testing shows whoever wields it would have access to an unending stream of passwords, email and other proprietary data belonging to hundreds of thousands of systems at major companies around the globe.</p>
<p><img class="aligncenter wp-image-50460" src="media/0797eaa8.corpcomtoxic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/corpcomtoxic.png" alt="" width="591" height="158" /></p>
<p>Now, facing 70 and seeking to simplify his estate, O&#8217;Connor is finally selling corp.com. The asking price &#8212; $1.7 million &#8212; is hardly outlandish for a 4-letter domain with such strong commercial appeal. O&#8217;Connor said he hopes <strong>Microsoft Corp.</strong> will buy it, but fears they won&#8217;t and instead it will get snatched up by someone working with organized cybercriminals or state-funded hacking groups bent on undermining the interests of Western corporations.</p>
<p>One reason O&#8217;Connor hopes Microsoft will buy it is that by virtue of the unique way that Windows handles resolving domain names on a local network, virtually all of the computers trying to share sensitive data with corp.com are somewhat confused <strong>Windows</strong> PCs. More importantly, early versions of Windows actually encouraged the adoption of insecure settings that made it more likely Windows computers might try to share sensitive data with corp.com.</p>
<p>At issue is a problem known as &#8220;<a href="https://www.computerworld.com/article/3480799/icann-seeks-to-tackle-dns-namespace-collision-risks.html" target="_blank" rel="noopener">namespace collision</a>,&#8221; a situation where domain names intended to be used exclusively on an internal company network end up overlapping with domains that can resolve normally on the open Internet.</p>
<p>Windows computers on an internal corporate network validate other things on that network using a Microsoft innovation called <a href="https://en.wikipedia.org/wiki/Active_Directory" target="_blank" rel="noopener">Active Directory</a>, which is the umbrella term for a broad range of identity-related services in Windows environments. A core part of the way these things find each other involves a Windows feature called &#8220;<a href="https://www.itprotoday.com/security/whats-dns-name-devolution" target="_blank" rel="noopener">DNS name devolution</a>,&#8221; which is a kind of network shorthand that makes it easier to find other computers or servers without having to specify a full, legitimate domain name for those resources.</p>
<p>For instance, if a company runs an internal network with the name internalnetwork.example.com, and an employee on that network wishes to access a shared drive called &#8220;drive1,&#8221; there&#8217;s no need to type &#8220;drive1.internalnetwork.example.com&#8221; into Windows Explorer; typing &#8220;\\drive1\&#8221; alone will suffice, and Windows takes care of the rest.</p>
<p>But things can get far trickier with an internal Windows domain that does not map back to a second-level domain the organization actually owns and controls. And unfortunately, in early versions of Windows that supported Active Directory &#8212; Windows 2000 Server, for example &#8212; the default or example Active Directory path was given as &#8220;corp,&#8221; and many companies apparently adopted this setting without modifying it to include a domain they controlled.</p>
<p>Compounding things further, some companies then went on to build (and/or assimilate) vast networks of networks on top of this erroneous setting.</p>
<p>Now, none of this was much of a security concern back in the day when it was impractical for employees to lug their bulky desktop computers and monitors outside of the corporate network. But what happens when an employee working at a company with an Active Directory network path called &#8220;corp&#8221; takes a company laptop to the local Starbucks?</p>
<p>Chances are good that at least some resources on the employee&#8217;s laptop will still try to access that internal &#8220;corp&#8221; domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at &#8220;corp.com.&#8221;</p>
<p>In practical terms, this means that whoever controls corp.com can passively intercept private communications from hundreds of thousands of computers that end up being taken outside of a corporate environment which uses this &#8220;corp&#8221; designation for its Active Directory domain.</p>
<h4>INSTANT CORPORATE BOTNET, ANYONE?</h4>
<p>That&#8217;s according to <strong>Jeff Schmidt</strong>, a security expert who <a href="media/370dcb63.name-collision-mitigation-study-06jun14-en.pdf" data-original-source="https://www.icann.org/en/system/files/files/name-collision-mitigation-study-06jun14-en.pdf" target="_blank" rel="noopener">conducted a lengthy study on DNS namespace collisions</a> funded in part by grants from the <strong>U.S. Department of Homeland Security</strong>. As part of that analysis, Schmidt convinced O&#8217;Connor to hold off selling corp.com so he and others could better understand and document the volume and types of traffic flowing to it each day.</p>
<p>During an eight month analysis of wayward internal corporate traffic destined for corp.com in 2019, Schmidt found more than 375,000 Windows PCs were trying to send this domain information it had no business receiving &#8212; including attempts to log in to internal corporate networks and access specific file shares on those networks.</p>
<p>For a brief period during that testing, Schmidt&#8217;s company <strong>JAS Global Advisors</strong> accepted connections at corp.com that mimicked the way local Windows networks handle logins and file-sharing attempts.</p>
<p>&#8220;It was terrifying,&#8221; Schmidt said. &#8220;We discontinued the experiment after 15 minutes and destroyed the data. A well-known offensive tester that consulted with JAS on this remarked that during the experiment it was &#8216;raining credentials&#8217; and that he&#8217;d never seen anything like it.&#8221;</p>
<p>Likewise, JAS temporarily configured corp.com to accept incoming email.</p>
<p>&#8220;After about an hour we received in excess of 12 million emails and discontinued the experiment,&#8221; Schmidt said. &#8220;While the vast majority of the emails were of an automated nature, we found some of the emails to be sensitive and thus destroyed the entire corpus without further analysis.&#8221;</p>
<p>Schmidt said he and others concluded that whoever ends up controlling corp.com could have an instant botnet of well-connected enterprise machines.</p>
<p>&#8220;Hundreds of thousands of machines directly exploitable and countless more exploitable via lateral movement once in the enterprise,&#8221; he said. &#8220;Want an instant foothold into about 30 of the world’s largest companies according to the Forbes Global 2000? Control corp.com.&#8221;<span id="more-50407"></span></p>
<h4>THE EARLY ADVENTURES OF CORP.COM</h4>
<p>Schmidt&#8217;s findings closely mirror what O&#8217;Connor discovered in the few years corp.com was live on the Internet after he initially registered it back in 1994. O&#8217;Connor said early versions of a now-defunct Web site building tool called Microsoft FrontPage suggested corporation.com (another domain registered early on by O&#8217;Connor) as an example domain in its setup wizard.</p>
<p>That experience, portions of which are <a href="https://web.archive.org/web/19971016071741/http://www.corp.com/" target="_blank" rel="noopener">still indexed by the indispensable Internet Archive</a>, saw O&#8217;Connor briefly redirecting queries for the domain to the Web site of a local adult sex toy shop as a joke. He soon got angry emails from confused people who&#8217;d also CC&#8217;d Microsoft co-founder Bill Gates.</p>
<div id="attachment_50459" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/7c723ef7.corpcomarchive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/corpcomarchive.png"><img class="wp-image-50459" src="media/7c723ef7.corpcomarchive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/corpcomarchive.png" alt="" width="596" height="229" /></a><p class="wp-caption-text">Archive.org&#8217;s index of corp.com from 1997, when its owner Mike O&#8217;Connor briefly enabled a Web site mainly to shame Microsoft for the default settings of its software.</p></div>
<p>O&#8217;Connor said he also briefly enabled an email server on corp.com, mainly out of morbid curiosity to see what would happen next.</p>
<p>&#8220;Right away I started getting sensitive emails, including pre-releases of corporate financial filings with The U.S. Securities and Exchange Commission, human resources reports and all kinds of scary things,&#8221; O&#8217;Connor recalled in an interview with KrebsOnSecurity. &#8220;For a while, I would try to correspond back to corporations that were making these mistakes, but most of them didn&#8217;t know what to do with that. So I finally just turned it off.&#8221;</p>
<h4>TOXIC WASTE CLEANUP IS HARD</h4>
<p>Microsoft declined to answer specific questions in response to Schmidt&#8217;s findings on the wayward corp.com traffic. But a spokesperson for the company shared a written statement acknowledging that &#8220;we sometimes reference &#8216;corp&#8217; as a label in our naming documentation.&#8221;</p>
<p>&#8220;We recommend customers own second level domains to prevent being routed to the internet,&#8221; the statement reads, linking to <a href="https://social.technet.microsoft.com/wiki/contents/articles/34981.active-directory-best-practices-for-internal-domain-and-network-names.aspx" target="_blank" rel="noopener">this Microsoft Technet article</a> on best practices for setting up domains in Active Directory.</p>
<p>Over the years, Microsoft has shipped <a href="https://www.security-database.com/detail.php?alert=KB971888" target="_blank" rel="noopener">several</a> <a href="https://msrc-blog.microsoft.com/2015/02/10/ms15-011-ms15-014-hardening-group-policy/" target="_blank" rel="noopener">software updates</a> to help decrease the likelihood of namespace collisions that <a href="https://www.jasadvisors.com/jasbug-improper-use-of-the-dns-for-authentication-and-over-the-internet-exploitation-scenarios/" target="_blank" rel="noopener">could create a security problem</a> for companies that still rely on Active Directory domains that do not map to a domain they control.</p>
<p>But both O&#8217;Connor and Schmidt say hardly any vulnerable organizations have deployed these fixes for two reasons. First, doing so requires the organization to take down its entire Active Directory network simultaneously for some period of time. Second, according to Microsoft applying the patch(es) will likely break or at least slow down a number of applications that the affected organization relies upon for day-to-day operations.</p>
<p>Faced with either or both of these scenarios, most affected companies probably decided the actual risk of not applying these updates was comparatively low, O&#8217;Connor said.</p>
<p>&#8220;The problem is that when you read the instructions for doing the repair, you realize that what they&#8217;re saying is, &#8216;Okay Megacorp, in order to apply this patch and for everything to work right, you have to take down all of your Active Directory services network-wide, and when you bring them back up after you applied the patch, a lot of your servers may not work properly&#8217;,&#8221; O&#8217;Connor said.</p>
<p>Curiously, Schmidt shared slides from a report submitted to a working group on namespace collisions suggesting that at least some of the queries corp.com received while he was monitoring it may have come from Microsoft&#8217;s own internal networks.</p>
<div id="attachment_50457" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/37de91b6.mscollision.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/mscollision.png"><img class="wp-image-50457" src="media/37de91b6.mscollision.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/mscollision.png" alt="" width="592" height="335" /></a><p class="wp-caption-text">Image: JAS Global Advisors</p></div>
<p>&#8220;The reason I believe this is Microsoft’s issue to solve is that someone that followed Microsoft&#8217;s recommendations when establishing an active directory several years back now has a problem,&#8221; Schmidt said.</p>
<p>&#8220;Even if all patches are applied and updated to Windows 10,&#8221; he continued. &#8220;And the problem will persist while there are active directories named ‘corp’ – which is forever. More practically, if corp.com falls into bad hands, the impact will be on Microsoft enterprise clients – and at large scale – paying, Microsoft clients they should protect.&#8221;</p>
<p>Asked why he didn&#8217;t just give corp.com to Microsoft as an altruistic gesture, O&#8217;Connor said the software giant ought to be accountable for its products and mistakes.</p>
<p>&#8220;It seems to me that Microsoft should stand up and shoulder the burden of the mistake they made,&#8221; he said. &#8220;But they&#8217;ve shown no real interest in doing that, and so I&#8217;ve shown no interest in giving it to them. I don&#8217;t really need the money. I&#8217;m basically auctioning off a chemical waste dump because I don&#8217;t want to pass it on to my kids and burden them with it. My frustration here is the good guys don&#8217;t care and the bad guys probably don&#8217;t know about it. But I expect the bad guys would like it.&#8221;</p>
<p>Further reading:</p>
<p><a href="media/370dcb63.name-collision-mitigation-study-06jun14-en.pdf" data-original-source="https://www.icann.org/en/system/files/files/name-collision-mitigation-study-06jun14-en.pdf" target="_blank" rel="noopener">Mitigating the Risk of DNS Namespace Collisions</a> (PDF)</p>
<p><a href="https://www.youtube.com/watch?v=ZPbyDSvGasw" target="_blank" rel="noopener">DEFCON 21 &#8211; DNS May Be Hazardous to your Health (Robert Stucke)</a></p>
<p><a href="media/416e2489.alysis-and-WPAD-Vulnerability-Assessment-in-the-New-gTLD-Era.pdf" data-original-source="https://www.verisign.com/assets/labs/MitM-Attack-by-Name-Collision-Cause-Analysis-and-WPAD-Vulnerability-Assessment-in-the-New-gTLD-Era.pdf" target="_blank" rel="noopener">Mitigating the Risk of Name Collision-Based Man-in-the-Middle Attacks</a> (PDF)</p>


feed_id: https://krebsonsecurity.com/?p=50492
title: U.S. Charges 4 Chinese Military Officers in 2017 Equifax Hack
uri: U-S-Charges-4-Chinese-Military-Officers-in-2017-Equifax-Hack
url: https://krebsonsecurity.com/2020/02/u-s-charges-4-chinese-military-officers-in-2017-equifax-hack/
content:
<p>The <strong>U.S. Justice Department</strong> today unsealed indictments against four Chinese officers of the <strong>People&#8217;s Liberation Army</strong> (PLA) accused of perpetrating the 2017 hack against consumer credit bureau <strong>Equifax</strong> that led to the theft of personal data on nearly 150 million Americans. DOJ officials said the four men were responsible for carrying out the largest theft of sensitive personal information by state-sponsored hackers ever recorded.</p>
<p><img class="alignright wp-image-50499" src="media/ab414e20.eqindict.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/eqindict.png" alt="" width="249" height="316" />The nine-count indictment names <strong>Wu Zhiyong</strong> (吴志勇), <strong>Wang Qian</strong> (王乾), <strong>Xu Ke</strong> (许可) and <strong>Liu Lei</strong> (刘磊) as members of the PLA’s 54<sup>th</sup> Research Institute, a component of the Chinese military. They are each charged with three counts of conspiracy to commit computer fraud, economic espionage and wire fraud.</p>
<p>The government says the men disguised their hacking activity by routing attack traffic through 34 servers located in nearly 20 countries, using encrypted communications channels within Equifax&#8217;s network to blend in with normal network activity, and deleting log files daily to remove evidence of their meanderings through the company&#8217;s systems.</p>
<p><strong>U.S. Attorney General Bill Barr</strong> said at a press conference today that the Justice Department doesn&#8217;t normally charge members of another country&#8217;s military with crimes (this is only the second time the agency has indicted Chinese military hackers). But in a carefully worded statement that seemed designed to deflect any criticism of past offensive cyber actions by the U.S. military against foreign targets, Barr said the DOJ did so in this case because the accused &#8220;indiscriminately&#8221; targeted American civilians on a massive scale.</p>
<p>&#8220;The United States, like other nations, has gathered intelligence throughout its history to ensure that national security and foreign policy decision makers have access to timely, accurate and insightful information,&#8221; Barr said. &#8220;But we collect information only for legitimate national security purposes. We don&#8217;t indiscriminately violate the privacy of ordinary citizens.&#8221;</p>
<p><strong>FBI Deputy Director David Bowdich</strong> sought to address the criticism about the wisdom of indicting Chinese military officers for attacking U.S. commercial and government interests. Some security experts <a href="https://www.wired.com/2014/05/us-indictments-of-chinese-military-hackers-could-be-awkward-for-nsa/" target="_blank" rel="noopener">have charged</a> that such indictments could both lessen the charges&#8217; impact and leave American officials open to parallel criminal allegations from Chinese authorities.</p>
<p>&#8220;Some might wonder what good it does when these hackers are seemingly beyond our reach,&#8221; Bowdich said. &#8220;We answer this question all the time. We can&#8217;t take them into custody, try them in a court of law and lock them up. Not today, anyway. But one day these criminals will slip up, and when they do we&#8217;ll be there. We in law enforcement will not let hackers off the hook just because they&#8217;re halfway around the world.&#8221;</p>
<p>The attorney general said the attack on Equifax was just the latest in a long string of cyber espionage attacks that sought trade secrets and sensitive data from a broad range of industries, and including managed service providers and their clients worldwide, as well as U.S. companies in the nuclear power, metals and solar products industries.</p>
<p>&#8220;Indeed, about 80 percent of our economic espionage prosecutions have implicated the Chinese government, and about 60 percent of all trade secret thefts cases in recent years involved some connection with China,&#8221; he said.</p>
<p>The indictments come on the heels of a conference held by US government officials this week that detailed the breadth of hacking attacks involving the theft of intellectual property by Chinese entities.</p>
<p>&#8220;The FBI has about a thousand investigations involving China&#8217;s attempted theft of U.S.-based technology in all 56 of our field offices and spanning just about every industry and sector,&#8221; <strong>FBI Director Christopher Wray</strong> <a href="https://www.zdnet.com/article/fbi-is-investigating-more-than-1000-cases-of-chinese-theft-of-us-technology/" target="_blank" rel="noopener">reportedly</a> told attendees at the gathering in Washington, D.C., dubbed the &#8220;China Initiative Conference.&#8221;</p>
<p>At a time when increasingly combative trade relations with China combined with public fears over the ongoing Coronavirus flu outbreak are <a href="https://www.marketwatch.com/story/no-chinese-allowed-racism-and-fear-are-now-spreading-along-with-the-coronavirus-2020-01-29" target="_blank" rel="noopener">stirring Sinophobia</a> in some pockets of the U.S. and other countries, Bowdich was quick to clarify that the DOJ&#8217;s beef was with the Chinese government, not its citizenry.</p>
<p>&#8220;Our concern is not with the Chinese people or with the Chinese American,&#8221; he said. &#8220;It is with the Chinese government and the Chinese Communist Party. Confronting this threat directly doesn&#8217;t mean we should not do business with China, host Chinese students, welcome Chinese visitors or co-exist with China as a country on the world stage. What it does mean is when China violates our criminal laws and international norms, we will hold them accountable for it.&#8221;</p>
<p>A copy of the indictment is available <a href="https://www.justice.gov/opa/press-release/file/1246891/download" target="_blank" rel="noopener">here</a>.</p>
<h4>ANALYSIS</h4>
<p>DOJ officials praised Equifax for their &#8220;close collaboration&#8221; in sharing data that helped investigators piece together this whodunnit. Attorney General Barr noted that the accused not only stole personal and in some cases financial data on Americans, they also stole Equifax&#8217;s trade secrets, which he said were &#8220;embodied by the compiled data and complex database designs used to store personal information.&#8221;</p>
<p>While the DOJ&#8217;s announcement today portrays Equifax in a somewhat sympathetic light, it&#8217;s important to remember that Equifax repeatedly has proven itself an extremely poor steward of the highly sensitive information that it holds on most Americans.</p>
<p>Equifax&#8217;s actions immediately before and after <a href="https://krebsonsecurity.com/2017/09/breach-at-equifax-may-impact-143m-americans/" target="_blank" rel="noopener">its breach disclosure on Sept 7, 2017</a> revealed a company so inept at managing its public response that one couldn&#8217;t help but wonder how it might have handled its internal affairs and security. Indeed, Equifax and its leadership careened from one feckless blunder to the next in a series of debacles that KrebsOnSecurity described at the time as a complete &#8220;<a href="https://krebsonsecurity.com/2017/09/equifax-breach-response-turns-dumpster-fire/" target="_blank" rel="noopener">dumpster fire</a>&#8221; of a breach response.<span id="more-50492"></span></p>
<p>For starters, the Web site that Equifax set up to let consumers check if they were affected by the breach consistently gave conflicting answers, and was initially flagged by some Web browsers as a potential phishing site.</p>
<p>Compounding the confusion, on Sept. 19, 2017, Equifax&#8217;s Twitter account told people looking for information about the breach to visit the wrong Web site, which also was blocked by multiple browsers as a phishing site.</p>
<p><img class="wp-image-40815 aligncenter" src="media/82052a03.equiphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish.png" alt="" width="596" height="246" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish.png 1264w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish-580x240.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish-768x317.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equiphish-940x388.png 940w" sizes="(max-width: 596px) 100vw, 596px" /></p>
<p>And two weeks after its breach disclosure, Equifax began notifying consumers of their eligibility to enroll in free credit monitoring &#8212; but the messages did not come from Equifax&#8217;s domain and were <a href="https://krebsonsecurity.com/2017/09/equifax-or-equiphish/" target="_blank" rel="noopener">in many other ways indistinguishable from a phishing attempt</a>.</p>
<p>It soon emerged the intruders had gained access to Equifax&#8217;s systems by attacking a software vulnerability in an Internet-facing server that had been left unpatched for four months after security experts warned that the flaw was being broadly exploited. We also learned that the server in question was tied to an online dispute portal at Equifax, which the intruders quickly seeded with tools that allowed them to maintain access to the credit bureau&#8217;s systems.</p>
<p>This is especially notable because on Sept. 12, 2017 &#8212; just five days after Equifax went public with its breach &#8212; KrebsOnSecurity <a href="https://krebsonsecurity.com/2017/09/ayuda-help-equifax-has-my-data/" target="_blank" rel="noopener">broke the news</a> that the administrative account for a separate Equifax dispute resolution portal catering to consumers in Argentina was wide open, protected by perhaps the most easy-to-guess password combination ever: &#8220;admin/admin.&#8221;</p>
<div id="attachment_40759" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/79dbd912.equifaxusers-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/equifaxusers-red.png"><img class="wp-image-40759" src="media/79dbd912.equifaxusers-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/equifaxusers-red.png" alt="" width="594" height="221" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/equifaxusers-red.png 1892w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equifaxusers-red-580x216.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equifaxusers-red-768x286.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/09/equifaxusers-red-940x350.png 940w" sizes="(max-width: 594px) 100vw, 594px" /></a><p class="wp-caption-text">A partial list of active and inactive Equifax employees in Argentina. This page also let anyone add or remove users at will, or modify existing user accounts.</p></div>
<p>Perhaps we all should have seen this megabreach coming. In May 2017, KrebsOnSecurity detailed how countless employees at many major U.S. companies suffered tax refund fraud with the IRS thanks to <a href="https://krebsonsecurity.com/2017/05/fraudsters-exploited-lax-security-at-equifaxs-talx-payroll-division/" target="_blank" rel="noopener">a laughably insecure portal at Equifax&#8217;s <strong>TALX</strong> payroll division</a>, which provides online payroll, HR and tax services to thousands of U.S. firms.</p>
<div id="attachment_39423" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-39423" src="media/85dc0345.equifaxwfs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs.png" alt="" width="593" height="376" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs.png 1418w, https://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs-580x368.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs-768x487.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/05/equifaxwfs-940x596.png 940w" sizes="(max-width: 593px) 100vw, 593px" /><p class="wp-caption-text">Equifax&#8217;s TALX &#8212; now called Equifax Workforce Solutions &#8212; aided tax thieves by relying on outdated and insufficient consumer authentication methods.</p></div>
<p>In October 2017, KrebsOnSecurity showed how easy it was to learn the complete salary history of a large portion of Americans simply by knowing someone&#8217;s Social Security number and date of birth, <a href="https://krebsonsecurity.com/2017/10/equifax-breach-fallout-your-salary-history/" target="_blank" rel="noopener">thanks to yet another Equifax portal</a>.</p>
<p>Around that same time, we also learned that at least two Equifax executives sought to profit from the disaster through insider trading just days prior to the breach announcement. <strong>Jun Ying</strong>, Equifax&#8217;s former chief information officer, dumped all of his stock in the company in late August 2017, realizing a gain of $480,000 and avoiding a loss of more than $117,000 when news of the breach dinged Equifax&#8217;s stock price.</p>
<p><strong>Sudhakar Reddy Bonthu</strong>, a former manager at Equifax who was contracted to help the company with its breach response, bought 86 &#8220;put&#8221; options in Equifax stock on Sept. 1, 2017 that allowed him to profit when the company&#8217;s share price dropped. Bonthu was <a href="https://www.justice.gov/usao-ndga/pr/former-equifax-manager-sentenced-insider-trading" target="_blank" rel="noopener">later sentenced</a> to eight months of home confinement; Ying <a href="https://www.justice.gov/usao-ndga/pr/former-equifax-employee-sentenced-insider-trading" target="_blank" rel="noopener">got four months in prison</a> and one year of supervised release. Both were fined and/or ordered to pay back their ill-gotten gains.</p>
<p>While Equifax&#8217;s stock price took a steep hit in the months following its breach disclosure, shares in the company [<a href="https://www.marketwatch.com/investing/stock/efx" target="_blank" rel="noopener">NYSE:EFX</a>] <a href="https://www.fool.com/investing/2020/01/12/why-equifax-stock-climbed-505-in-2019.aspx" target="_blank" rel="noopener">gained a whopping 50.5% in 2019</a>, according to data from <strong>S&amp;P Global Market Intelligence</strong>.</p>
<p>KrebsOnSecurity has long maintained that the 2017 breach at Equifax was not the work of financially-motivated identity thieves, as there has been exactly zero evidence to date that anything close to the size of the data cache stolen from that incident has shown up for sale in the cybercrime underground.</p>
<p>However, readers should understand that there are countless other companies with access to SSN, DOB and other information crooks need to apply for credit in your name that get hacked all the time, and that this data on a great many Americans is already for sale across various cybercrime bazaars.</p>
<p>Readers also should know that while identity theft protection services of the kind offered by Equifax and other companies may alert you if crooks open a new line of credit in your name, these services generally do nothing to stop that identity theft from taking place. ID theft protection services are most useful in helping people recover from such crimes.</p>
<p>As such, KrebsOnSecurity continues to encourage readers to place a freeze on their credit files with Equifax and the other major credit bureaus. This process puts you in control over who gets to grant credit in your name. Placing a freeze is now free for all Americans and their dependents. For more information on how to do that and what to expect from a freeze, <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">please see this primer</a>.</p>


feed_id: https://krebsonsecurity.com/?p=50414
title: Microsoft Patch Tuesday, February 2020 Edition
uri: Microsoft-Patch-Tuesday-February-2020-Edition
url: https://krebsonsecurity.com/2020/02/microsoft-patch-tuesday-february-2020-edition/
content:
<p><strong>Microsoft</strong> today released updates to plug nearly 100 security holes in various versions of its <strong>Windows</strong> operating system and related software, including a zero-day vulnerability in <strong>Internet Explorer</strong> (IE) that is actively being exploited. Also, <strong>Adobe</strong> has issued a bevy of security updates for its various products, including <strong>Flash Player</strong> and <strong>Adobe Reader/Acrobat</strong>.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />A dozen of the vulnerabilities Microsoft patched today are rated &#8220;critical,&#8221; meaning malware or miscreants could exploit them remotely to gain complete control over an affected system with little to no help from the user.</p>
<p>Last month, Microsoft released an advisory warning that attackers were exploiting a previously unknown flaw in IE. That vulnerability, assigned as <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0674" target="_blank" rel="noopener">CVE-2020-0674</a>, has been patched with this month&#8217;s release. It could be used to install malware just by getting a user to browse to a malicious or hacked Web site.</p>
<p>Microsoft once again fixed a critical flaw in the way Windows handles shortcut (.lnk) files (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0729" target="_blank" rel="noopener">CVE-2020-0729</a>) that affects <strong>Windows 8</strong> and <strong>10</strong> systems, as well as <strong>Windows Server 2008-2012</strong>. <strong>Allan Liska</strong>, intelligence analyst at <strong>Recorded Future</strong>, says Microsoft considers exploitation of the vulnerability unlikely, but that a similar vulnerability discovered last year, <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1280" target="_blank" rel="noopener">CVE-2019-1280</a>, was being actively exploited by the <a href="https://www.cyber.nj.gov/threat-profiles/trojan-variants/astaroth" target="_blank" rel="noopener">Astaroth trojan</a> as recently as September.</p>
<p>Another flaw fixed this month in <strong>Microsoft Exchange 2010</strong> through <strong>2019</strong> may merit special attention. The bug could allow attackers to exploit the Exchange Server and execute arbitrary code just by sending a specially crafted email. This vulnerability (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688" target="_blank" rel="noopener">CVE-2020-0688</a>) is rated &#8220;important&#8221; rather than &#8220;critical,&#8221; but Liska says it seems potentially dangerous, as Microsoft identifies this as a vulnerability that is likely to be exploited.</p>
<p>In addition, Redmond addressed a critical issue (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0618" target="_blank" rel="noopener">CVE-2020-0618</a>) in the way <strong>Microsoft SQL Server</strong> versions 2012-2016 handle page requests.</p>
<p>After a several-month respite from patches for its Flash Player browser plug-in, Adobe has once again blessed us with a security update for this program (fixes <a href="https://helpx.adobe.com/security/products/flash-player/apsb20-06.html" target="_blank" rel="noopener">one critical flaw</a>). Thankfully, <strong>Chrome</strong> and <strong>Firefox</strong> both now disable Flash by default, and Chrome and <strong>IE/Edg</strong>e auto-update the program when new security updates are available. Adobe is slated to retire Flash Player later this year.<span id="more-50414"></span></p>
<p>Other Adobe products for which the company shipped updates today include <strong>Experience Manager</strong>, <strong>Digital Editions</strong>, <strong>Framemaker</strong> and <strong>Acrobat/Reader </strong>(<a href="https://helpx.adobe.com/security/products/acrobat/apsb20-05.html" target="_blank" rel="noopener">17 flaws</a>). Security experts at <strong>Qualys</strong> note that on January 28th, Adobe also issued <a href="https://helpx.adobe.com/security/products/magento/apsb20-02.html" target="_blank" rel="noopener">an out-of-band patch</a> for <strong>Magento</strong>, labeled as Priority 2.</p>
<p>&#8220;While none of the vulnerabilities disclosed in Adobe’s release are known to be Actively Attacked today, all patches should be prioritized on systems with these products installed,&#8221; said Qualys&#8217;s <strong>Jimmy Graham</strong>.</p>
<p>Windows 7 users should be aware by now that while a fair number of flaws addressed this month by Microsoft affect Windows 7 systems, this operating system is no longer being supported with security updates (unless you&#8217;re an enterprise taking advantage of Microsoft&#8217;s <a href="https://support.microsoft.com/en-us/help/4527878/faq-about-extended-security-updates-for-windows-7" target="_blank" rel="noopener">paid extended security updates program</a>, which is available to Windows 7 Professional and Windows 7 enterprise users).</p>
<p>If you rely on Windows 7 for day-to-day use, it’s probably time to think about upgrading to something newer. That might be a computer with Windows 10. Or maybe you have always wanted that shiny MacOS computer.</p>
<p>If cost is a primary motivator and the user you have in mind doesn’t do much with the system other than browsing the Web, perhaps a <strong>Chromebook</strong> or an older machine with a recent version of <strong>Linux</strong> is the answer (Ubuntu may be easiest for non-Linux natives). Whichever system you choose, it’s important to pick one that fits the owner’s needs and provides security updates on an ongoing basis.</p>
<p>Keep in mind that while staying up-to-date on Windows patches is a must, it’s important to make sure you’re updating only after you’ve backed up your important data and files. A reliable backup means you’re not losing your mind when the odd buggy patch causes problems booting the system.</p>
<p>So do yourself a favor and backup your files before installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips. Also, keep an eye on the <a href="https://www.askwoody.com/2020/february-2020-patch-tuesday-foibles/" target="_blank" rel="noopener">AskWoody blog</a> from <strong>Woody Leonhard</strong>, who keeps a close eye on buggy Microsoft updates each month.</p>


feed_id: https://krebsonsecurity.com/?p=50518
title: A Light at the End of Liberty Reserve’s Demise?
uri: A-Light-at-the-End-of-Liberty-Reserve-s-Demise
url: https://krebsonsecurity.com/2020/02/a-light-at-the-end-of-liberty-reserves-demise/
content:
<p>In May 2013, the <strong>U.S. Justice Department </strong>seized <strong>Liberty Reserve</strong>, alleging the virtual currency service <a href="https://krebsonsecurity.com/2013/05/u-s-government-seizes-libertyreserve-com/" target="_blank" rel="noopener">acted as a $6 billion financial hub for the cybercrime world</a>. Prompted by assurances that the government would one day afford Liberty Reserve users a chance to reclaim any funds seized as part of the takedown, KrebsOnSecurity filed a claim shortly thereafter to see if and when this process might take place. This week, an investigator with the <strong>U.S. Internal Revenue</strong> service finally got in touch to discuss my claim.</p>
<p><img class="aligncenter wp-image-50526" src="media/cf2ac00b.lr-cracked.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/lr-cracked.png" alt="" width="598" height="221" /></p>
<p>Federal officials charged that Liberty Reserve facilitated a &#8220;broad range of criminal activity, including credit card fraud, identity theft, investment fraud, computer hacking, child pornography, and narcotics trafficking.&#8221; The government says from 2006 until the service&#8217;s takedown, Liberty Reserve processed an estimated 55 million financial transactions worth more than $6 billion, with more than 600,000 accounts associated with users in the United States alone.</p>
<p>While it&#8217;s clear that the digital currency system for years was the go-to money-moving vehicle for many engaged in dodgy online activities, it also was favored by users primarily because it offered a relatively anonymous way to send irrevocable transfers globally with low fees.</p>
<p>Indeed, the <a href="https://krebsonsecurity.com/2013/05/u-s-government-seizes-libertyreserve-com/" target="_blank" rel="noopener">two</a> <a href="https://krebsonsecurity.com/2013/05/reports-liberty-reserve-founder-arrested-site-shuttered/" target="_blank" rel="noopener">stories</a> I wrote about the closure of Liberty Reserve in 2013 remain among the most-read on this site, and have generated an enormous volume of emails from readers who saw many thousands of dollars held in legal limbo &#8212; much of it related to investments in online gaming platforms, payments to and from adult entertainment services, and various investment schemes.</p>
<p>The IRS official who contacted me was not authorized to be quoted in the media (and indeed did not initially realize he was speaking to a member of the press when he called). But he told me the government had recently obtained legal access to some of the funds held in overseas bank accounts that were used by Liberty Reserve, and that IRS investigators were now starting to contact people and vet any claims made in the wake of the takedown.</p>
<p>&#8220;We&#8217;re just getting to the point where we have received funds,&#8221; the investigator said. &#8220;We&#8217;ve started to contact people who originally contacted us, to vet their claims, make sure they weren&#8217;t involved in any illegal activity, and that the claim amounts match the records that we have.&#8221;<span id="more-50518"></span></p>
<p>The official said he didn&#8217;t know how much money in total the government was seeking to return to former Liberty Reserve users. Requests for this information from the Justice Department office that prosecuted the case &#8212; the <strong>U.S. Attorney for the Southern District of New York</strong> &#8212; went unanswered.</p>
<p>The founder of Liberty Reserve, 45-year-old <strong>Arthur Budovsky</strong>, pleaded guilty in 2016 to conspiring to commit money laundering. He was sentenced to 20 years in prison, ordered to pay a $500,000 fine and forfeit $122 million in company funds.</p>
<p>If you filed a monetary claim in response to the Liberty Reserve seizure years back, you may have already been contacted by federal investigators, or you may be soon. But please know that fraudsters will likely seize on public awareness about the possible repatriation of funds to fleece the unwary: KrebsOnSecurity has received more than a few emails from readers over the years who fell for various phishing scams that promised to return funds lost at Liberty Reserve in exchange for a bogus &#8220;processing fee.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=50522
title: Pay Up, Or We’ll Make Google Ban Your Ads
uri: Pay-Up-Or-We-ll-Make-Google-Ban-Your-Ads
url: https://krebsonsecurity.com/2020/02/pay-up-or-well-make-google-ban-your-ads/
content:
<p>A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google&#8217;s <strong>AdSense</strong> program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher&#8217;s ads with so much bot and junk traffic that Google&#8217;s automated anti-fraud systems suspend the user&#8217;s AdSense account for suspicious traffic.</p>
<div id="attachment_50541" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/bbfdf2a1.adsense-extortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/adsense-extortion.png"><img class="wp-image-50541" src="media/bbfdf2a1.adsense-extortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/adsense-extortion.png" alt="" width="594" height="244" /></a><p class="wp-caption-text">A redacted extortion email targeting users of Google&#8217;s AdSense program.</p></div>
<p>Earlier this month, KrebsOnSecurity heard from a reader who maintains several sites that receive a fair amount of traffic. The message this reader shared began by quoting from an automated email Google&#8217;s systems might send if they detect your site is seeking to benefit from automated clicks. The message continues:</p>
<blockquote><p>&#8220;Very soon the warning notice from above will appear at the dashboard of your AdSense account undoubtedly! This will happen due to the fact that we&#8217;re about to flood your site with huge amount of direct bot generated web traffic with 100% bounce ratio and thousands of IP&#8217;s in rotation &#8212; a nightmare for every AdSense publisher. More also we&#8217;ll adjust our sophisticated bots to open, in endless cycle with different time duration, every AdSense banner which runs on your site.&#8221;</p></blockquote>
<p>The message goes on to warn that while the targeted site&#8217;s ad revenue will be briefly increased, &#8220;AdSense traffic assessment algorithms will detect very fast such a web traffic pattern as fraudulent.&#8221;</p>
<blockquote><p>&#8220;Next an ad serving limit will be placed on your publisher account and all the revenue will be refunded to advertisers. This means that the main source of profit for your site will be temporarily suspended. It will take some time, usually a month, for the AdSense to lift your ad ban, but if this happens we will have all the resources needed to flood your site again with bad quality web traffic which will lead to second AdSense ban that could be permanent!&#8221;</p></blockquote>
<p>The message demands $5,000 worth of bitcoin to forestall the attack. In this scam, the extortionists are likely betting that some publishers may see paying up as a cheaper alternative to having their main source of advertising revenue evaporate.</p>
<p>The reader who shared this email said while he considered the message likely to be a baseless threat, a review of his recent AdSense traffic statistics showed that detections in his &#8220;AdSense invalid traffic report&#8221; from the past month had increased substantially.<span id="more-50522"></span></p>
<p>The reader, who asked not to be identified in this story, also pointed to <a href="https://www.searchenginejournal.com/google-adsense-crackdown/322123/" target="_blank" rel="noopener">articles about a recent AdSense crackdown</a> in which Google announced it was enhancing its defenses by improving the systems that identify potentially <a href="https://support.google.com/adsense/answer/16737" target="_blank" rel="noopener">invalid traffic</a> or high risk activities before ads are served.</p>
<p>Google defines invalid traffic as &#8220;clicks or impressions generated by publishers clicking their own live ads,&#8221; as well as &#8220;automated clicking tools or traffic sources.&#8221;</p>
<p>&#8220;Pretty concerning, thought it seems this group is only saying they&#8217;re planning their attack,&#8221; the reader wrote.</p>
<p>Google declined to discuss this reader&#8217;s account, saying its contracts prevent the company from commenting publicly on a specific partner&#8217;s status or enforcement actions. But in a statement shared with KrebsOnSecurity, the company said the message appears to be a classic threat of sabotage, wherein an actor attempts to trigger an enforcement action against a publisher by sending invalid traffic to their inventory.</p>
<p>&#8220;We hear a lot about the potential for sabotage, it&#8217;s extremely rare in practice, and we have built some safeguards in place to prevent sabotage from succeeding,&#8221; the statement explained. &#8220;For example, we have detection mechanisms in place to proactively detect potential sabotage and take it into account in our enforcement systems.&#8221;</p>
<p>Google said it has extensive tools and processes to protect against invalid traffic across its products, and that most invalid traffic is filtered from its systems before advertisers and publishers are ever impacted.</p>
<p>&#8220;We have <a href="https://support.google.com/adsense/answer/1348739" target="_blank" rel="noopener">a help center</a> on our website with tips for AdSense publishers on sabotage,&#8221; the statement continues. &#8220;There’s also <a href="https://support.google.com/adsense/contact/invalid_clicks_contact" target="_blank" rel="noopener">a form</a> we provide for publishers to contact us if they believe they are the victims of sabotage. We encourage publishers to disengage from any communication or further action with parties that signal that they will drive invalid traffic to their web properties. If there are concerns about invalid traffic, they should communicate that to us, and our Ad Traffic Quality team will monitor and evaluate their accounts as needed.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=50515
title: Encoding Stolen Credit Card Data on Barcodes
uri: Encoding-Stolen-Credit-Card-Data-on-Barcodes
url: https://krebsonsecurity.com/2020/02/encoding-stolen-credit-card-data-on-barcodes/
content:
<p>Crooks are constantly dreaming up new ways to use and conceal stolen credit card data. According to the <strong>U.S. Secret Service</strong>, the latest scheme involves stolen card information embedded in barcodes affixed to phony money network rewards cards. The scammers then pay for merchandise by instructing a cashier to scan the barcode and enter the expiration date and card security code.</p>
<div id="attachment_50550" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/ec18b347.scanandpay.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/scanandpay.png"><img class="wp-image-50550" src="media/ec18b347.scanandpay.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/scanandpay.png" alt="" width="593" height="376" /></a><p class="wp-caption-text">This phony reloadable rewards card conceals stolen credit card data written to a barcode. The barcode and other card data printed on the card have been obfuscated. Image: U.S. Secret Service.</p></div>
<p>Earlier this month, the Secret Service documented a recent fraud incident in Texas involving a counterfeit club membership card containing a barcode, and a card expiration date and CVV printed below the barcode.</p>
<p>&#8220;Located underneath the barcode are instructions to the cashier on the steps necessary to complete the transaction,&#8221; reads an alert the Secret Service sent to law enforcement agencies. &#8220;They instruct the cashier to select card payment, scan the barcode, then enter the expiration date and CVV. In this instance, the barcode was encoded with a VISA credit card number.&#8221;<span id="more-50515"></span></p>
<p>The instructions on the phony rewards card are designed to make the cashier think it’s a payment alternative designed for use exclusively at Sam&#8217;s Club and WalMart stores. When the transaction goes through, it’s recorded as card-not-present purchase.</p>
<p>&#8220;This appears to be an evolution of the traditional card-not-present fraud, and early indications are linking this type of activity to criminal organizations of Asian descent,&#8221; the Secret Service memo observed.</p>
<p>&#8220;As a result of this emerging trend, instead of finding a large number of re-encoded credit cards during a search, a subject may only possess stickers or cards with barcodes that contain stolen card data,&#8221; the alert continues. &#8220;Additionally, the barcodes could be stored on the subject&#8217;s cell phone. If barcodes are discovered in the field, it could be beneficial to utilize a barcode scanning app to check the barcode for credit card data.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=50556
title: Hackers Were Inside Citrix for Five Months
uri: Hackers-Were-Inside-Citrix-for-Five-Months
url: https://krebsonsecurity.com/2020/02/hackers-were-inside-citrix-for-five-months/
content:
<p>Networking software giant <strong>Citrix Systems</strong> says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords.</p>
<p><a class="lightbox" href="media/cd12384c.citrix-notice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/citrix-notice.png"><img class="alignright wp-image-50561" src="media/cd12384c.citrix-notice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/citrix-notice.png" alt="" width="250" height="223" /></a></p>
<p>Citrix provides software used by hundreds of thousands of clients worldwide, including most of the Fortune 100 companies. It is perhaps best known for selling virtual private networking (VPN) software that lets users remotely access networks and computers over an encrypted connection.</p>
<p>In March 2019, the <strong>Federal Bureau of Investigation</strong> (FBI) alerted Citrix they had reason to believe cybercriminals had gained access to the company&#8217;s internal network. The FBI told Citrix the hackers likely got in using a technique called &#8220;<a href="https://resources.infosecinstitute.com/password-spraying/" target="_blank" rel="noopener">password spraying</a>,&#8221; a relatively crude but remarkably effective attack that attempts to access a large number of employee accounts (usernames/email addresses) using just a handful of common passwords.</p>
<p>In <a href="https://www.citrix.com/blogs/2019/03/08/citrix-investigating-unauthorized-access-to-internal-network/" target="_blank" rel="noopener">a statement</a> released at the time, Citrix said it appeared hackers &#8220;may have accessed and downloaded business documents,&#8221; and that it was still working to identify what precisely was accessed or stolen.</p>
<p>But in a letter sent to affected individuals dated Feb. 10, 2020, Citrix disclosed additional details about the incident. According to the letter, the attackers &#8220;had intermittent access&#8221; to Citrix&#8217;s internal network between Oct. 13, 2018 and Mar. 8, 2019, and that there was no evidence that the cybercrooks still remain in the company&#8217;s systems.</p>
<p>Citrix said the information taken by the intruders may have included Social Security Numbers or other tax identification numbers, driver&#8217;s license numbers, passport numbers, financial account numbers, payment card numbers, and/or limited health claims information, such as health insurance participant identification number and/or claims information relating to date of service and provider name.</p>
<p>It is unclear how many people received this letter, but the communication suggests Citrix is contacting a broad range of individuals who work or worked for the company at some point, as well as those who applied for jobs or internships there and people who may have received health or other benefits from the company by virtue of having a family member employed by the company.<span id="more-50556"></span></p>
<p>Citrix&#8217;s letter was prompted by laws in virtually all U.S. states that require companies to notify affected consumers of any incident that jeopardizes their personal and financial data. While the notification does not specify whether the attackers stole proprietary data about the company&#8217;s software and internal operations, the intruders certainly had ample opportunity to access at least some of that information as well.</p>
<p>Shortly after Citrix initially disclosed the intrusion in March 2019, a little-known security company <strong>Resecurity</strong> <a href="https://resecurity.com/blog/supply-chain-the-major-target-of-cyberespionage-groups/" target="_blank" rel="noopener">claimed</a> it had evidence Iranian hackers were responsible, had been in Citrix’s network for years, and had offloaded terabytes of data. Resecurity also presented evidence that it notified Citrix of the breach as early as Dec. 28, 2018, a claim Citrix initially denied but later acknowledged.</p>
<p>Iranian hackers recently have been blamed for hacking VPN servers around the world in a bid to plant backdoors in large corporate networks. A <a href="media/a2a3ac38.ClearSky-Fox-Kitten-Campaign.pdf" data-original-source="https://www.clearskysec.com/wp-content/uploads/2020/02/ClearSky-Fox-Kitten-Campaign.pdf" target="_blank" rel="noopener">report released this week</a> (PDF) by security firm <strong>ClearSky</strong> details how Iran&#8217;s government-backed hacking units have been busy exploiting security holes in popular VPN products from Citrix and a number of other software firms.</p>
<p>ClearSky says the attackers have focused on attacking VPN tools because they provide a long-lasting foothold at the targeted organizations, and frequently open the door to breaching additional companies through supply-chain attacks. The company says such tactics have allowed the Iranian hackers to gain persistent access to the networks of companies across a broad range of sectors, including IT, security, telecommunications, oil and gas, aviation, and government.</p>
<p>Among the VPN flaws available to attackers is a recently-patched vulnerability (<a href="https://nvd.nist.gov/vuln/detail/CVE-2019-19781" target="_blank" rel="noopener">CVE-2019-19781</a>) in Citrix VPN servers dubbed &#8220;Shitrix&#8221; by some in the security community. The derisive nickname may have been chosen because while Citrix <a href="https://support.citrix.com/article/CTX267027" target="_blank" rel="noopener">initially warned customers about the vulnerability in mid-December 2019</a>, it didn&#8217;t start releasing patches to plug the holes until late January 2020 &#8212; roughly two weeks after attackers started using <a href="https://www.zdnet.com/article/proof-of-concept-code-published-for-citrix-bug-as-attacks-intensify/" target="_blank" rel="noopener">publicly released exploit code</a> to break into vulnerable organizations.</p>
<p>How would your organization hold up to a password spraying attack? As the Citrix hack shows, if you don’t know you should probably check, and then act on the results accordingly. It&#8217;s a fair bet the bad guys are going to find out even if you don’t.</p>


feed_id: https://krebsonsecurity.com/?p=50574
title: Zyxel Fixes 0day in Network Storage Devices
uri: Zyxel-Fixes-0day-in-Network-Storage-Devices
url: https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/
content:
<h4>Patch comes amid active exploitation by ransomware gangs</h4>
<p>Networking hardware vendor <strong>Zyxel</strong> today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground.</p>
<p>Based in Taiwan, <a href="https://www.zyxel.com/us/en/" target="_blank" rel="noopener">Zyxel Communications Corp.</a> (a.k.a &#8220;ZyXEL&#8221;) is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things (IoT) devices, the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale.</p>
<p>KrebsOnSecurity first learned about the flaw on Feb. 12 from <strong>Alex Holden</strong>, founder of Milwaukee-based security firm <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>. Holden had obtained a copy of the exploit code, which allows an attacker to remotely compromise more than a dozen types of Zyxel NAS products remotely without any help from users.</p>
<div id="attachment_50575" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/77cefba7.zyxel-0dayinstructions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/zyxel-0dayinstructions.png"><img class="wp-image-50575" src="media/77cefba7.zyxel-0dayinstructions.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/zyxel-0dayinstructions.png" alt="" width="599" height="256" /></a><p class="wp-caption-text">A snippet from the documentation provided by 500mhz for the Zyxel 0day.</p></div>
<p>Holden said the seller of the exploit code &#8212; a ne&#8217;er-do-well who goes by the nickname &#8220;<strong>500mhz</strong>&#8221; &#8211;is known for being reliable and thorough in his sales of 0day exploits (a.k.a. &#8220;zero-days,&#8221; these are vulnerabilities in hardware or software products that vendors first learn about when exploit code and/or active exploitation shows up online).</p>
<p>For example, this and previous zero-days for sale by 500mhz came with exhaustive documentation detailing virtually everything about the flaw, including any preconditions needed to exploit it, step-by-step configuration instructions, tips on how to remove traces of exploitation, and example search links that could be used to readily locate <a href="https://fofa.so/result?q=%22NAS326%22+%26%26+ZyXEL&amp;qbase64=Ik5BUzMyNiIgJiZaeVhFTA%3D%3D" target="_blank" rel="noopener">thousands of vulnerable devices</a>.</p>
<p>500mhz&#8217;s profile on one cybercrime forum states that he is constantly buying, selling and trading various 0day vulnerabilities.</p>
<p>&#8220;In some cases, it is possible to exchange your 0day with my existing 0day, or sell mine,&#8221; his Russian-language profile reads.</p>
<div id="attachment_50586" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/fd2647cf.500mhz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/500mhz.png"><img class="wp-image-50586" src="media/fd2647cf.500mhz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/500mhz.png" alt="" width="597" height="243" /></a><p class="wp-caption-text">The profile page of 500mhz, translated from Russian to English via Google Chrome.</p></div>
<h4>PARTIAL PATCH</h4>
<p>KrebsOnSecurity first contacted Zyxel on Feb. 12, sharing a copy of the exploit code and description of the vulnerability. When four days elapsed without any response from the vendor to notifications sent via multiple methods, this author shared the same information with vulnerability analysts at the <a href="https://www.cisa.gov/" target="_blank" rel="noopener">U.S. Department of Homeland Security (DHS)</a> and with the <a href="https://en.wikipedia.org/wiki/CERT_Coordination_Center" target="_blank" rel="noopener">CERT Coordination Center (CERT/CC</a>), a partnership between DHS and <strong>Carnegie Mellon University</strong>.</p>
<p>Less than 24 hours after contacting DHS and CERT/CC, KrebsOnSecurity heard back from Zyxel, which thanked KrebsOnSecurity for the alert without acknowledging its failure to respond until they were sent the same information by others.</p>
<p><span lang="EN-US">&#8220;Thanks for flagging,&#8221; Zyxel&#8217;s team wrote on Feb. 17. &#8220;We’ve just received an alert of the same vulnerabilities from US-CERT over the weekend, and we’re now in the process of investigating. Still, we heartily</span><span lang="EN-US"> appreciate you bringing it to our attention.&#8221;</span></p>
<p>Earlier today, Zyxel sent a message saying it had <a href="https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml" target="_blank" rel="noopener">published a security advisory and patch</a> for the zero-day exploit in some of its affected products. The vulnerable devices include NAS542, NAS540, NAS520, NAS326, NSA325 v2, NSA325, NSA320S, NSA320, NSA310S, NSA310, NSA221, NSA220+, NSA220, and NSA210. The flaw is designated as <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-9054" target="_blank" rel="noopener">CVE-2020-9054</a>.</p>
<p>However, many of these devices are no longer supported by Zyxel and will not be patched. Zyxel&#8217;s advice for those users is simply &#8220;do not leave the product directly exposed to the internet.&#8221;</p>
<p>&#8220;If possible, connect it to a security router or firewall for additional protection,&#8221; the advisory reads.</p>
<p>Holden said given the simplicity of the exploit &#8212; which allows an attacker to seize remote control over an affected device by injecting just two characters to the username field of the login panel for Zyxel NAS devices &#8212; it&#8217;s likely other Zyxel products may have related vulnerabilities.</p>
<p>&#8220;Considering how stupid this exploit is, I&#8217;m guessing this is not the only one of its class in their products,&#8221; he said.</p>
<p>CERT&#8217;s <a href="https://www.kb.cert.org/vuls/id/498544/" target="_blank" rel="noopener">advisory on the flaw</a> rates it at a &#8220;10&#8221; &#8212; its most severe. The advisory includes additional mitigation instructions, including a proof-of-concept exploit that has the ability to power down affected Zyxel devices.</p>
<p><span id="more-50574"></span></p>
<h4>EMOTET GOES IOT?</h4>
<p>Holden said recent activity suggests that attackers known for deploying ransomware have been actively working to test the zero-day for use against targets. Specifically, Holden said the exploit is now being used by a group of bad guys who are seeking to fold the exploit into <a href="https://www.us-cert.gov/ncas/alerts/TA18-201A" target="_blank" rel="noopener">Emotet</a>, a powerful malware tool typically disseminated via spam that is frequently used to seed a target with malcode which holds the victim&#8217;s files for ransom.</p>
<p>Holden said 500mhz was offering the Zyxel exploit for $20,000 on cybercrime forums, although it&#8217;s not clear whether the Emotet gang paid anywhere near that amount for access to the code. Still, he said, ransomware gangs could easily earn back their investment by successfully compromising a single target with this simple but highly reliable exploit.</p>
<p>&#8220;From the attacker&#8217;s standpoint simple is better,&#8221; he said. &#8220;The commercial value of this exploit was set at $20,000, but that&#8217;s not much when you consider a ransomware gang could easily make that money back and then some in a short period of time.&#8221;</p>
<p>Emotet&#8217;s nascent forays into IoT come amid other disturbing developments for the prolific exploitation platform. Earlier this month, security researchers noted that Emotet now has <a href="https://threatpost.com/emotet-now-hacks-nearby-wi-fi-networks-to-spread-like-a-worm/152725/" target="_blank" rel="noopener">the capability to spread in a worm-like fashion via Wi-Fi networks</a>.</p>
<p>&#8220;To me, a 0day exploit in Zyxel is not as scary as who bought it,&#8221; he said. &#8220;The Emotet guys have been historically targeting PCs, laptops and servers, but their venture now into IoT devices is very disturbing.&#8221;</p>
<h4>DISCLOSURE DEBATE</h4>
<p>This experience was a good reminder that vulnerability reporting and remediation often can be a frustrating process. Twelve days turnaround is fairly quick as these things go, although probably not quick enough for customers using products affected by zero-day vulnerabilities.</p>
<p>It can be tempting when one is not getting any response from a vendor to simply publish an alert detailing one&#8217;s findings, and the pressure to do so certainly increases when there is a zero-day flaw involved. KrebsOnSecurity ultimately opted not to do that for three reasons.</p>
<p>Firstly, at the time there was no evidence that the flaws were being actively exploited, and because the vendor had assured DHS and CERT-CC that it would soon have a patch available.</p>
<p>Perhaps most importantly, public disclosure of an unpatched flaw could well have made a bad situation worse, without offering affected users much in the way of information about how to protect their systems.</p>
<p>Many hardware and software vendors include a link from their home pages to /security.txt, which is <a href="https://tools.ietf.org/html/draft-foudil-securitytxt-08" target="_blank" rel="noopener">a proposed standard</a> for allowing security researchers to quickly identify the points of contact at vendors when seeking to report security vulnerabilities. But even vendors who haven&#8217;t yet adopted this standard (Zyxel has not) usually will respond to reports at security@[vendordomainhere]; indeed, Zyxel encourages researchers to forward any such reports to security@zyxel.com.tw.</p>
<p>On the subject of full disclosure, I should note that while this author is listed by Hold Security&#8217;s site as an advisor, KrebsOnSecurity has never sought nor received remuneration of any kind in connection with this role.</p>


feed_id: https://krebsonsecurity.com/?p=50612
title: Zyxel 0day Affects its Firewall Products, Too
uri: Zyxel-0day-Affects-its-Firewall-Products-Too
url: https://krebsonsecurity.com/2020/02/zyxel-0day-affects-its-firewall-products-too/
content:
<p>On Monday, networking hardware maker <strong>Zyxel</strong> released security updates to plug a critical security hole in its network attached storage (NAS) devices that is being actively exploited by crooks who specialize in deploying ransomware. Today, Zyxel acknowledged the same flaw is present in many of its firewall products.</p>
<p><img class="aligncenter  wp-image-36655" src="media/a96fd646.networktechnicians.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians.png" alt="" width="595" height="394" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians.png 1212w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-580x384.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-940x622.png 940w" sizes="(max-width: 595px) 100vw, 595px" /></p>
<p><a href="https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/" target="_blank" rel="noopener">This week&#8217;s story on the Zyxel patch</a> was prompted by the discovery that exploit code for attacking the flaw was being sold in the cybercrime underground for $20,000. <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Alex Holden</a>, the security expert who first spotted the code for sale, said at the time the vulnerability was so &#8220;stupid&#8221; and easy to exploit that he wouldn&#8217;t be surprised to find other Zyxel products were similarly affected.</p>
<p>Now it appears Holden&#8217;s hunch was dead-on.</p>
<p>&#8220;We’ve now completed the investigation of all Zyxel products and found that firewall products running specific firmware versions are also vulnerable,&#8221; Zyxel wrote in an email to KrebsOnSecurity. &#8220;Hotfixes have been released immediately, and the standard firmware patches will be released in March.&#8221;</p>
<p>The <a href="https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml" target="_blank" rel="noopener">updated security advisory</a> from Zyxel states the exploit works against its UTM, ATP, and VPN firewalls running firmware version <em>ZLD V4.35 Patch 0</em> through <em>ZLD V4.35 Patch 2</em>, and that those with firmware versions before <em>ZLD V4.35 Patch</em> 0 are not affected.</p>
<p>Zyxel&#8217;s new advisory suggests that some affected firewall product won&#8217;t be getting hotfixes or patches for this flaw, noting that the affected products listed in the advisory are only those which are &#8220;within their warranty support period.&#8221;</p>
<p>Indeed, while the exploit also works against more than a dozen of Zyxel&#8217;s NAS product lines, the company only released updates for NAS products that were newer than 2016. Its advice for those still using those unsupported NAS devices? &#8220;Do not leave the product directly exposed to the internet. If possible, connect it to a security router or firewall for additional protection.&#8221;</p>
<p>Hopefully, your vulnerable, unsupported Zyxel NAS isn&#8217;t being protected by a vulnerable, unsupported Zyxel firewall product.</p>
<p>CERT’s <a href="https://www.kb.cert.org/vuls/id/498544/" target="_blank" rel="noopener">advisory on the flaw</a> rate this vulnerability at a “10” — its most severe. <span class="pullquote pqright">My advice? If you can&#8217;t patch it, pitch it.</span> The zero-day sales thread first flagged by Holden also hinted at the presence of post-authentication exploits in many Zyxel products, but the company did not address those claims in its security advisories.</p>
<p>Recent activity suggests that attackers known for deploying ransomware have been actively working to test the zero-day for use against targets. Holden said the exploit is now being used by a group of bad guys who are seeking to fold the exploit into <a href="https://www.us-cert.gov/ncas/alerts/TA18-201A" target="_blank" rel="noopener">Emotet</a>, a powerful malware tool typically disseminated via spam that is frequently used to seed a target with malcode which holds the victim’s files for ransom.</p>
<p>“To me, a 0day exploit in Zyxel is not as scary as who bought it,” he said. “The Emotet guys have been historically targeting PCs, laptops and servers, but their venture now into IoT devices is very disturbing.”</p>


feed_id: https://krebsonsecurity.com/?p=50646
title: FCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data
uri: FCC-Proposes-to-Fine-Wireless-Carriers-200M-for-Selling-Customer-Loca
url:
https://krebsonsecurity.com/2020/02/fcc-proposes-to-fine-wireless-carriers-200m-for-selling-customer-location-data/

content:
<p>The <strong>U.S. Federal Communications Commission</strong> (FCC) today proposed fines of more than $200 million against the nation&#8217;s four largest wireless carriers for selling access to their customers&#8217; location information without taking adequate precautions to prevent unauthorized access to that data. While the fines would be among the largest the FCC has ever levied, critics say the penalties don&#8217;t go far enough to deter wireless carriers from continuing to sell customer location data.</p>
<p><img class="aligncenter  wp-image-43845" src="media/f262877a.locationtracking.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/locationtracking.jpg" alt="" width="596" height="386" /></p>
<p>The FCC proposed fining <strong>T-Mobile</strong> $91 million; <strong>AT&amp;T</strong> faces more than $57 million in fines; <strong>Verizon</strong> is looking at more than $48 million in penalties; and the FCC said <strong>Sprint</strong> should pay more than $12 million.</p>
<p>An FCC <a href="media/6bee8e88.DOC-362754A1.pdf" data-original-source="https://docs.fcc.gov/public/attachments/DOC-362754A1.pdf" target="_blank" rel="noopener">statement</a> (PDF) said &#8220;the size of the proposed fines for the four wireless carriers differs based on the length of time each carrier apparently continued to sell access to its customer location information without reasonable safeguards and the number of entities to which each carrier continued to sell such access.&#8221;</p>
<p>The fines are only &#8220;proposed&#8221; at this point because the carriers still have an opportunity to respond to the commission and contest the figures. <em>The Wall Street Journal</em> first reported earlier this week that the FCC was considering the fines.</p>
<p>The commission said it took action in response to a <a href="https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html" target="_blank" rel="noopener">May 2018 story</a> broken by <em>The New York Times</em>, which exposed how a company called <strong>Securus Technologies</strong> had been selling location data on customers of virtually any major mobile provider to law enforcement officials.</p>
<p>That same month, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">broke the news</a> that <strong>LocationSmart</strong> &#8212; a data aggregation firm working with the major wireless carriers &#8212; had a free, unsecured demo of its service online that anyone could abuse to find the near-exact location of virtually any mobile phone in North America.<span id="more-50646"></span></p>
<p>In response, the carriers <a href="https://krebsonsecurity.com/2018/06/verizon-to-stop-sharing-customer-location-data-with-third-parties/" target="_blank" rel="noopener">promised to &#8220;wind down&#8221; location data sharing agreements</a> with third-party companies. But in 2019, <strong>Joseph Cox</strong> at <a href="https://www.vice.com/en_us/article/nepxbz/i-gave-a-bounty-hunter-300-dollars-located-phone-microbilt-zumigo-tmobile" target="_blank" rel="noopener">Vice.com showed</a> that little had changed, detailing how he was able to locate a test phone after paying $300 to a bounty hunter who simply bought the data through a little-known third-party service.</p>
<p><strong>Gigi Sohn</strong> is a fellow at the Georgetown Law Institute for Technology Law and Policy and a former senior adviser to former FCC Chair Tom Wheeler in 2015. Sohn said this debacle underscores the importance of having strong consumer privacy protections.</p>
<p>&#8220;The importance of having rules that protect consumers before they are harmed cannot be overstated,&#8221; Sohn said. &#8220;In 2016, the Wheeler FCC adopted rules that would have prevented most mobile phone users from suffering this gross violation of privacy and security. But [FCC] Chairman Pai and his friends in Congress eliminated those rules, because allegedly the burden on mobile wireless providers and their fixed broadband brethren would be too great. Clearly, they did not think for one minute about the harm that could befall consumers in the absence of strong privacy protections.&#8221;</p>
<p><strong>Sen. Ron Wyden</strong> (D-Ore.), a longtime critic of the FCC&#8217;s inaction on wireless location data sharing, likewise called for more string consumer privacy laws, calling the proposed punishment &#8220;comically inadequate fines that won&#8217;t stop phone companies from abusing Americans&#8217; privacy the next time they can make a quick buck.&#8221;</p>
<p>“Time and again, from Facebook to Equifax, massive companies take reckless disregard for Americans’ personal information, knowing they can write off comparatively tiny fines as the cost of doing business,&#8221; Wyden said in a written statement. &#8220;The only way to truly protect Americans’ personal information is to pass strong privacy legislation like my <a href="media/41dd44cb.Mind20Your20Own20Business20Act20of20201920One20Pager.pdf" data-original-source="https://www.wyden.senate.gov/imo/media/doc/Mind%20Your%20Own%20Business%20Act%20of%202019%20One%20Pager.pdf" target="_blank" rel="noopener">Mind Your Own Business Act</a> [PDF] to put teeth into privacy laws and hold CEOs personally responsible for lying about protecting Americans’ privacy.”</p>


feed_id: https://krebsonsecurity.com/?p=50623
title: French Firms Rocked by Kasbah Hacker?
uri: French-Firms-Rocked-by-Kasbah-Hacker
url: https://krebsonsecurity.com/2020/03/french-firms-rocked-by-kasbah-hacker/
content:
<p>A large number of French critical infrastructure firms were hacked as part of an extended malware campaign that appears to have been orchestrated by at least one attacker based in Morocco, KrebsOnSecurity has learned. An individual thought to be involved has earned accolades from the likes of <strong>Apple</strong>, <strong>Dell</strong>, and <strong>Microsoft</strong> for helping to find and fix security vulnerabilities in their products.</p>
<p><img class="aligncenter wp-image-50700" src="media/e67d6901.kasbah.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/kasbah.png" alt="" width="596" height="377" /></p>
<p>In 2018, security intelligence firm <a href="https://www.hyas.com" target="_blank" rel="noopener">HYAS</a> discovered a malware network communicating with systems inside of a French national power company. The malware was identified as a version of the remote access trojan (RAT) known as <a href="https://en.wikipedia.org/wiki/Njrat" target="_blank" rel="noopener">njRAT</a>, which has been used against <a href="https://krebsonsecurity.com/2014/07/microsoft-darkens-4mm-sites-in-malware-fight/" target="_blank" rel="noopener">millions of targets globally</a> with a focus on victims in the Middle East.</p>
<p>Further investigation revealed the electricity provider was just one of many French critical infrastructure firms that had systems beaconing home to the malware network&#8217;s control center.</p>
<p>Other victims included one of France&#8217;s largest hospital systems; a French automobile manufacturer; a major French bank; companies that work with or manage networks for French postal and transportation systems; a domestic firm that operates a number of airports in France; a state-owned railway company; and multiple nuclear research facilities.</p>
<p>HYAS said it quickly notified the French national computer emergency team and the FBI about its findings, which pointed to a <a href="https://en.wikipedia.org/wiki/Dynamic_DNS" target="_blank" rel="noopener">dynamic domain name system</a> (DNS) provider on which the purveyors of this attack campaign relied for their various malware servers.</p>
<p>When it didn&#8217;t hear from French authorities after almost a week, HYAS asked the dynamic DNS provider to &#8220;<a href="https://en.wikipedia.org/wiki/DNS_sinkhole" target="_blank" rel="noopener">sinkhole</a>&#8221; the malware network&#8217;s control servers. Sinkholing is a practice by which researchers assume control over a malware network&#8217;s domains, redirecting any traffic flowing to those systems to a server the researchers control.</p>
<p>While sinkholing doesn&#8217;t clean up infected systems, it can prevent the attackers from continuing to harvest data from infected PCs or sending them new commands and malware updates. HYAS found that despite its notifications to the French authorities, some of the apparently infected systems were still attempting to contact the sinkholed control networks up until late 2019.</p>
<p>&#8220;Due to our remote visibility it is impossible for us to determine if the malware infections have been contained within the [affected] organizations,&#8221; HYAS wrote in a report summarizing their findings. &#8220;It is possible that an infected computer is beaconing, but is unable to egress to the command and control due to outbound firewall restrictions.&#8221;</p>
<div id="attachment_50682" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-50682" src="media/8d2daf00.frenchCI.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/frenchCI.png" alt="" width="597" height="427" /><p class="wp-caption-text">About the only French critical infrastructure vertical not touched by the Kasbah hackers was the water management sector.</p></div>
<p>HYAS said given the entities compromised &#8212; and that only a handful of known compromises occurred outside of France &#8212; there&#8217;s a strong possibility this was the result of an orchestrated phishing campaign targeting French infrastructure firms. It also concluded the domains associated with this campaign were very likely controlled by a group of adversaries based in Morocco.</p>
<p>“What caught our attention was the nature of the victims and the fact that there were no other observed compromises outside of France,&#8221; said Sasha Angus, vice president of intelligence for HYAS. “With the exception of water management, when looking at the organizations involved, each fell within one of the verticals in France’s critical infrastructure strategic plan. While we couldn’t rule out financial crime as the actor’s potential motive, it didn’t appear that the actor leveraged any normal financial crime tools.”</p>
<h4>&#8216;FATAL&#8217; ERROR</h4>
<p>HYAS said the dynamic DNS provider shared information showing that one of the email addresses used to register a key DNS server for the malware network was tied to a domain for a legitimate business based in Morocco.</p>
<p>According to historic records maintained by <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools.com</a> [an advertiser on this site], that email address &#8212; <strong>ing.equipepro@gmail.com</strong> &#8212; was used in 2016 to register the Web site <strong>talainine.com</strong>, a now-defunct business that offered recreational vehicle-based camping excursions just outside of a city in southern Morocco called <a href="https://en.wikipedia.org/wiki/Guelmim" target="_blank" rel="noopener">Guelmim</a>.</p>
<p><a class="lightbox" href="media/a4b24e2f.talainine2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/talainine2.png"><img class="aligncenter wp-image-50685" src="media/a4b24e2f.talainine2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/talainine2.png" alt="" width="597" height="317" /></a></p>
<p><a href="https://web.archive.org/web/20180124172721/http://www.talainine.com/Talanine.php" target="_blank" rel="noopener">Archived copies of talainine.com</a> indicate the business was managed by two individuals, including someone named <strong>Yassine Algangaf</strong>. A Google search for that name reveals a similarly named individual has been credited by a number of major software companies &#8212; including <a href="https://support.apple.com/fr-be/HT201536" target="_blank" rel="noopener">Apple</a>, <a href="https://www.dell.com/learn/us/en/04/campaigns/contributors-dell-software-security" target="_blank" rel="noopener">Dell</a> and <a href="https://www.microsoft.com/en-us/msrc/researcher-acknowledgments-online-services-archive" target="_blank" rel="noopener">Microsoft</a> &#8212; with reporting security vulnerabilities in their products.</p>
<p>A search on this name at Facebook <a href="https://fr-fr.facebook.com/pg/yamosoft/about/" target="_blank" rel="noopener">turned up a page for another now-defunct business</a> called <strong>Yamosoft.com</strong> that lists Algangaf as an owner. <a href="https://web.archive.org/web/20141218120929/http://yamosoft.com/#collapseTwo" target="_blank" rel="noopener">A cached copy of Yamosoft.com at archive.org</a> says it was a Moroccan computer security service that specialized in security audits, computer hacking investigations, penetration testing and source code review.<span id="more-50623"></span></p>
<p>A search on the ing.equipepro@gmail.com address at <a href="https://www.4iq.com" target="_blank" rel="noopener">4iq.com</a> &#8212; a service that indexes account details like usernames and passwords exposed in Web site data breaches &#8212; shows this email address was used to register an account at the computer hacking forum <strong>cracked[.]to</strong> for a user named &#8220;<strong>fatal.001</strong>.&#8221;</p>
<p><a href="https://www.linkedin.com/in/yassine-algangaf-93a81817b/?originalSubdomain=ma" target="_blank" rel="noopener">A LinkedIn profile for a Yassine Algangaf</a> says he&#8217;s a penetration tester from the Guelmim province of Morocco. Yet <a href="https://www.linkedin.com/in/yassine-algangaf-20934511b/?originalSubdomain=ma" target="_blank" rel="noopener">another LinkedIn profile</a> under the same name and location says he is a freelance programmer and penetration tester. Both profiles include the phrase &#8220;attack prevention mechanisms researcher security tools proof of concepts developer&#8221; in the description of the user&#8217;s job experience.</p>
<p>Searching for this phrase in Google turns up <a href="https://www.facebook.com/fatalW01" target="_blank" rel="noopener">another Facebook page</a>, this time for a &#8220;<strong>Yassine Majidi,</strong>&#8221; under the profile name &#8220;<strong>FatalW01</strong>.&#8221; A review of Majidi&#8217;s Facebook profile shows that phrase as his tag line, and that he has signed several of his posts over the years as &#8220;Fatal.001.&#8221;</p>
<p>There are also two different Skype accounts registered to the ing.equipepro.com email address, one for Yassine Majidi and another for Yassine Algangaf. There is a third Skype account nicknamed &#8220;Fatal.001&#8221; that is tied to the same phone number included on talainine.com as a contact number for Yassine Algangaf (+212611604438). <a href="https://www.facebook.com/fatalW01/videos/922726577888654/" target="_blank" rel="noopener">A video on Majidi&#8217;s Facebook page</a> shows him <a href="media/d826c0a1.majidi-fb-video-fatal001.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/majidi-fb-video-fatal001.png" target="_blank" rel="noopener">logged in to the &#8220;Fatal.001&#8221; Skype account</a>.</p>
<p>On his Facebook profile, Majidi includes screen shots of several emails from software companies thanking him for reporting vulnerabilities in their products. Fatal.001 was an active member on <strong>dev-point[.]com</strong>, an Arabic-language computer hacking forum. Throughout multiple posts, Fatal.001 discusses his work in developing <a href="https://www.youtube.com/watch?v=zquBREsu_4w&#038;t=361s" rel="noopener" target="_blank">spam</a> <a href="https://www.youtube.com/watch?v=TDEW1dFt-xA&#038;t=2595s" rel="noopener" target="_blank">tools</a> and RAT malware.</p>
<p>In <a href="https://www.youtube.com/watch?v=0-5uUcSw0EU&amp;t=4932s" target="_blank" rel="noopener">this two-hour Arabic language YouTube tutorial from 2014</a>, Fatal.001 explains how to use a RAT he developed called &#8220;Little Boy&#8221; to steal credit card numbers and passwords from victims. The main control screen for the Little Boy botnet interface includes a map of Morocco.</p>
<p><a class="lightbox" href="media/bab3d787.littleboybotnet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/littleboybotnet.png"><img class="aligncenter wp-image-50698" src="media/bab3d787.littleboybotnet.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/littleboybotnet.png" alt="" width="598" height="325" /></a></p>
<p>Reached via LinkedIn, Algangaf confirmed he used the pseudonyms Majidi and Fatal.001 for his security research and bug hunting. But he denied ever participating in illegal hacking activities. He acknowledged that ing.equipepro@gmail.com is his email address, but claims the email account was hacked at some point in 2017.</p>
<p>&#8220;It has already been hacked and recovered after a certain period,&#8221; Algangaf said. &#8220;Since I am a security researcher, I publish from time to time a set of blogs aimed at raising awareness of potential security risks.&#8221;</p>
<p>As for the notion that he has somehow been developing hacking programs for years, Algangaf says this, also, is untrue. He said he never sold any copies of the Little Boy botnet, and that this was one of several tools he created for raising awareness.</p>
<p>&#8220;In 2013, I developed a platform for security research through which penetration test can be done for phones and computers,&#8221; Algangaf said. &#8220;It contained concepts that could benefit from a controlled domain. As for the fact that unlawful attacks were carried out on others, it is impossible because I simply have no interest in blackhat [activities].&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=50640
title: The Case for Limiting Your Browser Extensions
uri: The-Case-for-Limiting-Your-Browser-Extensions
url: https://krebsonsecurity.com/2020/03/the-case-for-limiting-your-browser-extensions/
content:
<p>Last week, KrebsOnSecurity reported to health insurance provider <a href="https://www.blueshieldca.com/" target="_blank" rel="noopener"><strong>Blue Shield of California</strong></a> that its Web site was flagged by multiple security products as serving malicious content. Blue Shield quickly removed the unauthorized code. An investigation determined it was injected by a browser extension installed on the computer of a Blue Shield employee who&#8217;d edited the Web site in the past month.</p>
<p>The incident is a reminder that browser extensions &#8212; however useful or fun they may seem when you install them &#8212; typically have a great deal of power and can effectively read and/or write all data in your browsing sessions. And as we&#8217;ll see, it&#8217;s not uncommon for extension makers to sell or lease their user base to shady advertising firms, or in some cases abandon them to outright cybercriminals.</p>
<p><img class="aligncenter wp-image-45005" src="media/8b179f15.browsers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/browsers.png" alt="" width="599" height="110" /></p>
<p>The health insurance site was compromised after an employee at the company edited content on the site while using a Web browser equipped with a once-benign but now-compromised extension which quietly injected code into the page.</p>
<p>The extension in question was <a href="https://chrome.google.com/webstore/detail/page-ruler/emliamioobfffbgcfdchabfibonehkme?hl=en" target="_blank" rel="noopener">Page Ruler</a>, a Chrome addition with some 400,000 downloads. Page Ruler lets users measure the inch/pixel width of images and other objects on a Web page. But the extension was <a href="https://github.com/wrakky/page-ruler/issues/101" target="_blank" rel="noopener">sold by the original developer</a> a few years back, and for some reason it&#8217;s still available from the Google Chrome store despite multiple recent reports from people blaming it for spreading malicious code.</p>
<p>How did a browser extension lead to a malicious link being added to the health insurance company Web site? This compromised extension tries to determine if the person using it is typing content into specific Web forms, such as a blog post editing system like <strong>WordPress</strong> or <strong>Joomla</strong>.</p>
<p>In that case, the extension silently adds a request for a javascript link to the end of whatever the user types and saves on the page. When that altered HTML content is saved and published to the Web, the hidden javascript code causes a visitor&#8217;s browser to display ads under certain conditions.</p>
<p>Who exactly gets paid when those ads are shown or clicked is not clear, but there are a few clues about who&#8217;s facilitating this. The malicious link that set off antivirus alarm bells when people tried to visit Blue Shield California downloaded javascript content from a domain called <strong>linkojager[.]org</strong>.</p>
<p>The file it attempted to download &#8212; <strong>212b3d4039ab5319ec.js</strong> &#8212; appears to be named after an affiliate identification number designating a specific account that should get credited for serving advertisements. A simple Internet search shows this same javascript code is present on <a href="https://krebsonsecurity.com/wp-content/uploads/2020/03/212b3d4039ab5319ecjs.txt" target="_blank" rel="noopener">hundreds of other Web sites</a>, no doubt inadvertently published by site owners who happened to be editing their sites with this Page Ruler extension installed.</p>
<p>If we download a copy of that javascript file and view it in a text editor, we can see the following message toward the end of the file:</p>
<blockquote><p>[NAME OF EXTENSION HERE]&#8217;s development is supported by advertisements that are added to some of the websites you visit. During the development of this extension, I&#8217;ve put in thousands of hours adding features, fixing bugs and making things better, not mentioning the support of all the users who ask for help.</p>
<p>Ads support most of the internet we all use and love; without them, the internet we have today would simply not exist. Similarly, without revenue, this extension (and the upcoming new ones) would not be possible.</p>
<p>You can disable these ads now or later in the settings page. You can also minimize the ads appearance by clicking on partial support button. Both of these options are available by clicking \&#8217;x\&#8217; button in the corner of each ad. In both cases, your choice will remain in effect unless you reinstall or reset the extension.</p></blockquote>
<p>This appears to be boilerplate text used by one or more affiliate programs that pay developers to add a few lines of code to their extensions. The opt-out feature referenced in the text above doesn&#8217;t actually work because it points to a domain that no longer resolves &#8212; <strong>thisadsfor[.]us</strong>. But that domain is still useful for getting a better idea of what we&#8217;re dealing with here.</p>
<p>Registration records maintained by <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools</a> [an advertiser on this site] say it was originally registered to someone using the email address <strong>frankomedison1020@gmail.com</strong>. A reverse WHOIS search on that unusual name turns up several other interesting domains, including <strong>icontent[.]us</strong>.</p>
<p>icontent[.]us is currently not resolving either, but <a href="https://web.archive.org/web/20170421092836/http://icontent.us/#features" target="_blank" rel="noopener">a cached version of it at Archive.org</a> shows it once belonged to an advertising network called <strong>Metrext</strong>, which marketed itself as an analytics platform that let extension makers track users in real time.</p>
<div id="attachment_50642" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/4f63f022.metrext.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/metrext.png"><img class="wp-image-50642" src="media/4f63f022.metrext.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/metrext.png" alt="" width="597" height="376" /></a><p class="wp-caption-text">An archived copy of the content once served at icontent[.]us promises &#8220;plag&#8217;n&#8217;play&#8221; capability.</p></div>
<p>&#8220;Three lines into your product and it&#8217;s in live,&#8221; iContent enthused. &#8220;High revenue per user.&#8221;</p>
<p>Another domain tied to Frank Medison is <strong>cdnpps[.]us</strong>, which currently redirects to the domain &#8220;<strong>monetizus[.]com</strong>.&#8221; Like its competitors, Monetizus&#8217; site is full of grammar and spelling errors: &#8220;Use Monetizus Solutions to bring an extra value to your toolbars, addons and extensions, without loosing an audience,&#8221; the company says in a banner at the top of its site.</p>
<div id="attachment_50747" style="width: 601px" class="wp-caption aligncenter"><a class="lightbox" href="media/4b6346b9.monetizus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/monetizus.png"><img class="wp-image-50747" src="media/4b6346b9.monetizus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/monetizus.png" alt="" width="591" height="335" /></a><p class="wp-caption-text">Be sure not to &#8220;loose&#8221; out on sketchy moneymaking activities!</p></div>
<p>Contacted by KrebsOnSecurity, Page Ruler&#8217;s original developer <strong>Peter Newnham</strong> confirmed he sold his extension to MonetizUs in 2017.</p>
<p>&#8220;They didn&#8217;t say what they were going to do with it but I assumed they were going to try to monetize it somehow, probably with the scripts their website mentions,&#8221; Newnham said.<span id="more-50640"></span></p>
<p>&#8220;I could have probably made a lot more running ad code myself but I didn&#8217;t want the hassle of managing all of that and Google seemed to be making noises at the time about cracking down on that kind of behaviour so the one off payment suited me fine,&#8221; Newnham said. &#8220;Especially as I hadn&#8217;t updated the extension for about 3 years and work and family life meant I was unlikely to do anything with it in the future as well.&#8221;</p>
<p>Monetizus did not respond to requests for comment.</p>
<p>Newnham declined to say how much he was paid for surrendering his extension. But it&#8217;s not difficult to see why developers might sell or lease their creation to a marketing company: Many of these entities offer the promise of a hefty payday for extensions with decent followings. For example, one competing extension monetization platform called <strong>AddonJet</strong> claims it can offer revenues of up to $2,500 <em>per day</em> for every 100,000 user in the United States (see screenshot below).</p>
<div id="attachment_50671" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/f9971d6a.addonjt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/addonjt.png"><img class="wp-image-50671" src="media/f9971d6a.addonjt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/addonjt.png" alt="" width="596" height="451" /></a><p class="wp-caption-text">Read here how its work!</p></div>
<p>I hope it&#8217;s obvious by this point, but readers should be extremely cautious about installing extensions &#8212; sticking mainly to those that are actively supported and respond to user concerns. Personally, I do not make much use of browser extensions. In almost every case I’ve considered installing one I’ve been sufficiently spooked by the permissions requested that I ultimately decided it wasn’t worth the risk.</p>
<p>If you’re the type of person who uses multiple extensions, it may be wise to adopt a risk-based approach going forward. Given the high stakes that typically come with installing an extension, consider carefully whether having the extension is truly worth it. This applies equally to plug-ins designed for Web site content management systems like <strong>WordPress</strong> and<strong> Joomla</strong>.</p>
<p>Do not agree to update an extension if it suddenly requests more permissions than a previous version. This should be a giant red flag that something is not right. If this happens with an extension you trust, you&#8217;d be well advised to remove it entirely.</p>
<p>Also, never download and install an extension just because some Web site says you need it to view some type of content. Doing otherwise is almost always a high-risk proposition. Here, Rule #1 from <a href="https://krebsonsecurity.com/2011/05/krebss-3-basic-rules-for-online-safety/" target="_blank" rel="noopener">KrebsOnSecurity’s Three Rules of Online Safety</a> comes into play: “If you didn’t go looking for it, don’t install it.” Finally, in the event you do wish to install something, make sure you’re getting it directly from the entity that produced the software.</p>
<p>Google Chrome users can see any extensions they have installed by clicking the three dots to the right of the address bar, selecting “More tools” in the resulting drop-down menu, then “Extensions.” In Firefox, click the three horizontal bars next to the address bar and select “Add-ons,” then click the “Extensions” link on the resulting page to view any installed extensions.</p>


feed_id: https://krebsonsecurity.com/?p=50774
title: U.S. Govt. Makes it Harder to Get .Gov Domains
uri: U-S-Govt-Makes-it-Harder-to-Get-Gov-Domains
url: https://krebsonsecurity.com/2020/03/u-s-govt-makes-it-harder-to-get-gov-domains/
content:
<p>The federal agency in charge of issuing .gov domain names is enacting new requirements for validating the identity of people requesting them. The additional measures come less than four months after KrebsOnSecurity published research suggesting it was relatively easy for just about anyone to get their very own .gov domain.</p>
<p>In November&#8217;s piece <a href="https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-a-gov-domain-name/" target="_blank" rel="noopener">It&#8217;s Way Too Easy to Get a .gov Domain Name</a>, an anonymous source detailed how he obtained one by impersonating an official at a small town in Rhode Island that didn&#8217;t already have its own .gov.</p>
<p><img class="aligncenter  wp-image-49682" src="media/f25f353d.dotgov.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/dotgov.png" alt="" width="592" height="376" /></p>
<p>“I had to [fill out] ‘an official authorization form,’ which basically just lists your admin, tech guy, and billing guy,” the source said. “Also, it needs to be printed on ‘official letterhead,’ which of course can be easily forged just by Googling a document from said municipality. Then you either mail or fax it in. After that, they send account creation links to all the contacts.”</p>
<p>While what my source did was technically wire fraud (obtaining something of value via the Internet through false pretenses), cybercriminals bent on using fake .gov domains to hoodwink Americans likely would not be deterred by such concerns.</p>
<p>&#8220;I never said it was legal, just that it was easy,&#8221; the source told KrebsOnSecurity. &#8220;I assumed there would be at least ID verification. The deepest research I needed to do was Yellow Pages records.&#8221;</p>
<p>Now, Uncle Sam says in a few days all new .gov domain applications will include an additional authorization step.</p>
<p>&#8220;Effective on March 10, 2020, the DotGov Program will begin requiring notarized signatures on all authorization letters when submitting a request for a new .gov domain,&#8221; reads <a href="https://home.dotgov.gov/" target="_blank" rel="noopener">a notice published March 5</a> by the <strong>U.S. General Services Administration</strong>, which overseas the .gov space.</p>
<p>&#8220;This is a necessary security enhancement to prevent mail and wire fraud through signature forgery in obtaining a .gov domain,&#8221; the statement continues. &#8220;This step will help maintain the integrity of .gov and ensure that .gov domains continue to be issued only to official U.S. government organizations.&#8221;<span id="more-50774"></span></p>
<p>The GSA didn&#8217;t say whether it was putting in place any other safeguards, such as more manual verification of .gov domain applications. It certainly hadn&#8217;t followed up on the fraudulent application from my source before granting him the .gov domain name he sought (<strong>exeterri[.]gov</strong>). The GSA only did that four days after I asked them for comment, and approximately 10 days after they&#8217;d already granted the phony domain request.</p>
<p>“GSA is working with the appropriate authorities and has already implemented additional fraud prevention controls,” the agency said in a written statement at the time, without elaborating on what those additional controls might be.</p>
<p>But I&#8217;m left to wonder: If I&#8217;m a bad guy who&#8217;s willing to forge someone&#8217;s signature and letterhead in a fraudulent application for a .gov domain, why wouldn&#8217;t I also be willing to fake a notarization? Especially when there are plenty of services in the cybercrime underground that specialize in spoofing these phony attestations <a href="https://krebsonsecurity.com/2010/12/reintroducing-scanlab-a-k-a-scamlab/" target="_blank" rel="noopener">for a small fee</a>.</p>
<p>&#8220;This is a classic case of &#8216;we must do something&#8217; and this is certainly something,&#8221; said <strong>John Levine</strong>, a domain name expert, consultant and author of the book <a href="https://www.amazon.com/Internet-Dummies-John-R-Levine/dp/1118096142" target="_blank" rel="noopener">The Internet for Dummies</a>.</p>
<p>Levine said it would not be terribly difficult for the GSA to do a slightly more thorough job of validating .gov domain requests, but that some manual verification probably would be required. Still, he said, it&#8217;s not clear how big a threat fake .gov domains really are.</p>
<p>&#8220;As far as we know, only one person tried to fake a .gov,&#8221; Levine said. &#8220;Maybe this is good enough?&#8221;</p>
<p><strong>The Cybersecurity and Infrastructure Security Agency</strong>, a division of the <strong>U.S. Department of Homeland Security</strong>, has argued that more needs to be done to secure the .gov domain space, and is making a play to wrest control over the process from the GSA.</p>
<p>The <a href="https://www.congress.gov/bill/116th-congress/senate-bill/2749/text" target="_blank" rel="noopener">DOTGOV bill</a>, introduced in October 2019, would &#8220;ensure that only authorized users obtain a .gov domain, and proactively validate existing .gov holders,&#8221; according to a statement CISA shared with this author last year.</p>


feed_id: https://krebsonsecurity.com/?p=50786
title: FBI Arrests Alleged Owner of Deer.io, a Top Broker of Stolen Accounts
uri: FBI-Arrests-Alleged-Owner-of-Deer-io-a-Top-Broker-of-Stolen-Accounts
url:
https://krebsonsecurity.com/2020/03/fbi-arrests-alleged-owner-of-deer-io-a-top-broker-of-stolen-accounts/

content:
<p>FBI officials last week arrested a Russian computer security researcher on suspicion of operating <strong>deer.io</strong>, a vast marketplace for buying and selling stolen account credentials for thousands of popular online services and stores.</p>
<p><strong>Kirill V. Firsov</strong> was arrested Mar. 7 after arriving at New York&#8217;s John F. Kennedy Airport, according to court documents unsealed Monday. Prosecutors with the <strong>U.S. District Court for the Southern District of California</strong> allege Firsov was the administrator of deer.io, an online platform that hosted more than 24,000 shops for selling stolen and/or hacked usernames and passwords for a variety of top online destinations.</p>
<div id="attachment_50792" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/1500d418.deerio.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/deerio.png"><img class="wp-image-50792" src="media/1500d418.deerio.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/deerio.png" alt="" width="596" height="288" /></a><p class="wp-caption-text">An example seller&#8217;s panel at deer.io. Click image to enlarge.</p></div>
<p>The indictment against Firsov says deer.io was responsible for $17 million worth of stolen credential sales since its inception in 2013.</p>
<p>&#8220;The FBI&#8217;s review of approximately 250 DEER.IO storefronts reveals thousands of compromised accounts posted for sale via this platform and its customers&#8217; storefronts, including videogame accounts (gamer accounts) and PII files containing user names, passwords, U.S. Social Security Numbers, dates of birth, and victim addresses,&#8221; the indictment states.</p>
<p>In addition to facilitating the sale of hacked accounts at video streaming services like <strong>Netflix</strong> and <strong>Hulu </strong>and social media platforms like <strong>Facebook</strong>, <strong>Twitter</strong> and <strong>Vkontakte</strong> (the Russian equivalent of Facebook), deer.io also is a favored marketplace for people involved in selling phony social media accounts.</p>
<p>For example, one early adopter of deer.io was a now-defunct shop called &#8220;Dedushka&#8221; (&#8220;grandpa&#8221; in transliterated Russian), a service offering aged, fake Vkontakte accounts that was quite popular among crooks involved in various online dating scams.</p>
<p>The indictment doesn&#8217;t specify how prosecutors pegged Firsov as the mastermind behind deer.io, but there are certainly plenty of clues that suggest such a connection. <span id="more-50786"></span></p>
<p>Firsov&#8217;s <a href="https://twitter.com/k_firsov?fbclid=IwAR2Btpbkgc6x8ZcZUULZiM8Pqx7OsfU_JvlAwArhogZfZ9738oL7j3vK5pc" target="_blank" rel="noopener">identity on Twitter</a> says he is a security researcher and developer who currently lives in Moscow. Previous tweets from that account indicate Firsov made a name for himself after discovering a number of serious security flaws in Telegram, a popular cross-platform messaging application.</p>
<p>Firsov also tweeted about competing in and winning several &#8220;capture the flag&#8221; hacking competitions, including the 2016 and 2017 CTF challenges at <a href="https://en.wikipedia.org/wiki/Positive_Hack_Days" target="_blank" rel="noopener">Positive Hack Days</a> (PHDays), an annual security conference in Moscow.</p>
<div id="attachment_50794" style="width: 214px" class="wp-caption alignright"><img class=" wp-image-50794" src="media/09a70c80.isis-antichat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/isis-antichat.png" alt="" width="204" height="262" /><p class="wp-caption-text">Isis&#8217; profile on antichat.</p></div>
<p>Deer.io was originally advertised on the public Russian-language hacking forum <strong>Antichat</strong> by a venerated user in that community who goes by the alias &#8220;<strong>Isis</strong>.&#8221; A Google Translate version of that advertisement is <a href="media/a90e86c2.deerio-antichat-en.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/deerio-antichat-en.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>In 2016, Isis would post to Antichat <a href="https://twitter.com/k_firsov/status/722534067670020097" target="_blank" rel="noopener">a detailed writeup</a> on how he was able to win a PHDays hacking competition (translated thread <a href="media/17687808.antichat-isis-thread-en.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/antichat-isis-thread-en.pdf" target="_blank" rel="noopener">here</a>). In one section of the writeup Isis claims authorship of a specific file-dumping tool, and links to <a href="https://gist.github.com/firsov/734b98c7ac7d74a5cdf72eb83b9b607b" target="_blank" rel="noopener">a Github directory</a> under the username &#8220;Firsov.&#8221;</p>
<p>In another thread from June 2019, an Antichat user asks if anyone has heard from Isis recently, and Isis pops up a day later to inquire what he wants. The user asks why Isis&#8217;s site &#8212; a video and music search site called <strong>vpleer[.]ru</strong> &#8212; wasn&#8217;t working at the time. Isis responds that he hasn&#8217;t owned the site for 10 years.</p>
<p>According to historic WHOIS records maintained by <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> (an advertiser on this site), vpleer was originally registered in 2008 to someone using the email address <strong>hm@mail.ru</strong>.</p>
<p>That same email address was used to register the account &#8220;Isis&#8221; at several other top Russian-language cybercrime forums, including Damagelab, Zloy, Evilzone and Priv-8. It also was used in 2007 to register <strong>xeka[.]ru</strong>, a cybercrime forum in its own right that called itself &#8220;<a href="https://web.archive.org/web/20070808133623/http://www.xeka.ru/" target="_blank" rel="noopener">The Antichat Mafia</a>.&#8221;</p>
<div id="attachment_50793" style="width: 395px" class="wp-caption aligncenter"><img class="size-full wp-image-50793" src="media/4dc645ba.antichatmafia.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/antichatmafia.png" alt="" width="385" height="505" /><p class="wp-caption-text">A cached copy of the entry page for xeka[.]ru. Image courtesy archive.org.</p></div>
<p>More importantly, that same hm@mail.ru email address was used to register accounts at Facebook, Foursquare, Skype and Twitter in the name of Kirill Firsov.</p>
<p>Russian hacking forums have taken note of Firsov&#8217;s arrest, as they do whenever an alleged cybercriminal in their midst gets apprehended by authorities; typically such a user&#8217;s accounts are then removed from the forum as a security precaution. An administrator of one popular crime forum posted today that Firsov is a 28-year-old from Krasnodar, Russia who studied at the <a href="http://mpi.fsb.ru/r4/index.html" target="_blank" rel="noopener">Moscow Border Institute</a>, a division of the Russian <a href="https://en.wikipedia.org/wiki/Federal_Security_Service" target="_blank" rel="noopener">Federal Security Service</a> (FSB).</p>
<p>Firsov is slated to be arraigned later this week, when he will face two felony counts, specifically aiding and abetting the unauthorized solicitation of access devices, and aiding and abetting trafficking in &#8220;false authentication features.&#8221; A copy of the indictment is available <a href="media/ce35d979.firsovindictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/firsovindictment.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=50817
title: Microsoft Patch Tuesday, March 2020 Edition
uri: Microsoft-Patch-Tuesday-March-2020-Edition
url: https://krebsonsecurity.com/2020/03/microsoft-patch-tuesday-march-2020-edition/
content:
<p><strong>Microsoft Corp.</strong> today released updates to plug more than 100 security holes in its various <strong>Windows</strong> operating systems and associated software. If you (ab)use Windows, please take a moment to read this post, backup your system(s), and patch your PCs.</p>
<p>All told<img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />, this patch batch addresses at least 115 security flaws. Twenty-six of those earned Microsoft&#8217;s most-dire &#8220;critical&#8221; rating, meaning malware or miscreants could exploit them to gain complete, remote control over vulnerable computers without any help from users.</p>
<p>Given the sheer number of fixes, mercifully there are no <a href="https://en.wikipedia.org/wiki/Zero-day_(computing)" target="_blank" rel="noopener">zero-day bugs</a> to address, nor were any of them detailed publicly prior to today. Also, there were no security patches released by <strong>Adobe</strong> today. But there are a few eyebrow-raising Windows vulnerabilities worthy of attention.</p>
<p><strong>Recorded Future</strong> warns exploit code is now available for one of the critical bugs Redmond patched last month in <strong>Microsoft Exchange</strong> (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0688" target="_blank" rel="noopener">CVE-2020-0688</a>), and that nation state actors have been observed abusing the exploit for targeted attacks.</p>
<p>One flaw fixed this month in <strong>Microsoft Word</strong> (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0852" target="_blank" rel="noopener">CVE-2020-0852</a>) could be exploited to execute malicious code on a Windows system just by getting the user to load an email containing a booby-trapped document in the <strong>Microsoft Outlook</strong> preview pane. CVE-2020-0852 is one just four remote execution flaws Microsoft patched this month in versions of Word.</p>
<p>One somewhat ironic weakness fixed today (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0872" target="_blank" rel="noopener">CVE-2020-0872</a>) resides in a new component Microsoft debuted this year called <a href="https://www.microsoft.com/security/blog/2020/01/16/introducing-microsoft-application-inspector/" target="_blank" rel="noopener">Application Inspector</a>, a source code analyzer designed to help Windows developers identify &#8220;interesting&#8221; or risky features in open source software (such as the use of cryptography, connections made to a remote entity, etc).</p>
<p>Microsoft said this flaw can be exploited if a user runs Application Inspector on a hacked or booby-trapped program. Whoops. <strong>Animesh Jain</strong> from security vendor <strong>Qualys</strong> <a href="https://blog.qualys.com/laws-of-vulnerabilities/2020/03/10/march-2020-patch-tuesday-115-vulns-26-critical-microsoft-word-and-workstation-patches" target="_blank" rel="noopener">says</a> this patch should be prioritized, despite being labeled as less severe (&#8220;important&#8221; versus &#8220;critical&#8221;) by Microsoft.</p>
<p>For enterprises, Qualys recommends prioritizing the patching of desktop endpoints over servers this month, noting that most of the other critical bugs patched today are prevalent on workstation-type devices. Those include a number of flaws that can be exploited simply by convincing a Windows user to browse to a malicious or hacked Web site.<span id="more-50817"></span></p>
<p>While many of the vulnerabilities fixed in today&#8217;s patch batch affect Windows 7 operating systems, this OS is no longer being supported with security updates (unless you’re an enterprise taking advantage of Microsoft’s <a href="https://support.microsoft.com/en-us/help/4527878/faq-about-extended-security-updates-for-windows-7" target="_blank" rel="noopener">paid extended security updates program</a>, which is available to Windows 7 Professional and Windows 7 enterprise users).</p>
<p>If you rely on Windows 7 for day-to-day use, it’s probably time to think about upgrading to something newer. That might be a computer with Windows 10. Or maybe you have always wanted that shiny MacOS computer.</p>
<p>If cost is a primary motivator and the user you have in mind doesn’t do much with the system other than browsing the Web, perhaps a <strong>Chromebook</strong> or an older machine with a recent version of <strong>Linux</strong> is the answer (Ubuntu may be easiest for non-Linux natives). Whichever system you choose, it’s important to pick one that fits the owner’s needs and provides security updates on an ongoing basis.</p>
<p>Keep in mind that while staying up-to-date on Windows patches is a must, it’s important to make sure you’re updating only after you’ve backed up your important data and files. A reliable backup means you’re not losing your mind when the odd buggy patch causes problems booting the system.</p>
<p>So do yourself a favor and backup your files before installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips. Also, keep an eye on the <a href="https://www.askwoody.com/2020/february-2020-patch-tuesday-foibles/" target="_blank" rel="noopener">AskWoody blog</a> from <strong>Woody Leonhard</strong>, who keeps a close eye on buggy Microsoft updates each month.</p>
<p><strong>Update, 7:50 p.m.:</strong> Microsoft has released <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/ADV200005" target="_blank" rel="noopener">an advisory</a> about a remote code execution vulnerability in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. Critical SMB (Windows file-sharing) flaws are dangerous because they are typically &#8220;wormable,&#8221; in that they can spread rapidly to vulnerable systems across an internal network with little to no human interaction.</p>
<p>&#8220;To exploit the vulnerability against an SMB Server, an unauthenticated attacker could send a specially crafted packet to a targeted SMBv3 Server,&#8221; Microsoft warned. &#8220;To exploit the vulnerability against an SMB Client, an unauthenticated attacker would need to configure a malicious SMBv3 Server and convince a user to connect to it.&#8221;</p>
<p>Microsoft&#8217;s advisory says the flaw is neither publicly disclosed nor exploited at the moment. It includes a workaround to mitigate the flaw in file-sharing servers, but says the workaround does not prevent the exploitation of clients.</p>


feed_id: https://krebsonsecurity.com/?p=50828
title: Crafty Web Skimming Domain Spoofs “https”
uri: Crafty-Web-Skimming-Domain-Spoofs-https
url: https://krebsonsecurity.com/2020/03/crafty-web-skimming-domain-spoofs-https/
content:
<p>Earlier today, KrebsOnSecurity alerted the 10th largest food distributor in the United States that one of its Web sites had been hacked and retrofitted with code that steals credit card and login data. While such Web site card skimming attacks are not new, this intrusion leveraged a sneaky new domain that hides quite easily in a hacked site&#8217;s source code: &#8220;<strong>http[.]ps</strong>&#8221; (the actual malicious domain does not include the brackets, which are there to keep readers from being able to click on it).</p>
<p>This crafty domain was hidden inside the checkout and login pages for <strong>grandwesternsteaks.com</strong>, a meat delivery service owned by <a href="https://www.cheneybrothers.com/" target="_blank" rel="noopener">Cheney Bros. Inc.</a>, a major food distributor based in Florida. Here&#8217;s what a portion of the login page looked like until earlier today when you right-clicked on the page and selected  &#8220;view-source&#8221;:</p>
<div id="attachment_50829" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/c5a53b18.gws.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/gws.png"><img class="wp-image-50829" src="media/c5a53b18.gws.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/gws.png" alt="" width="598" height="425" /></a><p class="wp-caption-text">The malicious domain added to the HTML code for grandwesternsteaks.com (highlighted in orange) fetched a script that intercepted data entered by customers, including credit card details and logins. The code has since been removed from the site.</p></div>
<p>Viewing the HTML source for the malicious link highlighted in the screenshot above reveals the obfuscated card-skimming code, a snippet of which is pictured below:</p>
<div id="attachment_50830" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/59eb9c26.gws-skimsource.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/gws-skimsource.png"><img class="wp-image-50830" src="media/59eb9c26.gws-skimsource.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/gws-skimsource.png" alt="" width="596" height="278" /></a><p class="wp-caption-text">The obfuscated card skimming code is full of references to &#8220;ants&#8221; and &#8220;cockroaches,&#8221; which is enough to give any site owner the heebie-jeebies.</p></div>
<p>A simple search on the malicious domain &#8220;http[.]ps&#8221; at HTML search service <a href="https://publicwww.com" target="_blank" rel="noopener">publicwww.com</a> shows this code is present on nearly a dozen other sites, including a music instrument retailer, an herbal pharmacy shop in Europe, and a business in Spain that sells <a href="https://en.wikipedia.org/wiki/Programmable_logic_controller" target="_blank" rel="noopener">programmable logic controllers</a> &#8212; expensive computers and circuit boards designed to control large industrial operations.<span id="more-50828"></span></p>
<p>The http[.]ps domain is hosted in Russia, and sits on a server with one other malicious domain &#8212; <strong>autocapital[.]pw</strong>. According a Mar. 3 Twitter post by security researcher and blogger <a href="https://twitter.com/unmaskparasites/status/1234917686242619393?s=20" target="_blank" rel="noopener">Denis Sinegubko</a>, the autocapital domain acts as a collector of data hoovered up by the http[.]ps skimming script.</p>
<p><a href="https://blog.malwarebytes.com/author/jeromesegura/" target="_blank" rel="noopener">Jerome Segura</a> over at <strong>Malwarebytes</strong> <a href="https://blog.malwarebytes.com/threat-analysis/2020/03/rocket-loader-skimmer-impersonates-cloudflare-library-in-clever-scheme/" target="_blank" rel="noopener">recently wrote about a similar attack</a> in which the intruders used http[.]ps to spoof the location of a script that helps improve page load times for sites that rely on Web infrastructure firm <a href="https://en.wikipedia.org/wiki/Cloudflare" target="_blank" rel="noopener">Cloudflare</a>.</p>
<p>&#8220;There is a subtle difference in the URI path loading both scripts,&#8221; Segura wrote. &#8220;The malicious one uses a clever way to turn the domain name <strong>http.ps</strong> (note the dot ‘.’ , extra ‘p’ and double slash ‘//’) into something that looks like ‘https://’. The threat actors are taking advantage of the fact that <a href="https://bugs.chromium.org/p/chromium/issues/detail?id=883038#c114" target="_blank" rel="noopener noreferrer" aria-label="since Google Chrome version 76 (opens in a new tab)" data-ss1583956254="1">since Google Chrome version 76</a>, the “https” scheme (and special-case subdomain “www”) is no longer shown to users.&#8221;</p>
<p>Segura says there are two ways e-commerce sites are being compromised here:</p>
<ul>
<li>Skimming code that is injected into a self hosted JavaScript library (the jQuery library seems to be the most targeted)</li>
<li>A script that references an external JavaScript, hosted on a malicious site (in this case, http[.]ps)</li>
</ul>
<p>Malwarebytes assesses that the tricks this domain uses to obfuscate the malicious code are tied to various site-hacking malware campaigns <a href="https://blog.sucuri.net/2019/03/more-on-dnsden-biz-swipers-and-radix-obfuscation.html" target="_blank" rel="noopener">dating back to 2016</a>. By the way, an installation of Malwarebytes on a test machine used for this investigation blocked the http[.]ps script from loading on each of the compromised sites I found.</p>
<p>Finally, the &#8220;.ps&#8221; bit of the malicious skimming domain refers to the country code top-level-domain (ccTLD) for the <a href="https://en.wikipedia.org/wiki/.ps" target="_blank" rel="noopener">State of Palestine</a>. The domain was registered on Feb. 7.</p>
<p>If you run an e-commerce Web site, it would be a great idea to read up on leveraging <a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP" target="_blank" rel="noopener">Content Security Policy</a> (CSP) response headers and <a href="https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity" target="_blank" rel="noopener">Subresource Integrity</a> security features offered by modern Web browsers. These offer mitigation options to prevent your site from being used in these card skimming attacks. <strong>Ryan Barnett</strong> at <strong>Akamai</strong> penned <a href="https://blogs.akamai.com/sitr/2018/11/protecting-your-website-visitors-from-magecart-trust-but-verify.html" target="_blank" rel="noopener">a comprehensive blog post</a> on these approaches not long ago that is well worth reading [full disclosure: Akamai is an advertiser on this site].</p>
<p>I&#8217;ve been playing recently with <a href="https://privacy.com/" target="_blank" rel="noopener">privacy.com</a>, which among other things offers a free service that allows users to generate a unique, one-time credit card number for each online transaction (privacy.com makes money from the interchange fees paid by merchants). The beauty of this approach is if your credit card details do get swiped by one of these site skimmers, you won&#8217;t have to change your credit card information at dozens of other sites and services you frequent.</p>


feed_id: https://krebsonsecurity.com/?p=50850
title: Live Coronavirus Map Used to Spread Malware
uri: Live-Coronavirus-Map-Used-to-Spread-Malware
url: https://krebsonsecurity.com/2020/03/live-coronavirus-map-used-to-spread-malware/
content:
<p>Cybercriminals constantly latch on to news items that captivate the public&#8217;s attention, but usually they do so by sensationalizing the topic or spreading misinformation about it. Recently, however, cybercrooks have started disseminating real-time, accurate information about global infection rates tied to the <strong>Coronavirus/COVID-19</strong> pandemic in a bid to infect computers with malicious software.</p>
<div id="attachment_50853" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/77fab861.cv-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/cv-map.png"><img class="wp-image-50853" src="media/77fab861.cv-map.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/cv-map.png" alt="" width="598" height="295" /></a><p class="wp-caption-text">A recent snapshot of the Johns Hopkins Coronavirus data map, available at coronavirus.jhu.edu.</p></div>
<p>In one scheme, <a href="https://coronavirus.jhu.edu/map.html" target="_blank" rel="noopener">an interactive dashboard of Coronavirus infections and deaths</a> produced by <strong>John Hopkins University</strong> is being used in malicious Web sites (and possibly spam emails) to spread password-stealing malware.</p>
<p>Late last month, a member of several Russian language cybercrime forums began selling a digital Coronavirus infection kit that uses the Hopkins interactive map as part of a Java-based malware deployment scheme. The kit costs $200 if the buyer already has a Java code signing certificate, and $700 if the buyer wishes to just use the seller&#8217;s certificate.</p>
<p>&#8220;It loads [a] fully working online map of Corona Virus infected areas and other data,&#8221; the seller explains. &#8220;Map is resizable, interactive, and has real time data from World Health Organization and other sources. Users will think that PreLoader is actually a map, so they will open it and will spread it to their friends and it goes viral!&#8221;</p>
<p>The sales thread claims the customer&#8217;s payload can be bundled with the Java-based map into a filename that most Webmail providers allow in sent messages. The seller claims in a demonstration video that Gmail also allows it, but the video shows Gmail still warns recipients that downloading the specific file type in question (obscured in the video) can be harmful. The seller says the user/victim has to have Java installed for the map and exploit to work, but that it will work even on fully patched versions of Java.<span id="more-50850"></span></p>
<p>&#8220;Loader loads .jar files which has real working interactive Coronavirus realtime data map and a payload (can be a separate loader),&#8221; the seller said in the video. &#8220;Loader can predownload only map and payload will be loaded after the map is launched to show map faster to users. Or vice versa payload can be predownloaded and launched first.&#8221;</p>
<p>It&#8217;s unclear how many takers this seller has had, but earlier this week security experts <a href="https://blog.malwarebytes.com/social-engineering/2020/02/battling-online-coronavirus-scams-with-facts/" target="_blank" rel="noopener">began</a> warning of new malicious Web sites being stood up that used interactive versions of the same map to distract visitors while the sites tried to foist the password-stealing <a href="https://securelist.com/azorult-analysis-history/89922/" target="_blank" rel="noopener">AZORult</a> malware.</p>
<p>As long as this pandemic remains front-page news, malware purveyors will continue to use it as lures to snare the unwary. Keep your guard up, and avoid opening attachments sent unbidden in emails &#8212; even if they appear to come from someone you know.</p>


feed_id: https://krebsonsecurity.com/?p=50870
title: The Web’s Bot Containment Unit Needs Your Help
uri: The-Web-s-Bot-Containment-Unit-Needs-Your-Help
url: https://krebsonsecurity.com/2020/03/the-webs-bot-containment-unit-needs-your-help/
content:
<p>Anyone who&#8217;s seen the 1984 hit movie <a href="https://en.wikipedia.org/wiki/Ghostbusters" target="_blank" rel="noopener">Ghostbusters</a> likely recalls the pivotal scene where a government bureaucrat <a href="https://www.youtube.com/watch?v=j3Uy9wsfkok" target="_blank" rel="noopener">orders the shutdown of the ghost containment unit</a>, effectively unleashing a pent-up phantom menace on New York City. Now, something similar is in danger of happening in cyberspace: <strong><a href="https://www.shadowserver.org" target="_blank" rel="noopener">Shadowserver.org</a></strong>, an all-volunteer nonprofit organization that works to help Internet service providers (ISPs) identify and quarantine malware infections and botnets, has lost its longtime primary source of funding.</p>
<div id="attachment_50890" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-50890" src="media/df6b6e7f.ghostbusters.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/ghostbusters.png" alt="" width="593" height="358" /><p class="wp-caption-text">Image: Ghostbusters.</p></div>
<p>Shadowserver provides free daily live feeds of information about systems that are either infected with bot malware or are in danger of being infected to more than 4,600 ISPs and to 107 national computer emergency response teams (CERTs) in 136 countries. In addition, it has aided the FBI and other nations&#8217; federal law enforcement officials in &#8220;sinkholing&#8221; domain names used to control the operations of far-flung malware empires.</p>
<p>In computer security lexicon, a <a title="http://en.wikipedia.org/wiki/DNS_Sinkhole" href="http://en.wikipedia.org/wiki/DNS_Sinkhole" target="_blank" rel="noopener">sinkhole</a> is basically a way of redirecting malicious Internet traffic so that it can be captured and analyzed by experts and/or law enforcement officials. Typically, a sinkhole is set up in tandem with some kind of legal action designed to wrest control over key resources powering a malware network.</p>
<p>Some of these interventions involving ShadowServer have been documented here, including the <a href="https://krebsonsecurity.com/2016/12/avalanche-global-fraud-ring-dismantled/" target="_blank" rel="noopener">Avalanche spam botnet takedown</a>, <a href="https://krebsonsecurity.com/2011/03/homegrown-rustock-botnet-fed-by-u-s-firms/" target="_blank" rel="noopener">the Rustock botnet takeover</a>, the <a href="https://krebsonsecurity.com/2014/06/backstage-with-the-gameover-botnet-hijackers/" target="_blank" rel="noopener">Gameover malware botnet seizure</a>, and <a href="https://krebsonsecurity.com/2012/09/microsoft-disrupts-nitol-botnet-in-piracy-sweep/" target="_blank" rel="noopener">the Nitol botnet sneak attack</a>. Last week, Shadowserver was instrumental in <a href="https://www.zdnet.com/article/microsoft-orchestrates-coordinated-takedown-of-necurs-botnet/" target="_blank" rel="noopener">helping Microsoft kneecap the Necurs malware network</a>, one of the world&#8217;s largest spam and malware botnets.</p>
<div id="attachment_50886" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/2454edf6.shadowtakedowns.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/shadowtakedowns.png"><img class="wp-image-50886" src="media/2454edf6.shadowtakedowns.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/shadowtakedowns.png" alt="" width="598" height="259" /></a><p class="wp-caption-text">Image: Shadowserver.org</p></div>
<p>Sinkholing allows researchers to assume control over a malware network’s domains, while redirecting any traffic flowing to those systems to a server the researchers control. As long as good guys control the sinkholed domains, none of the infected computers can receive instructions about how to harm themselves or others online.</p>
<p>And Shadowserver has time and again been the trusted partner when national law enforcement agencies needed someone to manage the technical side of things while people with guns and badges seized hard drives at the affected ISPs and hosting providers.</p>
<p>But very recently, Shadowserver got the news that the company which has primarily funded its operations <a href="https://www.washingtonpost.com/wp-dyn/content/article/2006/03/21/AR2006032100279_pf.html" target="_blank" rel="noopener">for more than 15 years</a>, networking giant <strong>Cisco Systems Inc.</strong>, opted to stop providing that support.</p>
<p>Cisco declined to respond to questions about why it withdrew funding. But it did say the company was exploring the idea of supporting the organization as part of a broader support effort by others in the technology industry going forward.</p>
<p>“Cisco supports the evolution of Shadowserver to an industry alliance enabling many organizations to contribute and grow the capabilities of this important organization,&#8221; the company said in a written statement. &#8220;Cisco is proud of its long history as a Shadowserver supporter and will explore future involvement as the alliance takes shape.”</p>
<p>To make matters worse, Shadowserver has been told it needs to migrate its data center to a new location by May 15, a chore the organization reckons will cost somewhere in the neighborhood of $400,000.</p>
<p>&#8220;Millions of malware infected victims all over the world, who are currently being sinkholed and protected from cybercriminal control ​by Shadowserver, may lose that critical protection &#8211; just at the time when governments and businesses are being forced to unexpectedly stretch their corporate security perimeters and allow staff to work from home on their own, potentially unmanaged devices, and the risk of another major Windows worm has increased,&#8221; Shadowserver <a href="https://www.shadowserver.org/news/saving-shadowserver-and-securing-the-internet-why-you-should-care-how-you-can-help/" target="_blank" rel="noopener">wrote</a> in a blog post published today about their financial plight.<br />
<span id="more-50870"></span></p>
<p>The Shadowserver Foundation currently serves 107 National computer emergency response teams (CERTs) in 136 countries, more than 4,600 vetted network owners and over 90% of the Internet, primarily by giving them free daily network reports.</p>
<p>&#8220;These reports notify our constituents ​about millions of misconfigured, compromised, infected or abusable devices for remediation every day,&#8221; Shadowserver explained.</p>
<p>The group is exploring several options for self-funding, but Shadowserver Director <strong>Richard Perlotto</strong> says the organization will likely depend on a tiered &#8220;alliance&#8221; funding model, where multiple entities provide financial support.</p>
<p>&#8220;Many national CERTs have been getting our data for free for years, but most of these organizations have no money and we never charged them because Cisco paid the bill,&#8221; Perlotto said. &#8220;The problem for Shadowserver is we don&#8217;t blog about our accomplishments very frequently and we operate pretty quietly. But now that we need to do funding it&#8217;s a different story.&#8221;</p>
<p><span style="font-weight: 400;">Perlotto said while Shadowserver&#8217;s data is extremely valuable, the organization took a stance long ago </span><span style="font-weight: 400;">that it would </span>never sell victim data<span style="font-weight: 400;">. </span></p>
<p><span style="font-weight: 400;">&#8220;This does not mean that we are anti-commercial sector activities – we definitely believe that there are huge opportunities for innovation, for product development, and to sell cyber security services,&#8221; he said. &#8220;Shadowserver does not seek to compete with commercial vendors, or disrupt their business models. But we do fundamentally believe that </span>no-one should have to pay to find out that they have been a victim of cybercrime<span style="font-weight: 400;">.&#8221;</span></p>
<p>Most immediately, Shadowserver needs to raise approximately $400,000 by the end of this month to manage the migration of its 1,300+ servers out of Cisco&#8217;s California data center into a new facility.</p>
<p>Anyone interested in supporting that migration effort can do so directly <a href="https://www.shadowserver.org/sponsor/" target="_blank" rel="noopener">here</a>; Shadowserver&#8217;s contact page is <a href="https://www.shadowserver.org/contact/" target="_blank" rel="noopener">here</a>.</p>
<p><strong>Update 10:46 a.m., ET:</strong> Added comment from Cisco.</p>


feed_id: https://krebsonsecurity.com/?p=50869
title: Coronavirus Widens the Money Mule Pool
uri: Coronavirus-Widens-the-Money-Mule-Pool
url: https://krebsonsecurity.com/2020/03/coronavirus-widens-the-money-mule-pool/
content:
<p>With many people being laid off or working from home thanks to the <strong>Coronavirus</strong> pandemic, cybercrooks are almost certain to have more than their usual share of recruitable &#8220;<strong>money mules</strong>&#8221; &#8212; people who get roped into money laundering schemes under the pretense of a work-at-home job offer. Here&#8217;s the story of one upstart mule factory that spoofs a major nonprofit and tells new employees they&#8217;ll be collecting and transmitting donations for an international &#8220;Coronavirus Relief Fund.&#8221;</p>
<p>On the surface, the Web site for the <strong>Vasty Health Care Foundation</strong> certainly looks legitimate. It includes various sections on funding relief efforts around the globe, explaining that it &#8220;connects nonprofits, donors, and companies in nearly every country around the world.&#8221; The site says it&#8217;s a nonprofit with offices based in Nebraska and Quebec, Canada.</p>
<div id="attachment_50912" style="width: 606px" class="wp-caption aligncenter"><img class="wp-image-50912" src="media/bda3b10a.vasty-home.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/vasty-home.png" alt="" width="596" height="498" /><p class="wp-caption-text">Vasty is a phony charity that pretends to raise money for Coronavirus victims but instead hires people to help launder stolen funds. This and the rest of the content at Vasty&#8217;s site was lifted from GlobalGiving, a legitimate charity that is helping people affected by the pandemic.</p></div>
<p>The &#8220;Vasty Health Care Foundation&#8221; is one of several fraudulent Web sites that recruit money mules in the name of helping Coronavirus victims. The content on Vasty&#8217;s site was lifted almost entirely from <strong>globalgiving.org</strong>, a legitimate charity that actually is trying to help people affected by the pandemic.</p>
<p>&#8220;We have been contacted by job seekers asking if we are related to some of these job opportunities they&#8217;ve been finding on Indeed.com and Monster.com,&#8221; said <strong>Kevin Conroy</strong>, chief product officer at GlobalGiving. &#8220;And we always tell them no that&#8217;s not from us, and not to cash any checks someone may be giving them in relation to those offers.&#8221;</p>
<p>The Vasty domain &#8212; <strong>vastyhealthcarefoundation[.]com</strong> &#8212; was registered just weeks ago, although the site claims its organization has been around for years.</p>
<p>The crooks behind this scheme also seem to have submitted the Vasty name in custom links at vetting sites like <a href="http://www.bbb.org/charity-reviews/national/other/Vasty%20Health%20Care%20Foundation-foundation-in-washington-dc-3204" target="_blank" rel="noopener">The Better Business Bureau</a> and <a href="http://www.guidestar.org/organizations/30-0108263/Vasty%20Health%20Care%20Foundation-foundation.aspx" target="_blank" rel="noopener">Guidestar</a> that ultimately take one to a summary of data on GlobalGiving. No doubt this is part of an effort to lend legitimacy to the Vasty name (hovering over the links above reveals the trickery).</p>
<p>What proof is there that Vasty isn&#8217;t a legitimate charity? None of the dozens of Canadian mules contacted by this author responded to requests for comment. But KrebsOnSecurity received copious amounts of information about this scam from Milwaukee, Wisc. based <a href="https://www.holdsecurity.com" target="_blank" rel="noopener">Hold Security</a>, which managed to intercept key file exchanges between threat actors through public file sharing services.</p>
<p>Among those files were a set of form letters and boilerplate email messages that describe the ideal candidate for the job at Vasty and welcome new recruits to the Vasty payroll. Here&#8217;s a look at part of the job description, which includes (not pictured) a description of the healthcare plans and other benefits allegedly offered to Vasty employees.</p>
<p><img class="aligncenter wp-image-50918" src="media/0c9e8ab3.vasty-jobdescription.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/vasty-jobdescription.png" alt="" width="596" height="566" /></p>
<p>After congratulating applicants (everyone who applies is &#8220;hired&#8221;) on their new positions, Vasty asks the recruits to do some busy work. In this case, new hires are sent to local pharmacies on some bogus errand, such as to inspect the pricing of face masks and hand sanitizer products for price-gouging.</p>
<blockquote><p>&#8220;Now we have the first task for you. You will have to perform a trip within your city. So that we can compensate for transportation costs along with your hourly rate, I ask you to keep receipts confirming your expenses.</p>
<p>LOCATION: Sam&#8217;s Geneva Street Pharmacy</p>
<p>ADDRESS:  284 Geneva St, St. Catharines, ON L2N 2E8</p>
<p>I ask you to go to the pharmacy at the specified address. We are increasingly receiving reports of private sellers violating the pricing policy for products such as: aspirin, face masks are loose surgical masks with elastic loops that go around the ears, hand sanitizers.&#8221;</p></blockquote>
<p>New recruits are then asked to assemble and submit a written report of their observations at the store in question.</p>
<p>These types of menial, meaningless tasks are a typical tactic of money mule recruitment schemes and they serve two main purposes: They separate out slackers from people who really need and want a job, and they help the employee feel like he&#8217;s doing something useful and legitimate (aside from just moving money around, which if brought up too soon might make him question whether the job is legit).<span id="more-50869"></span></p>
<p>Eventually, after successfully completing one or more of these busy work tasks, the new hire is asked to process a &#8220;donation&#8221; from someone who wants to help fight the Coronavirus outbreak:</p>
<blockquote><p>&#8220;Please read the instructions carefully. One donor wants to make donations to help fight the coronavirus. As you know, this is a big problem for most countries of the world. Every day we receive information from the World Health Organization that more and more people are sick. Quite a lot of people died from this virus. Some people simply don’t have enough funds to provide themselves with standard face masks and disinfectants to fight the virus.&#8221;</p>
<p>&#8220;The donor requests that Bitcoins be bought with his funds. For this task, you need to create your Bitcoin wallet, or use the QR code that we send you in this letter. You will receive from the donor up to 3000 CAD. Your commission up to 150 CAD will be included in this amount to cover your expenses. I remind you that you do not need to use your funds to buy bitcoins. The funds will be sent to you. You will need to receive cash atm or at your bank branch.&#8221;</p></blockquote>
<p>What happens next is the employee then receives an electronic transfer of money into his bank account, is asked to withdraw the cash, and to keep 150 Canadian dollars for himself. He&#8217;s then instructed to take the remainder of the funds to a Bitcoin ATM and scan an emailed QR code with his mobile phone. This causes the cash he deposits into the Bitcoin ATM to be sent in an irreversible transaction to a Bitcoin wallet controlled by the scammers.</p>
<p>What&#8217;s going on behind the scenes is the funds that get deposited in the employee&#8217;s account are invariably stolen from other hacked bank accounts, and the employee is merely helping the crooks launder the stolen money into a form of payment that can&#8217;t be reversed.</p>
<p>Another boilerplate email intercepted by Hold Security shows Vasty&#8217;s new hires manager offering advice to employees who are asked by nosey bank employees about the nature of the funds withdrawal.</p>
<blockquote><p>&#8220;Important: If you receive any questions from the bank regarding the purpose of the payment, you can open part of the instructions if necessary and inform that these funds are intended for payment of medicines. In any case, it is a personal payment and it will not be taxed. However, I strongly recommend that you not divulge the rest of the instructions for paying for medicines against coronavirus so as not to aggravate panic among the population.&#8221;</p></blockquote>
<p>Americans shouldn&#8217;t feel left out of the scam: Hold Security founder <strong>Alex Holden</strong> says his analysts also intercepted a nearly identical set of scam templates targeting job seekers in the United States.</p>
<p>Money mule scammers specialize in hacking employer accounts at job recruitment Web sites like Monster.com, Hotjobs.com and other popular employment search services. Armed with the employer accounts, the crooks are free to search through millions of resumes and reach out to people who are currently between jobs or seeking part-time employment.</p>
<p>If you receive a job solicitation via email that sounds too-good-to-be-true, it probably is related in some way to one of these money-laundering schemes. Even if you can’t see the downside to you, someone is likely getting ripped off. Also, know that money mules — however unwitting — may find themselves in hot water with local police, and may be asked by their bank to pay back funds that were illegally transferred into the mules’ account.</p>
<p>Overall, Holden said, established cybercriminals who specialize in recruiting and grooming money mules for financial crimes have been cooing of late over the potential glut of new mules. One mule vendor on a popular Russian-language crime forum posted Tuesday that his &#8220;drops&#8221; &#8212; the hacker slang term for money mules &#8212; weren&#8217;t scared of Coronavirus concerns.</p>
<p>&#8220;We got drops in masks!,&#8221; one vendor proclaimed.</p>
<p>&#8220;We continue to work despite the Coronavirus,&#8221; declared another drops vendor.</p>
<p>Any readers interested in helping others affected by the Coronavirus outbreak should consider giving through the organization Vasty is impersonating here; <a href="https://www.globalgiving.org/projects/coronavirus-relief-fund/" target="_blank" rel="noopener">Global Giving</a>. Alternatively, these <a href="https://www.marketwatch.com/story/everyone-is-a-responder-in-this-crisis-heres-where-you-can-donate-and-volunteer-2020-03-15" target="_blank" rel="noopener">two</a> <a href="https://www.buzzfeednews.com/article/tasneemnashrulla/coronavirus-covid19-organizations-help-food-medical-aid" target="_blank" rel="noopener">stories</a> link to a number of other reputable organizations facilitating Coronavirus relief efforts.</p>


feed_id: https://krebsonsecurity.com/?p=50960
title: Security Breach Disrupts Fintech Firm Finastra
uri: Security-Breach-Disrupts-Fintech-Firm-Finastra
url: https://krebsonsecurity.com/2020/03/security-breach-disrupts-fintech-firm-finastra/
content:
<p><strong>Finastra</strong>, a company that provides a range of technology solutions to banks worldwide, said it was shutting down key systems in response to a security breach discovered Friday morning. The company&#8217;s public statement and notice to customers does not mention the cause of the outage, but their response so far is straight out of the playbook for dealing with ransomware attacks.</p>
<p><img class="aligncenter  wp-image-50961" src="media/b38c8607.finastra.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/finastra.png" alt="" width="596" height="362" />London-based Finastra has offices in 42 countries and reported more than $2 billion in revenues last year. The company employs more than 10,000 people and has over 9,000 customers across 130 countries &#8212; including nearly all of the top 50 banks globally.</p>
<p>Earlier today, sources at two different U.S. financial institutions forwarded a notice they received from Finastra saying the outage was expected to disrupt certain services, particularly for clients in North America.</p>
<p>&#8220;We wish to inform our valued customers that we are investigating a potential security breach. At 3:00 a.m. EST on March 20, 2020, we were alerted to anomalous activity on our network which risked the integrity of our data-centers,&#8221; reads the notice. &#8220;As such, and to protect our customers, we have taken quick and strict remedial action to contain and isolate the incident, while we investigate further.&#8221;<span id="more-50960"></span></p>
<p>The statement continues:</p>
<blockquote><p>&#8220;Our approach has been to temporarily disconnect from the internet the affected servers, both in the USA and elsewhere, while we work closely with our cybersecurity experts to inspect and ensure the integrity of each server in turn. Using this ‘isolation, investigation and containment’ approach will allow us to bring the servers back online as quickly as possible, with minimum disruption to service, however we are anticipating some disruption to certain services, particularly in North America, whilst we undertake this task. Our priority is ensuring the integrity of the servers before we bring them back online and protecting our customers and their data at this time.&#8221;</p></blockquote>
<p>Finastra did not respond to requests for comment. But the company appears to have acknowledged an incident via <a href="https://www.finastra.com/statement-coo-finastra" target="_blank" rel="noopener">a notice</a> on its Web site that offers somewhat less information and refers to the incident merely as the detection of anomalous activity.</p>
<p>&#8220;The Finastra risk and security services team has detected anomalous activity on our systems,&#8221; wrote <strong>Tom Kilroy</strong>, Finastra&#8217;s chief operating officer. &#8220;In order to safeguard our customers and employees, we have made the decision to take a number of our servers offline while we investigate. This, of course, has an impact on some of our customers and we are in touch directly with those who may be affected.&#8221;</p>
<p>Once considered by many to be isolated extortion attacks, ransomware infestations have become de facto data breaches for victim companies. That&#8217;s because some of the more active ransomware gangs have taken to downloading reams of data from targets before launching the ransomware inside their systems. Some or all of this data is then <a href="https://krebsonsecurity.com/2019/12/ransomware-gangs-now-outing-victim-businesses-that-dont-pay-up/" target="_blank" rel="noopener">published on victim-shaming sites</a> set up by the ransomware gangs as a way to strongarm victim companies into paying up.</p>
<p>One reader on Twitter told KrebsOnSecurity they&#8217;d heard Finastra had sent thousands of employees home today as a result of the security breach, but that claim could not be confirmed. Considering the rapidity with which the global Coronavirus pandemic appears to be spreading, thousands of employees being sent home might not be the worst outcome here.</p>
<p>Interestingly, several ransomware gangs have apparently stated that they are observing a kind of moratorium on attacking hospitals and other healthcare centers while the Coronavirus epidemic rages on. Bleeping Computer&#8217;s <strong>Lawrence Abrams</strong> said he <a href="https://www.bleepingcomputer.com/news/security/ransomware-gangs-to-stop-attacking-health-orgs-during-pandemic/" target="_blank" rel="noopener">recently reached out</a> to the operators of the Maze, DoppelPaymer, Ryuk, Sodinokibi/REvil, PwndLocker, and Ako Ransomware infections to ask if they would continue targeting health and medical organizations during the outbreak.</p>
<p>Abrams said several of those gangs told him they would indeed stop attacking healthcare providers for the time being. One gang even used its victim-shaming Web site to post a &#8220;press release&#8221; on Mar. 18 stated that &#8220;due to situation with incoming global economy crisis and virus pandemic&#8221; it would be offering discounts to victims of their ransomware.</p>
<p>&#8220;We also stop all activity versus all kinds of medical organizations until the stabilization of the situation with virus,&#8221; reads the release from the Maze ransomware gang.</p>
<div id="attachment_50973" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/18054033.mazepresser.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/mazepresser.png"><img class="wp-image-50973" src="media/18054033.mazepresser.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/mazepresser.png" alt="" width="598" height="320" /></a><p class="wp-caption-text">A press release published by the Maze ransomware group.</p></div>
<p>This story will be updated as more details become available.</p>


feed_id: https://krebsonsecurity.com/?p=50948
title: Zxyel Flaw Powers New Mirai IoT Botnet Strain
uri: Zxyel-Flaw-Powers-New-Mirai-IoT-Botnet-Strain
url: https://krebsonsecurity.com/2020/03/zxyel-flaw-powers-new-mirai-iot-botnet-strain/
content:
<p>In February, hardware maker <strong>Zyxel</strong> <a href="https://krebsonsecurity.com/2020/02/zyxel-fixes-0day-in-network-storage-devices/" target="_blank" rel="noopener">fixed a zero-day vulnerability in its routers and VPN firewall products</a> after KrebsOnSecurity told the company the flaw was being abused by attackers to break into devices. This week, security researchers said they spotted that same vulnerability being exploited by a new variant of <a href="https://krebsonsecurity.com/?s=mirai&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mirai</a>, a malware strain that targets vulnerable <strong>Internet of Things</strong> (IoT) devices for use in large-scale attacks and <a href="https://krebsonsecurity.com/2016/10/iot-devices-as-proxies-for-cybercrime/" target="_blank" rel="noopener">as proxies for other cybercrime activity</a>.</p>
<p><img class="aligncenter size-full wp-image-40170" src="media/a8923b63.iotc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/iotc.png" alt="" width="569" height="395" /></p>
<p>Security experts at <strong>Palo Alto Networks</strong> <a href="https://unit42.paloaltonetworks.com/new-mirai-variant-mukashi/" target="_blank" rel="noopener">said Thursday</a> their sensors detected the new Mirai variant &#8212; dubbed <strong>Mukashi</strong> &#8212; on Mar. 12. The new Mirai strain targets <a href="https://kb.cert.org/vuls/id/498544/" target="_blank" rel="noopener">CVE-2020-9054</a>, a critical flaw that exists in many VPN firewalls and network attached storage (NAS) devices made by Taiwanese vendor <strong>Zyxel Communication Corp.</strong>, which boasts some 100 million devices deployed worldwide.</p>
<p>Like other Mirai variants, Mukashi constantly scans the Internet for vulnerable IoT devices like security cameras and digital video recorders (DVRs), looking for a range of machines protected only by factory-default credentials or commonly-picked passwords.</p>
<p>Palo Alto said IoT systems infected by Mukashi then report back to a control server, which can be used to disseminate new instructions &#8212; such as downloading additional software or <a href="https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/" target="_blank" rel="noopener">launching distributed denial of service (DDoS) attacks</a>.</p>
<div id="attachment_50949" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/1413a7cc.mukashicommands.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/mukashicommands.png"><img class="wp-image-50949" src="media/1413a7cc.mukashicommands.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/mukashicommands.png" alt="" width="599" height="89" /></a><p class="wp-caption-text">The commands Mukashi botmasters can send to infected devices include scanning for and exploiting other systems, and launching DDoS attacks. Image: Palo Alto Networks.</p></div>
<p>Zyxel <a href="https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml" target="_blank" rel="noopener">issued a patch</a> for the flaw on Feb. 24, but the update did not fix the problem on many older Zyxel devices which are no longer being supported by the company. For those devices, Zyxel&#8217;s advice was not to leave them connected to the Internet.</p>
<p><a href="https://kb.cert.org/vuls/id/498544/" target="_blank" rel="noopener">A joint advisory on CVE-2020-9054</a> from the <strong>U.S. Department of Homeland Security</strong> and the <strong>CERT Coordination Center</strong> rates this vulnerability at a “10” — the most severe kind of flaw. The DHS/CERT advisory also includes sample code to test if a Zyxel product is vulnerable to the flaw.</p>
<p>My advice? If you can’t <a href="https://www.zyxel.com/support/remote-code-execution-vulnerability-of-NAS-products.shtml" target="_blank" rel="noopener">patch it</a>, pitch it, as Mukashi is not the only thing interested in this Zyxel bug: Recent activity suggests attackers known for deploying ransomware have been actively working to test it for use against targets.</p>


feed_id: https://krebsonsecurity.com/?p=50984
title: Who’s Behind the ‘Web Listings’ Mail Scam?
uri: Who-s-Behind-the-Web-Listings-Mail-Scam
url: https://krebsonsecurity.com/2020/03/whos-behind-the-web-listings-mail-scam/
content:
<p>In December 2018, KrebsOnSecurity looked at how dozens of U.S. political campaigns, cities and towns had paid a shady company called <strong>Web Listings Inc.</strong> after <a href="https://krebsonsecurity.com/2018/12/how-internet-savvy-are-your-leaders/" target="_blank" rel="noopener">receiving what looked like a bill for search engine optimization (SEO) services</a> rendered on behalf of their domain names. The story concluded that this dubious service had been scamming people and companies for more than a decade, and promised a Part II to explore who was behind Web Listings. What follows are some clues that point to a very convincing answer to that question.</p>
<p>Since at least 2007, Web Listings Inc. has been sending snail mail letters to domain registrants around the world. The missives appear to be an $85 bill for an &#8220;annual search engine listing&#8221; service. The notice does disclose that it is in fact a solicitation and not a bill, but wording of the notice asserts the recipient has already received the services in question.</p>
<div id="attachment_45949" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-45949" src="media/576e455e.wkbw.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/wkbw.png" alt="" width="597" height="675" /><p class="wp-caption-text">Image: Better Business Bureau.</p></div>
<p>The mailer references the domain name <strong>web-listings.net</strong>, one of several similarly-named domains registered sometime in 2007 or later to a &#8220;<strong>James Madison</strong>,&#8221; who lists his address variously as a university in New Britain, Connecticut or a UPS Store mailbox in Niagara Falls, New York.</p>
<p>Some others include: <strong>weblistingservices.com</strong>, <strong>webservicescorp.net</strong>, <strong>websiteservicescorp.com</strong>, <strong>web-listingsinc.com</strong>, <strong>weblistingsinc.net</strong>, and <strong>weblistingsreports.net</strong>. At some point, each of these domains changes the owner&#8217;s name from James Madison to &#8220;<strong>Mark Carter</strong>.&#8221; As we&#8217;ll see, Mark is a name that comes up quite a bit in this investigation.</p>
<div id="attachment_45978" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-45978" src="media/77dcbcf9.bbb-webpayments.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/bbb-webpayments.png" alt="" width="599" height="448" /><p class="wp-caption-text">Image: Better Business Bureau.</p></div>
<p>A <a href="https://www.twitter.com/weblistingsinc" target="_blank" rel="noopener">Twitter account for Web Listings Inc.</a> has posts dating back to 2010, and points to even more Web Listings domains, including <strong>weblistingsinc.org</strong>. <a href="https://web.archive.org/web/20110518155957/http://www.weblistingsinc.org/" target="_blank" rel="noopener">Cached versions of weblistingsinc.org at <strong>archive.org</strong></a> show logos similar to the one featured on the Web Listings mailer, and early versions of the site reference a number of &#8220;business partners&#8221; in India that also perform SEO services.</p>
<p>Searching the Internet for some of these Web listing domains mentioned in the company&#8217;s Twitter account brings up a series of press releases once issued on behalf of the company. One from May 2011 <a href="https://onlineprnews.com/news/142748-1306493005-web-listings-inc-new-promotion-services-will-bring-dramatic-change-to-small-businesses.html/" target="_blank" rel="noopener">at onlineprnews.com</a> sings the praises of <strong>Weblistingsinc.info</strong>, weblistingsinc.org and web-listings.net in the same release, and lists the point of contact simply as &#8220;Mark.&#8221;</p>
<p>Historic WHOIS registration records from <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools</a> [an advertiser on this blog] say Weblistingsinc.org was registered in Nov. 2010 to a <a href="https://web.archive.org/web/20091228070928/http://www.blogger.com/profile/11526351081081042485" target="_blank" rel="noopener"><strong>Mark Scott </strong></a>in Blairgowrie, Scotland, using the email address <strong>clientnews@reputationmanagementfor.com</strong>.</p>
<p>Reputationmanagementfor.com bills itself as an online service for &#8220;fighting negative and incorrect content on the internet,&#8221; which is especially interesting for reasons that should become clearer in a few paragraphs. The site says Mark Scott, 46, is an employee of Reputationmanagementfor.com, and that he is also involved with two other companies:</p>
<p><strong>-GoBananas</strong>, a business that sets up group outings, with a focus on bachelor and bachelorette parties;</p>
<p><strong>-HelpMeGo.to</strong>, a entity in Scotland that did online marketing and travel tourism both in Scotland (via sites like Scotland.org.uk and marketinghotelsonline.co.uk) and on <a href="https://web.archive.org/web/20070223043952/http://www.karmakerala.com/" target="_blank" rel="noopener">India&#8217;s coastal Kerala state</a> where HelpMeGo.to employed a number of people involved in the SEO business. Helpmego.to now simply redirects to GoBananas.</p>
<p>According to <a href="https://www.farsightsecurity.com" target="_blank" rel="noopener">Farsight Security</a>, a company that keeps historic records of which Web sites were hosted at which Internet addresses, Weblistingsinc.org was for a while hosted at the IP address <strong>68.169.45.65</strong> with just six other domains, including <strong>travelingalberta.com</strong>, which was a blog about traveling and living in Alberta, Canada registered to Mark Scott and the email address <strong>management@helpmego.to</strong>. Cached versions of this site from 2011 <a href="https://web.archive.org/web/20110313111131/http://www.travellingalberta.com/reputation-management-the-need-for-your-business.html" target="_blank" rel="noopener">show it naming Web Listings Inc. as a business partner</a>.</p>
<p>That same management@helpmego.to email address is tied to the WHOIS records for <a href="https://web.archive.org/web/20100515231237/http://markscottblog.com/" target="_blank" rel="noopener">markscottblog.com</a>, gobananas.co.uk, gobananas.com. <a href="https://web.archive.org/web/20100515231237/http://markscottblog.com/" target="_blank" rel="noopener">Cached copies of markscottblog.com from 2010 at Archive.org</a> show his profile page on blogger.com links to another blog with much the same content, images and links called <a href="http://internetmadness.blogspot.com/" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=http://internetmadness.blogspot.com&amp;source=gmail&amp;ust=1584986329826000&amp;usg=AFQjCNEgodNAZlTbE1bO_vb4q7ytIiX98g">internetmadness.blogspot.com</a>.</p>
<p>Among the 2011 entries from the Internetmadness blog <a href="http://internetmadness.blogspot.com/search?updated-max=2011-11-10T08:15:00-08:00&amp;max-results=7&amp;reverse-paginate=true" target="_blank" rel="noopener">is a post promoting the wonders of benefits of Web Listings Inc.</a></p>
<div id="attachment_50994" style="width: 590px" class="wp-caption aligncenter"><img class=" wp-image-50994" src="media/d10a1eee.wl-internetmadness.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/wl-internetmadness.png" alt="" width="580" height="930" /><p class="wp-caption-text">A cached copy of Mark Scott&#8217;s blog Internet Madness from 2011 promotes Web Listings Inc.</p></div>
<p><span id="more-50984"></span></p>
<h4>THE COBRA/APPCO GROUP</h4>
<p>Aha! But wait, there&#8217;s more. You see, for years Weblistingsinc.org was hosted on the same servers along with a handful of other domains that all switched Internet addresses at the same times, including gobananas.com, gobananasworld.com and the IP addresses <strong>107.20.142.166</strong> (17 hosts), <strong>54.85.65.241</strong> (6 hosts).</p>
<p>Most of the other domains at these IPs historically have been tied to other domains connected to Mark Scott and his various companies and business partners, including <strong>chrisniarchos.net</strong>, <strong>redwoodsadvance.net</strong>, <strong>gdsinternationalus.com</strong>, <strong>staghensscotlands.com</strong>, <strong>cobra-group.blogspot.com</strong>, <strong>the-cobra-group.com</strong>, <strong>appcogroup.co.uk</strong>, and <strong>reputationmanagementfor.com</strong>.</p>
<p>I found a similar pattern with domains stemming from a <a href="https://www.crunchbase.com/organization/web-technologies-inc" target="_blank" rel="noopener">Crunchbase company profile on Web Listings Inc.</a>, which says the firm is based in Toronto, Canada, with the Web site <strong>webtechnologiesinc.net</strong>, and email address <strong>webtechnologiesletter@gmail.com</strong>. Historic WHOIS data from Domaintools.com says Webtechnologiesinc.net was registered in 2013 to a <strong>Marcus Ruskov</strong> in Toronto.</p>
<p>Information about who registered Webtechnologiesletter.com is completely hidden behind privacy protection services. But Farsight says the domain was in 2015 hosted at the Internet address <strong>54.77.128.87</strong>, along with just 70 other domains, including the same list of domains mentioned above, chrisniarchos.net, redwoodsadvance.net, gdsinternationalus.com, et cetera.</p>
<p>What do all of these domains have in common? They are tied to companies for which Mark Scott was listed as a key contact. For example, <a href="https://www.journalism.co.uk/press-releases/appco-group-uk-launches-new-website/s66/a543432/" target="_blank" rel="noopener">this press release from 2o11</a> says Mark Scott is the contact person for a company called <a href="https://twitter.com/hashtag/appco?f=live" target="_blank" rel="noopener"><strong>Appco Group UK</strong></a> which bills itself as a market leader in face-to-face marketing and sales.</p>
<p>&#8220;Worldwide, Appco Group has raised hundreds of millions of pounds for some of the world&#8217;s biggest charities, delivered pay-TV and broadband services, financial services, security and many other successful marketing solutions on a diverse range of products,&#8221; the press release enthuses.</p>
<p>The Appco Group is the re-branded name of a family of marketing and sales companies originally created under the name <strong>The Cobra Group</strong>, <a href="https://en.wikipedia.org/wiki/The_Cobra_Group" target="_blank" rel="noopener">whose Wikipedia page</a> states that it is a door-to-door selling and marketing company headquartered in Hong Kong. It says investigations by the media have found the company promises much larger compensation rates that employees actually receive.</p>
<p>&#8220;It is also criticized for being a cult, a scam and a pyramid scheme,&#8221; the entry reads.</p>
<p>The Cobra Group and its multifariously named direct sales and marketing companies are probably best described as &#8220;multi-level marketing&#8221; schemes; that is, entities which often sell products and/or services of dubious quality, use high-pressure sales tactics and misleading if not deceptive advertising practices, and offer little to no employee payment for anything other than direct sales.</p>
<p>Even the most cursory amount of time spent searching the Internet for information on some of the companies named above (<a href="https://www.glassdoor.com/Reviews/Appco-Group-door-to-door-Reviews-EI_IE407500.0,11_KH12,24.htm" target="_blank" rel="noopener">Appco Group</a>, <a href="https://www.mirror.co.uk/opinion/money-opinion/p-s-investigates/just-6-for-eight-days-cobra-533256" target="_blank" rel="noopener">Cobra Group</a>, <a href="https://shoutforsteph.livejournal.com/106516.html" target="_blank" rel="noopener">Redwoods Advance</a>, <a href="https://www.beingpeterkim.com/2018/01/the-gds-group-cmo-digital-insight-summit-sales-pitch-is-a-lie.html" target="_blank" rel="noopener">GDS International</a>) reveals a mountain of bad press and horrible stories from former employees.</p>
<p>For example, Appco salespeople became known as &#8220;<a href="https://www.abc.net.au/news/2018-05-18/charity-muggers-win-round-one-in-appco-class-action/9777046" target="_blank" rel="noopener">charity muggers</a>&#8221; because they were trained to solicit donations on behalf of charities from random people on the street, and <em>because media outlets later discovered that the people running Appco <a href="https://www.theguardian.com/society/2014/jun/19/global-fundraising-company-keeps-96-of-122m-raised-for-special-olympics" target="_blank" rel="noopener">kept the majority of the millions of dollars they raised for the charities</a></em>.</p>
<p><a href="https://doortodoortruth.wordpress.com/background/" target="_blank" rel="noopener">This exhaustive breakdown on the door-to-door sales industry</a> traces Cobra and Appco Group back to a long line of companies that simply renamed and rebranded each time a scandal inevitably befell them.</p>
<p>Now it makes sense why Web Listings Inc. had so many confusingly-named domain names. And this might also explain the primary role of Mr. Scott&#8217;s business &#8212; the online reputation management company reputationmanagementfor.com &#8212; in relation to the Cobra Group/Appco&#8217;s efforts to burnish its reputation online.</p>
<div id="attachment_51019" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/89c79526.weblistingsmm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/weblistingsmm.png"><img class="wp-image-51019" src="media/89c79526.weblistingsmm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/weblistingsmm.png" alt="" width="598" height="289" /></a><p class="wp-caption-text">A partial screenshot of a mind map I used to keep track of the myriad connections between various Web Listings domains and their owners. This map was created with MindNode Pro for Mac.</p></div>
<p>Mark Scott did not respond to multiple requests for comment sent to various email addresses and phone numbers tied to his name. However, KrebsOnSecurity did receive a response from <a href="https://web.archive.org/web/20111028094605/http://www.chrisniarchos.net/" target="_blank" rel="noopener">Cobra Group founder Chris Niarchos</a>, a Toronto native who said this was the first he&#8217;d heard of the Web Listings scam.</p>
<p>&#8220;Mark used to provide some services to us but my understanding was that stopped a long time ago,&#8221; Niarchos said. &#8220;He used to own a marketing company that we supplied but that contract ended maybe 12 years ago. That’s how we met. After that he did start some internet based businesses where he sold services to us as a customer at arms length. That also stopped many years ago again as we did it all in house. As far as I know he did this for many companies and we were simply a customer of his. In my dealings with him we got what we paid for but never did we have any closer relationship than that.&#8221;</p>
<h4>USA CONNECTIONS</h4>
<p>Two more small &#8212; possibly insignificant &#8212; but interesting things. First, if we go back and look at archived posts from markscottblog.com in 2010, we can see a number of entries where he defends the honor of Cobra Group, Appco, and other multi-level marketing programs he supports, saying they&#8217;re not scams. If we go back further to 2008 and look at <a href="https://web.archive.org/web/20080228113920/http://www.blogger.com:80/profile/11526351081081042485" target="_blank" rel="noopener">Mark Scott&#8217;s profile on Blogger.com</a>, we can see at the bottom of the page <a href="https://web.archive.org/web/20080303111523/http://holiday-cottages.scotland.org.uk/self-catering-bogus-emails.htm" target="_blank" rel="noopener">a link called &#8220;Enquiries and Emails</a>.&#8221;</p>
<p>Visiting that link brings up what looks like a public shaming page of emails apparently sent to Mr. Scott from scammers trying to set him up for some kind of fake check scheme in connection with renting one of the U.K. properties listed by his various travel accommodations Web sites. Click the <a href="https://web.archive.org/web/20080304050509/http://www.scotland.org.uk/contactus/" target="_blank" rel="noopener">&#8220;Contact&#8221; tab</a> at the top right of that page and you&#8217;ll see Travel Scotland has a U.S. phone number that potential customers here in the states can use to make reservations toll-free.</p>
<p>That number happens to be in Connecticut. Recall that the address listed in the ownership records for many of the Web Listings domains tied to the &#8220;James Madison/Mark Carter&#8221; identities were for an address in Connecticut.</p>
<p>Finally, I wanted to mention something that has stumped me (until very recently) since I began this investigation a couple of years ago. There are two unexpected domains returned when one performs a reverse search on a couple of different persistent data points in the WHOIS registration records for the Web Listings domains. See if you can spot the odd duck in this list produced by running a reverse search at Domaintools on info@web-listings.net (the contact email address shown on the mailed letter above):</p>
<p><strong>Domain Name </strong> <strong>Create Date</strong> <strong>Registrar</strong><br />
finzthegoose.com 2010-08-03 enom, inc.<br />
web-listings.net 2007-04-24 ENOM, INC.,ENOM, LLC<br />
web-listingsinc.com 2015-11-06 ENOM, INC.,ENOM, LLC<br />
weblistingservices.com 2007-04-23 ENOM, INC.,ENOM, LLC<br />
weblistingsinc.com 2014-06-21 GODADDY.COM, LLC<br />
weblistingsinc.net 2016-02-09 ENOM, INC.,ENOM, LLC<br />
weblistingsreports.net 2015-11-06 ENOM, INC.,ENOM, LLC<br />
webservicescorp.net 2007-06-03 ENOM, INC.,ENOM, LLC<br />
websiteservicescorp.com 2007-06-03 &#8212;</p>
<p>Ten points if you said &#8220;finzthegoose.com.&#8221; Now let&#8217;s run a search on the phone number for Mark Carter &#8212; the phony persona behind all the Web Listings domains registered to the Niagara Falls address &#8212; +1.716-285-3575. What stands out about this list?</p>
<p><strong>Domain Name Create Date Registrar</strong><br />
aquariumofniagara.org 2001-01-11 GODADDY.COM, LLC<br />
web-listings.net 2007-04-24 ENOM, INC.,ENOM, LLC<br />
web-listingsinc.com 2015-11-06 ENOM, INC.,ENOM, LLC<br />
weblistingservices.com 2007-04-23 ENOM, INC.,ENOM, LLC<br />
weblistingsinc.com 2014-06-21 GODADDY.COM, LLC<br />
weblistingsinc.net 2016-02-09 ENOM, INC.,ENOM, LLC<br />
weblistingsreports.net 2015-11-06 ENOM, INC.,ENOM, LLC<br />
webservicescorp.net 2007-06-03 ENOM, INC.,ENOM, LLC<br />
websiteservicescorp.com 2007-06-03 &#8212;</p>
<p>If you&#8217;re picking up an aquatic and marine life theme here, you&#8217;re two for two. That is actually the real phone number for the Aquarium of Niagara; the Web-Listings people just for some reason decided to list it in their WHOIS records as theirs.</p>
<p>It appears that a Scotsman named <strong>Robert Paul Graham Scott</strong> &#8212; perhaps Mark&#8217;s older brother &#8212; was in the same line of work (SEO and advertising) and pimping the exact same companies as Mark. According to <a href="https://beta.companieshouse.gov.uk/company/SC418164/officers" target="_blank" rel="noopener">a listing at Companies House</a>, the official ledger of corporations in the United Kingdom, Paul Scott was for four years until Sept. 2019 a director in <strong>HMGT Services Ltd.</strong> (HMGT stands for the aforementioned HelpMeGo.To business).</p>
<p>Paul Scott&#8217;s own Internet presence says he lives in Perth &#8212; a short distance from Mark&#8217;s hometown in Blairgowrie, Scotland. Like Mark, Paul Scott did not respond to requests for comment. But Paul Scott&#8217;s Twitter profile &#8212; <a href="https://twitter.com/scubadog_uk" target="_blank" rel="noopener">@scubadog_uk</a> &#8212; shows him tweeting out messages supporting many of the same companies and causes as Mark over the past decade.</p>
<p>More to the point, Paul&#8217;s Website &#8212; <a href="https://web.archive.org/web/20070222164302/http://www.scubadog.co.uk/" target="_blank" rel="noopener">scubadog.co.uk</a> &#8212; says he has an abiding interest in underwater photography, scuba diving, and all things marine-related.</p>


feed_id: https://krebsonsecurity.com/?p=51035
title: US Government Sites Give Bad Security Advice
uri: US-Government-Sites-Give-Bad-Security-Advice
url: https://krebsonsecurity.com/2020/03/us-government-sites-give-bad-security-advice/
content:
<p>Many U.S. government Web sites now carry a message prominently at the top of their home pages meant to help visitors better distinguish between official U.S. government properties and phishing pages. Unfortunately, part of that message is misleading and may help perpetuate a popular misunderstanding about Web site security and trust that phishers have been exploiting for years now.</p>
<p>For example, the official <strong>U.S. Census Bureau</strong> website <a href="https://my2020census.gov" target="_blank" rel="noopener">https://my2020census.gov</a> carries a message that reads, &#8220;An official Web site of the United States government. Here&#8217;s how you know.&#8221; Clicking the last part of that statement brings up a panel with the following information:</p>
<div id="attachment_51037" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/ca18af9e.2020census.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/2020census.png"><img class="wp-image-51037" src="media/ca18af9e.2020census.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/2020census.png" alt="" width="597" height="105" /></a><p class="wp-caption-text">A message displayed at the top of many U.S. .gov Web sites.</p></div>
<p>The text I have a beef with is the bit on the right, beneath the &#8220;This site is secure&#8221; statement. Specifically, it says, &#8220;The https:// ensures that you are connecting to the official website&#8230;.&#8221;</p>
<p>Here&#8217;s the deal: The https:// part of an address (also called “Secure Sockets Layer” or SSL) merely signifies the data being transmitted back and forth between your browser and the site is encrypted and cannot be read by third parties.</p>
<p>However, the presence of &#8220;https://&#8221; or a padlock in the browser address bar <em>does not mean the site is legitimate</em>, nor is it any proof the site has been security-hardened against intrusion from hackers.</p>
<p>In other words, while readers should never transmit sensitive information to a site that does not use https://, the presence of this security feature tells you nothing about the <em>trustworthiness</em> of the site in question.</p>
<p>Here&#8217;s a sobering statistic: According to <strong>PhishLabs</strong>, <em>by the end of 2019 roughly three-quarters (74 percent) of all phishing sites were using SSL certificates</em>. PhishLabs <a href="https://info.phishlabs.com/blog/top-phishing-trends-2019" target="_blank" rel="noopener">found</a> this percentage increased from 68% in Q3 and 54% in Q2 of 2019.<span id="more-51035"></span></p>
<p>&#8220;Attackers are using free certificates on phishing sites that they create, and are abusing the encryption already installed on hacked web sites,&#8221; PhishLabs founder and CTO <strong>John LaCour</strong> said.</p>
<div id="attachment_51040" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/9e1fed54.phishhttpspercent.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/phishhttpspercent.png"><img class="wp-image-51040" src="media/9e1fed54.phishhttpspercent.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/phishhttpspercent.png" alt="" width="597" height="453" /></a><p class="wp-caption-text">Image: PhishLabs.com</p></div>
<p>The truth is anyone can get an SSL certificate for free, and that&#8217;s a big reason why most phishing sites now have them. The other reason is that they help phishers better disguise their sites as legitimate, since many Web browsers now throw up security warnings on non-https:// sites.</p>
<p>KrebsOnSecurity couldn&#8217;t find any reliable information on how difficult it may be to obtain an SSL certificate for a .gov site once one has a .gov domain, but it is apparently <a href="https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-a-gov-domain-name/" target="_blank" rel="noopener">not difficult for just about anyone to get their very own .gov domain name</a>.</p>
<p>The <strong>U.S. General Services Administration </strong>(GSA), which oversees the issuance of .gov domains, recently made it a tiny bit more difficult to do so &#8212; by requiring all applications be notarized &#8212; but this seems <a href="https://krebsonsecurity.com/2020/03/u-s-govt-makes-it-harder-to-get-gov-domains/" target="_blank" rel="noopener">a small hurdle for scam artists to clear</a>.</p>
<p>Regardless, it seems the federal government is doing consumers a disservice with this messaging, by perpetuating the myth that the presence of &#8220;https://&#8221; in a link denotes any kind of legitimacy.</p>
<p>&#8220;&#8216;Https&#8217; does not mean that you are at the correct website or that the site is secure,&#8221; LaCour said. &#8220;It only indicates that the connection is encrypted. The server could still be misconfigured or have software vulnerabilities. It is good that they mention to look for ‘.gov’. There’s no guarantee that a .gov website is secure, but it should help ensure that visitors are on the right website.&#8221;</p>
<p>I should note that this misleading message seems to be present only on some federal government Web sites. For instance, while the sites for <a href="https://www.gsa.gov/" target="_blank" rel="noopener">the GSA</a>, the <a href="https://www.dol.gov/" target="_blank" rel="noopener">Department of Labor</a>, <a href="https://www.transportation.gov/" target="_blank" rel="noopener">Department of Transportation</a>, and <a href="https://www.va.gov/" target="_blank" rel="noopener">Department of Veterans Affairs</a> all include the same wording, those for the <a href="https://www.commerce.gov/" target="_blank" rel="noopener">Commerce Department</a> and <a href="https://www.justice.gov/" target="_blank" rel="noopener">Justice Department</a> are devoid of the misleading text, stating:</p>
<p>&#8220;This site is also protected by an SSL (Secure Sockets Layer) certificate that’s been signed by the U.S. government. The https:// means all transmitted data is encrypted — in other words, any information or browsing history that you provide is transmitted securely.&#8221;</p>
<p>Other federal sites &#8212; like <strong>dhs.gov</strong>, <strong>irs.gov</strong> and <strong>epa.gov</strong> &#8212; simply have the &#8220;An official website of the United States government&#8221; declaration at the top, without offering any tips about how to feel better about that statement.</p>


feed_id: https://krebsonsecurity.com/?p=51069
title: Russians Shut Down Huge Card Fraud Ring
uri: Russians-Shut-Down-Huge-Card-Fraud-Ring
url: https://krebsonsecurity.com/2020/03/russians-shut-down-huge-card-fraud-ring/
content:
<p>Federal investigators in Russia have charged at least 25 people accused of operating a sprawling international credit card theft ring. Cybersecurity experts say the raid included the charging of a major carding kingpin thought to be tied to dozens of carding shops and to some of the bigger data breaches targeting western retailers over the past decade.</p>
<p>In <a href="http://www.fsb.ru/fsb/press/message/single.htm%21id%3D10438549%40fsbMessage.html" target="_blank" rel="noopener">a statement</a> released this week, the Russian <strong>Federal Security Service</strong> (FSB) said 25 individuals were charged with circulating illegal means of payment in connection with some 90 websites that sold stolen credit card data.</p>
<div id="attachment_51071" style="width: 602px" class="wp-caption aligncenter"><img class="size-full wp-image-51071" src="media/02817946.fsb2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/fsb2.png" alt="" width="592" height="332" /><p class="wp-caption-text">A still image from a video of the raids released by the Russian FSB this week shows stacks of hundred dollar bills and cash counting machines seized at a residence of one of the accused.</p></div>
<p>The FSB has not released a list of those apprehended, but the agency&#8217;s statement came several days after details of the raids were first leaked on the LiveJournal blog of cybersecurity blogger <a href="https://sporaw.livejournal.com/678535.html" target="_blank" rel="noopener">Andrey Sporov</a>. The post claimed that among those apprehended was the infamous cybercriminal <strong>Alexey Stroganov, </strong>who goes by the hacker names &#8220;Flint&#8221; and &#8220;Flint24.&#8221;</p>
<p>According to cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, Stroganov has been a long-standing member of major underground forums since at least 2001. In 2006, Stroganov and an associate <strong>Gerasim Silivanon</strong> (a.k.a. &#8220;<strong>Gabrik</strong>&#8220;) were sentenced to six years of confinement in Russia, but were set free just two years into their sentence. Intel 471 says <a href="https://mos-gorsud.ru/rs/tverskoj/services/cases/criminal-materials/details/e050d0a9-8799-42ff-b914-c40178abfd65" target="_blank" rel="noopener">Selivanon also was charged</a> <a href="https://mos-gorsud.ru/rs/tverskoj/services/cases/criminal-materials/details/b10673db-5554-458d-8e29-0958e9002b0e" target="_blank" rel="noopener">along with Stroganov</a> in this past week&#8217;s law enforcement action.</p>
<p>&#8220;Our continuous monitoring of underground activity revealed despite the conviction, Flint24 never left the cybercrime scene,&#8221; reads an analysis penned by Intel 471.</p>
<p>&#8220;You can draw your own conclusions [about why he was released early],&#8221; Sporaw wrote, suggesting that perhaps the accused bribed someone to get out of jail before his sentence was up.</p>
<p>Flint is among the biggest players in the crowded underground market for stolen credit card data, according to a U.S. law enforcement source who asked to remain anonymous because he was not authorized to speak to the media. The source described Flint&#8217;s role as that of a wholesaler of credit card data stolen in some of the biggest breaches at major Western retailers.</p>
<p>&#8220;He moved hundreds of millions of dollars through BTC-e,&#8221; the source said, referring to a cryptocurrency exchange that was <a href="https://en.wikipedia.org/wiki/BTC-e" target="_blank" rel="noopener">seized by U.S. authorities in 2017</a>. &#8220;<span class="pullquote pqleft">Flint had a piece of almost every major hack because in many cases it was his guys doing it.</span> Whether or not his marketplaces sold it, his crew had a role in a lot of the big breaches over the last ten years.&#8221;</p>
<p>Intel 471&#8217;s analysis seemed to support that conclusion, noting that Flint worked closely with other major carding shops that were not his, and that he associated with a number of cybercrooks who regularly bought stolen credit cards in batches of 100,000 pieces at once.</p>
<p>Top denizens of several cybercrime forums who&#8217;ve been tracking the raids posited that Stroganov and others were busted because they had a habit of violating the golden rule for criminal hackers residing in Russia or in a former Soviet country: Don&#8217;t target your own country&#8217;s people and/or banks.<span id="more-51069"></span></p>
<p>A longtime moderator of perhaps the cybercrime underground&#8217;s most venerated Russian hacking forum posted a list of more than 40 carding sites thought to be tied to the group&#8217;s operations that are no longer online. Among them is <strong>MrWhite[.]biz</strong>, a carding site whose <a href="https://krebsonsecurity.com/2019/07/party-like-a-russian-carders-edition/" target="_blank" rel="noopener">slick video ads were profiled in a KrebsOnSecurity post last year</a>.</p>
<div id="attachment_51073" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-51073" src="media/e0a4271c.plar.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/plar.png" alt="" width="594" height="286" /><p class="wp-caption-text">A snippet from a promotional video from the carding/dumps shop MrWhite.</p></div>
<h4>KNOW YOUR FRAUDSTER</h4>
<p>Nearly all of the carding sites allegedly tied to this law enforcement action &#8212; including those with such catchy names as <strong>BingoDumps</strong>, <strong>DumpsKindgom</strong>, <strong>GoldenDumps</strong>, <strong>HoneyMoney</strong> and <strong>HustleBank</strong> &#8212; were united by a common innovation designed to win loyalty among cybercriminals who buy stolen cards or &#8220;dumps&#8221; in bulk: Namely, a system that allowed buyers to get instant refunds on &#8220;bad&#8221; stolen cards without having to first prove that the cards were canceled by the issuing bank before they could be used for fraud.</p>
<p>Most carding sites will offer customers a form of buyer&#8217;s insurance known as a &#8220;checker,&#8221; which is an automated, à la carte service customers can use after purchasing cards to validate whether the cards they just bought are still active.</p>
<p>These checking services are tied to “moneyback” guarantees that will automatically refund the purchase price for any cards found to be invalid shortly after the cards are bought (usually a window of a few minutes up to a few hours), provided the buyer agrees to pay an added fee of a few cents per card to use the shop’s own checking service.</p>
<p>But many cybercrooks have long suspected some checkers at the more popular carding sites routinely give inaccurate results that favor the card shop (i.e., intentionally flagging some percentage of inactive cards as valid). So, the innovation that Flint&#8217;s gang came up with was a policy called &#8220;Trust Your Client&#8221; or &#8220;TYC,&#8221; which appears to be a sly dig on the <a href="https://corpgov.law.harvard.edu/2016/02/07/fincen-know-your-customer-requirements/" target="_blank" rel="noopener">banking industry&#8217;s &#8220;know your customer&#8221; or KYC rules to help fight fraud and money laundering</a>.</p>
<p>With TYC, if a customer claimed a card they bought was declined for fraudulent transaction attempts made within six hours of purchase, the carding shop would refund the price of that card &#8212; no questions asked. However, it seems likely these shops that observed TYC ran their own checkers on the back-end to protect themselves against dishonest customers.</p>
<div id="attachment_51074" style="width: 602px" class="wp-caption aligncenter"><img class=" wp-image-51074" src="media/82459c87.trustyourclient.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/trustyourclient.png" alt="" width="592" height="585" /><p class="wp-caption-text">An ad for the &#8220;Trust Your Client&#8221; or TYC policy observed by virtually all of the carding shops taken down in this past week&#8217;s Russian law enforcement operation.</p></div>
<p>Want to learn more about how carding shops work and all the lingo that comes with them? Check out my behind-the-scenes profile of one major fraud store &#8212; <a href="https://krebsonsecurity.com/2014/06/peek-inside-a-professional-carding-shop/" target="_blank" rel="noopener">Peek Inside a Professional Carding Shop</a>.</p>


feed_id: https://krebsonsecurity.com/?p=51101
title: Annual Protest to ‘Fight Krebs’ Raises €150K+
uri: Annual-Protest-to-Fight-Krebs-Raises-150K
url: https://krebsonsecurity.com/2020/03/annual-protest-to-fight-krebs-raises-e150k/
content:
<p>In 2018, KrebsOnSecurity unmasked the creators of <strong>Coinhive</strong> &#8212; a now-defunct cryptocurrency mining service that was being massively abused by cybercriminals &#8212; as the administrators of a popular German language image-hosting forum. In protest of that story, forum members donated hundreds of thousands of euros to nonprofits that combat cancer (Krebs means &#8220;cancer&#8221; in German). This week, the forum is celebrating its third annual observance of that protest to &#8220;fight Krebs,&#8221; albeit with a Coronavirus twist.</p>
<div id="attachment_51103" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/a119d54b.krebsaktion3.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/krebsaktion3.png"><img class="wp-image-51103" src="media/a119d54b.krebsaktion3.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/krebsaktion3.png" alt="" width="597" height="443" /></a><p class="wp-caption-text">Images posted to the decidedly not-safe-for-work German-language image forum pr0gramm[.]com. Members have posted a large number of &#8216;thank you&#8217; receipts from cancer research organizations that benefited from their fight cancer/krebs campaign.</p></div>
<p>On March 26, 2018, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2018/03/who-and-what-is-coinhive/" target="_blank" rel="noopener">Who and What is Coinhive</a>, which showed the founder of Coinhive was the co-creator of the German forum <strong>pr0gramm[dot]com</strong> (not safe for work).  I undertook the research because Coinhive’s code at the time was found on tens of thousands of hacked Web sites, and Coinhive seemed uninterested in curbing widespread abuse of its platform.</p>
<p>Pr0gramm’s top members accused KrebsOnSecurity of violating their privacy, even though all of the research published about them was publicly available online. In protest, the forum’s leaders urged members to donate money to medical research in a bid to find a cure for Krebs (i.e. “cancer”). <a href="https://krebsonsecurity.com/2018/03/coinhive-expose-prompts-cancer-research-fundraiser/" target="_blank" rel="noopener">They ended up raising more than a quarter-million dollars worth of donations from members</a>.</p>
<p>Last year&#8217;s commemoration of the protest fundraiser &#8212; dubbed &#8220;<strong>Krebsaction</strong>&#8221; by Pr0gramm &#8212; raised almost $300,000 for anti-cancer research groups. Interestingly, <a href="https://krebsonsecurity.com/2019/02/crytpo-mining-service-coinhive-to-call-it-quits/" target="_blank" rel="noopener">Coinhive announced it was shutting down</a> around the same time as that second annual fundraiser.</p>
<p>This year&#8217;s Krebsaction started roughly three days ago and so far has raised more than 150,000 euros (~$165,000), with many Pr0gramm members posting screenshots of their online donations. The primary beneficiary appears to be <a href="https://en.wikipedia.org/wiki/DKMS" target="_blank" rel="noopener">DKMS</a>, a German nonprofit that works to combat various blood cancers, such as leukemia and lymphoma.</p>
<div id="attachment_51104" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/abd350c6.ka2020.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/ka2020.png"><img class="wp-image-51104" src="media/abd350c6.ka2020.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/ka2020.png" alt="" width="597" height="413" /></a><p class="wp-caption-text">The pr0gramm post kicking off this year&#8217;s &#8220;Krebsaction&#8221; fundraiser.</p></div>
<p>This year, however, Pr0gramm&#8217;s administrators exhorted forum members to go beyond just merely donating money to a worthy cause, and encouraged them to do something to help those most affected by the COVID-19/Coronavirus pandemic.</p>
<p>&#8220;This year <span class="il">pr0gramm</span>-members shall not only donate but do a good act in terms of corona (and prove it), for example bring food to old people, bring proof of volunteering and such stuff,&#8221; reads the Pr0gramm image kicking off this year&#8217;s Krebsaction.  The message further states, &#8220;Posts mit geringem Einsatz können wir nicht akzeptieren,&#8221; which translates roughly to &#8220;Posts with little effort we cannot accept.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=51125
title: Phish of GoDaddy Employee Jeopardized Escrow.com, Among Others
uri: Phish-of-GoDaddy-Employee-Jeopardized-Escrow-com-Among-Others
url: https://krebsonsecurity.com/2020/03/phish-of-godaddy-employee-jeopardized-escrow-com-among-others/
content:
<p>A spear-phishing attack this week hooked a customer service employee at <strong>GoDaddy.com</strong>, the world&#8217;s largest domain name registrar, KrebsOnSecurity has learned. The incident gave the phisher the ability to view and modify key customer records, access that was used to change domain settings for a half-dozen GoDaddy customers, including transaction brokering site <strong>escrow.com</strong>.</p>
<p><a href="https://www.escrow.com" target="_blank" rel="noopener">Escrow.com</a> helps people safely broker all sorts of transactions online (ironically enough, brokering domain sales is a big part of its business). For about two hours starting around 5 p.m. PT Monday evening, Escrow.com&#8217;s website looked radically different: Its homepage was replaced with a crude message in plain text:</p>
<div id="attachment_51127" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/cb8b9006.escrowmsg-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/escrowmsg-red.png"><img class="wp-image-51127" src="media/cb8b9006.escrowmsg-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/escrowmsg-red.png" alt="" width="599" height="62" /></a><p class="wp-caption-text">The profanity-laced message left behind by whoever briefly hijacked the DNS records for escrow.com. Image: Escrow.com</p></div>
<p>DomainInvesting.com&#8217;s <strong>Elliot Silver</strong> <a href="https://domaininvesting.com/escrow-com-statement-on-security-incident/" target="_blank" rel="noopener">picked up on the change</a> and got a statement from <strong>Matt Barrie</strong>, the CEO of <strong>freelancer.com</strong>, which owns escrow.com.</p>
<p>&#8220;During the incident, the hackers changed the DNS records for Escrow.com to point to to a third party web server,&#8221; <a href="https://www.escrow.com/updates/incident20200331" target="_blank" rel="noopener">Barre wrote</a>, noting that his security team managed to talk to the hacker responsible for the hijack via telephone.</p>
<p>Barrie said escrow.com would be sharing more details about the incident in the coming days, but he emphasized that no escrow.com systems were compromised, and no customer data, funds or domains were compromised.</p>
<p>KrebsOnSecurity reached out to Barrie and escrow.com with some follow-up questions, and immediately after that pinged <strong>Chris Ueland</strong>, CEO of <a href="https://securitytrails.com/" target="_blank" rel="noopener">SecurityTrails</a>, a company that helps customers keep track of their digital assets.</p>
<p>Ueland said after hearing about the escrow.com hack Monday evening he pulled the domain name system (DNS) records for escrow.com and saw they were pointing to an Internet address in Malaysia &#8212; <strong>111.90.149[.]49 </strong>(that domain is hobbled here because it is currently flagged as hosting a phishing site). The attacker also <a href="https://crt.sh/?q=escrow.com" target="_blank" rel="noopener">obtained free encryption certificates for escrow.com</a> from <a href="https://letsencrypt.org/" target="_blank" rel="noopener">Let&#8217;s Encrypt</a>.</p>
<p>Running a reverse DNS lookup on this 111.90.149[.]49 address shows it is tied to fewer than a dozen domains, including a 12-day-old domain that invokes the name of escrow.com&#8217;s registrar &#8212; <strong>servicenow-godaddy[.]com</strong>. Sure enough, loading that domain in a browser reveals the same text that appeared Monday night on escrow.com, minus the redaction above.</p>
<div id="attachment_51132" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/76c1521f.servicenowgodaddy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/servicenowgodaddy.png"><img class="wp-image-51132" src="media/76c1521f.servicenowgodaddy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/servicenowgodaddy.png" alt="" width="594" height="42" /></a><p class="wp-caption-text">The message at servicenow-godaddy[.]com was identical to the one displayed by escrow.com while the site&#8217;s DNS records were hacked.</p></div>
<p>It was starting to look like someone had gotten phished. Then I heard back from Matt Barrie, who said it wasn&#8217;t anyone at escrow.com that got phished. Barrie said the hacker was able to read messages and notes left on escrow.com&#8217;s account at GoDaddy that only GoDaddy employees should have been able to see.</p>
<p>Barrie said one of those notes stated that certain key changes for escrow.com could only be made after calling a specific phone number and receiving verbal authorization. As it happened, the attacker went ahead and called that number, evidently assuming he was calling someone at GoDaddy.</p>
<p>In fact, the name and number belonged to escrow.com&#8217;s general manager, who played along for more than an hour talking to the attacker while recording the call and coaxing information out of him.</p>
<p>&#8220;This guy had access to the notes, and knew the number to call,&#8221; to make changes to the account, Barrie said. &#8220;He was literally reading off the tickets to the notes of the admin panel inside GoDaddy.&#8221;</p>
<div id="attachment_51134" style="width: 609px" class="wp-caption aligncenter"><img class=" wp-image-51134" src="media/8e3c648f.ps-escrow.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/03/ps-escrow.png" alt="" width="599" height="401" /><p class="wp-caption-text">A WHOIS lookup on escrow.com Monday evening via the Windows PowerShell built into Windows 10. Image: SecurityTrails</p></div>
<p>In a statement shared with KrebsOnSecurity, GoDaddy acknowledged that on March 30 the company was alerted to a security incident involving a customer&#8217;s domain name. An investigation revealed a GoDaddy employee had fallen victim to a spear-phishing attack, and that five other customer accounts were &#8220;potentially&#8221; affected &#8212; although GoDaddy wouldn&#8217;t say which or how many domains those customer accounts may have with GoDaddy.<span id="more-51125"></span></p>
<p>&#8220;Our team investigated and found an internal employee account triggered the change,&#8221; the statement reads. &#8220;We conducted a thorough audit on that employee account and confirmed there were five other customer accounts potentially impacted.&#8221;</p>
<p>The statement continues:</p>
<p>&#8220;We immediately locked down the impacted accounts involved in this incident to prevent further changes. Any actions done by the threat actor have been reverted and the impacted customers have been notified. The employee involved in this incident fell victim to a spear-fishing or social engineering attack. We have taken steps across our technology, processes and employee education, to help prevent these types of attacks in the future.&#8221;</p>
<p>There are many things domain owners can and should do to minimize the chances that domain thieves can wrest control over a business-critical domain, but much of that matters little if and when someone at your domain name registrar gets phished or hacked.</p>
<p>But increasingly, savvy attackers are focusing their attention on targeting people at domain registrars, and at their support personnel. In January, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/01/does-your-domain-have-a-registry-lock/" target="_blank" rel="noopener">told the harrowing story of e-hawk.net</a>, an online fraud prevention and scoring service that had its domain name fraudulently transferred to another provider after someone social engineered a customer service representative at e-hawk&#8217;s registrar.</p>
<p>Nation-state level attackers also are taking a similar approach. A <a href="https://krebsonsecurity.com/2019/02/a-deep-dive-on-the-recent-widespread-dns-hijacking-attacks/" target="_blank" rel="noopener">massive cyber espionage campaign</a> targeting a slew of domains for government agencies across the Middle East region between 2018 and 2019 was preceded by a series of targeted attacks on domain registrars and Internet infrastructure firms that served those countries.</p>
<p>While there is very little you can do to prevent your domain registrar from getting phished or tricked by scammers, there are several precautions that you can control. For maximum security on your domains, consider adopting some or all of the following best practices:</p>
<p>-Use 2-factor authentication, and require it to be used by all relevant users and subcontractors.</p>
<p>-In cases where passwords are used, pick unique passwords and consider password managers.</p>
<p>-Review the security of existing accounts with registrars and other providers, and make sure you have multiple notifications in place when and if a domain you own is about to expire.</p>
<p>-Use registration features like Registry Lock that can help protect domain name records from being changed. Note that this may increase the amount of time it takes going forward to make key changes to the locked domain (such as DNS changes).</p>
<p>-Use DNSSEC (both signing zones and validating responses).</p>
<p>-Use access control lists for applications, Internet traffic and monitoring.</p>
<p>-Monitor the issuance of new SSL certificates for your domains by monitoring, for example, <a href="https://www.certificate-transparency.org/how-ct-works" target="_blank" rel="noopener">Certificate Transparency Logs</a>.</p>


feed_id: https://krebsonsecurity.com/?p=51159
title: ‘War Dialing’ Tool Exposes Zoom’s Password Problems
uri: War-Dialing-Tool-Exposes-Zoom-s-Password-Problems
url: https://krebsonsecurity.com/2020/04/war-dialing-tool-exposes-zooms-password-problems/
content:
<p>As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from <strong>Zoom</strong>. But without the protection of a password, there&#8217;s a decent chance your next Zoom meeting could be &#8220;Zoom bombed&#8221; &#8212; attended or disrupted by someone who doesn&#8217;t belong. And according to data gathered by a new automated Zoom meeting discovery tool dubbed &#8220;<strong>zWarDial</strong>,&#8221; a crazy number of meetings at major corporations are not being protected by a password.</p>
<div id="attachment_51183" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/9dfe816b.zwardial-red1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/zwardial-red1.png"><img class="wp-image-51183" src="media/9dfe816b.zwardial-red1.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/zwardial-red1.png" alt="" width="598" height="569" /></a><p class="wp-caption-text">zWarDial, an automated tool for finding non-password protected Zoom meetings. According to its makers, zWarDial can find on average 110 meetings per hour, and has a success rate of around 14 percent.</p></div>
<p>Each Zoom conference call is assigned a Meeting ID that consists of 9 to 11 digits. Naturally, hackers have figured out they can simply guess or automate the guessing of random IDs within that space of digits.</p>
<p>Security experts at <strong>Check Point Research</strong> <a href="https://research.checkpoint.com/2020/zoom-zoom-we-are-watching-you/" target="_blank" rel="noopener">did exactly that last summer</a>, and found they were able to predict approximately four percent of randomly generated Meeting IDs. The Check Point researchers said enabling passwords on each meeting was the only thing that prevented them from randomly finding a meeting.</p>
<p>Zoom responded by saying it was enabling passwords by default in all future scheduled meetings. Zoom also said it would block repeated attempts to scan for meeting IDs, and that it would no longer automatically indicate if a meeting ID was valid or invalid.</p>
<p>Nevertheless, the incidence of <a href="https://techcrunch.com/2020/03/17/zoombombing/" target="_blank" rel="noopener">Zoombombing</a> has skyrocketed over the past few weeks, even prompting an alert by the FBI on how to secure meetings against eavesdroppers and mischief-makers. This suggests that many Zoom users have disabled passwords by default and/or that Zoom&#8217;s new security feature simply isn&#8217;t working as intended for all users.</p>
<p>New data and acknowledgments by Zoom itself suggest the latter may be more likely.</p>
<p>Earlier this week, KrebsOnSecurity heard from <a href="https://www.twitter.com/surbo" target="_blank" rel="noopener">Trent Lo</a>, a security professional and founder of <a href="https://www.seckc.org/" target="_blank" rel="noopener">SecKC</a>, Kansas City&#8217;s longest-running monthly security meetup. Lo and fellow SecKC members recently created <strong>zWarDial</strong>, which borrows part of its name from <a href="https://www.youtube.com/watch?v=zb1r_uKOew4" target="_blank" rel="noopener">the old phone-based war dialing programs</a> that called random or sequential numbers in a given telephone number prefix to search for computer modems.</p>
<p>Lo said zWarDial evades Zoom&#8217;s attempts to block automated meeting scans by routing the searches through multiple proxies in <a href="https://en.wikipedia.org/wiki/Tor_(anonymity_network)" target="_blank" rel="noopener">Tor</a>, a free and open-source software that lets users browse the Web anonymously.</p>
<p>&#8220;Zoom recently said they fixed this but I&#8217;m using a totally different URL and passing a cookie along with that URL,&#8221; Lo said, describing part of how his tool works on the back end. &#8220;This gives me the [Zoom meeting] room information without having to log in.&#8221;</p>
<p>Lo said a single instance of zWarDial can find approximately 100 meetings per hour, but that multiple instances of the tool running in parallel could probably discover most of the open Zoom meetings on any given day. Each instance, he said, has a success rate of approximately 14 percent, meaning for each random meeting number it tries, the program has a 14 percent chance of finding an open meeting.</p>
<p>Only meetings that are protected by a password are undetectable by zWarDial, Lo said.</p>
<p>&#8220;Having a password enabled on the meeting is the only thing that defeats it,&#8221; he said.</p>
<p>Lo shared the output of one day&#8217;s worth of zWarDial scanning, which revealed information about nearly 2,400 upcoming or recurring Zoom meetings. That information included the link needed to join each meeting; the date and time of the meeting; the name of the meeting organizer; and any information supplied by the meeting organizer about the topic of the meeting.</p>
<p>The results were staggering, and revealed details about Zoom meetings scheduled by some of the world&#8217;s largest companies, including major banks, international consulting firms, ride-hailing services, government contractors, and investment ratings firms.</p>
<p>KrebsOnSecurity is not naming the companies involved, but was able to verify dozens of them by matching the name of the meeting organizer with corporate profiles on LinkedIn.</p>
<p>By far the largest group of companies exposing their Zoom meetings are in the technology sector, and include a number of security and cloud technology vendors. These include at least one tech company that&#8217;s taken to social media warning people about the need to password protect Zoom meetings!</p>
<div id="attachment_51167" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/9b669ec8.zwardialmeetingsbyindustry.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/zwardialmeetingsbyindustry.png"><img class="wp-image-51167" src="media/9b669ec8.zwardialmeetingsbyindustry.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/zwardialmeetingsbyindustry.png" alt="" width="597" height="324" /></a><p class="wp-caption-text">The distribution of Zoom meetings found by zWarDial, indexed by industry. As depicted above, zWarDial found roughly 2,400 exposed meetings in less than 24 hours. Image: SecKC.</p></div>
<p><span id="more-51159"></span></p>
<h4>A GREMLIN IN THE DEFAULTS?</h4>
<p>Given the preponderance of Zoom meetings exposed by security and technology companies that ostensibly should know better, KrebsOnSecurity asked Zoom whether its approach of adding passwords by default to all new meetings was actually working as intended.</p>
<p>In reply, Zoom said it was investigating the possibility that its password-by-default approach may fail under certain circumstances.</p>
<p>&#8220;Zoom strongly encourages users to implement passwords for all of their meetings to ensure uninvited users are not able to join,&#8221; the company said in a written statement shared with this author.</p>
<p>&#8220;Passwords for new meetings have been enabled by default since late last year, unless account owners or admins opted out,&#8221; the statement continues. &#8220;We are looking into unique edge cases to determine whether, <span class="pullquote pqright">under certain circumstances, users unaffiliated with an account owner or administrator may not have had passwords switched on by default at the time that change was made.</span>&#8221;</p>
<p>The acknowledgment comes amid a series of security and privacy stumbles for Zoom, which has seen its user base grow exponentially in recent weeks. Zoom founder and chief executive <strong>Eric Yuan</strong> said in a recent blog post that the maximum number of daily meeting participants &#8212; both paid and free &#8212; has grown from around 10 million in December to 200 million in March.</p>
<p>That rapid growth has also brought additional scrutiny from security and privacy experts, who&#8217;ve found plenty of real and potential problems with the service of late. TechCrunch&#8217;s <strong>Zack Whittaker</strong> has a fairly comprehensive breakdown of them <a href="https://techcrunch.com/2020/03/31/zoom-at-your-own-risk/" target="_blank" rel="noopener">here</a>; not included in that list is <a href="https://techcrunch.com/2020/04/01/zoom-doom/" target="_blank" rel="noopener">a story he broke earlier this week</a> on a pair of zero-day vulnerabilities in Zoom that were publicly detailed by a former NSA expert.</p>
<p>Zoom CEO Yuan acknowledged that his company has struggled to keep up with steeply growing demand for its service and with the additional scrutiny that comes with it, saying in a blog post that for the next 90 days all new feature development was being frozen so the company&#8217;s engineers could focus on security issues.</p>
<p><strong>Dave Kennedy</strong>, a security expert and founder of the security consultancy <a href="https://www.trustedsec.com/" target="_blank" rel="noopener">TrustedSec</a>, penned a lengthy thread on Twitter saying while Zoom certainly has had its share of security and privacy goofs, some in the security community are unnecessarily exacerbating an already tough situation for Zoom and its tens of millions of users who rely on it for day-to-day meetings.</p>
<p>&#8220;What we have here is a company that is relatively easy to use for the masses (comes with its challenges on personal meeting IDs) and is relatively secure,&#8221; Kennedy <a href="https://twitter.com/HackingDave/status/1245536000819986432" target="_blank" rel="noopener">wrote</a>. &#8220;Yet the industry is making it out to be &#8216;this is malware&#8217; and you can&#8217;t use this. This is extreme. We need to look at the risk specific applications pose and help voice a message of how people can leverage technology and be safe. Dropping zero-days to the media hurts our credibility, sensationalizes fear, and hurts others.&#8221;</p>
<p>&#8220;If there are ways for a company to improve, we should notify them and if they don&#8217;t fix their issues, we should call them out,&#8221; he continued. &#8220;We should not be putting fear into everyone, and leveraging the media as a method to create that fear.&#8221;</p>
<p>Zoom&#8217;s advice on securing meetings is <a href="https://support.zoom.us/hc/en-us/articles/360033331271-Account-Setting-Update-Password-Default-for-Meeting-and-Webinar" target="_blank" rel="noopener">here</a>. SecKC&#8217;s Lo said organizations using Zoom should <a href="https://twitter.com/bry_campbell/status/1244994026413137920" target="_blank" rel="noopener">avoid posting the Zoom meeting links on social media</a>, and always require a meeting password when possible.</p>
<p>&#8220;This should be enabled by default as a new customer or a trial user,&#8221; he said. &#8220;Legacy organizations will need to check their administration settings to make sure this is enabled. You can also enable ‘Embed password in meeting link for one-click join.&#8217; This prevents an actor from accessing your meeting without losing the usability of sharing a link to join.&#8221;</p>
<p>In addition, Zoom users can disable &#8220;Allow participants to join the meeting before the host arrives.&#8221;</p>
<p>&#8220;If you have to have this feature enabled at least enable &#8220;notify host when participants join the meeting before them,&#8221; Lo advised. &#8220;This will notify you that someone might be using your meeting without your knowledge. If you must keep your meeting unprotected you should enable &#8216;Mask phone number in the participant list.&#8217; Using the waiting list feature will prevent unwanted participants from accessing your meeting but it will still expose your meeting details if used without a password.&#8221;</p>
<div id="attachment_51169" style="width: 608px" class="wp-caption aligncenter"><img class=" wp-image-51169" src="media/c7d1c6af.zoomsecsettings.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/zoomsecsettings.png" alt="" width="598" height="583" /><p class="wp-caption-text">Some of the security settings available to Zoom users. These and others can be found at https://www.zoom.us/profile/settings/</p></div>


feed_id: https://krebsonsecurity.com/?p=51195
title: Microsoft Buys Corp.com So Bad Guys Can’t
uri: Microsoft-Buys-Corp-com-So-Bad-Guys-Can-t
url: https://krebsonsecurity.com/2020/04/microsoft-buys-corp-com-so-bad-guys-cant/
content:
<p>In February, KrebsOnSecurity told the story of a private citizen <a href="https://krebsonsecurity.com/2020/02/dangerous-domain-corp-com-goes-up-for-sale/" target="_blank" rel="noopener">auctioning off the dangerous domain <strong>corp.com</strong> for the starting price of $1.7 million</a>. Domain experts called corp.com dangerous because years of testing showed whoever wields it would have access to an unending stream of passwords, email and other sensitive data from hundreds of thousands of <strong>Microsoft Windows</strong> PCs at major companies around the globe. This week, <strong>Microsoft Corp.</strong> agreed to buy the domain in a bid to keep it out of the hands of those who might abuse its awesome power.</p>
<p><img class="aligncenter wp-image-50460" src="media/0797eaa8.corpcomtoxic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/02/corpcomtoxic.png" alt="" width="595" height="159" /></p>
<p>Wisconsin native <strong>Mike O&#8217;Connor</strong>, who bought corp.com 26 years ago but has done very little with it since, said he hoped Microsoft would buy it because hundreds of thousands of confused Windows PCs are constantly trying to share sensitive data with corp.com. Also, early versions of Windows actually encouraged the adoption of insecure settings that made it more likely Windows computers might try to share sensitive data with corp.com.</p>
<p>From February&#8217;s piece:</p>
<blockquote><p>At issue is a problem known as “<a href="https://www.computerworld.com/article/3480799/icann-seeks-to-tackle-dns-namespace-collision-risks.html" target="_blank" rel="noopener">namespace collision</a>,” a situation where domain names intended to be used exclusively on an internal company network end up overlapping with domains that can resolve normally on the open Internet.</p>
<p>Windows computers on an internal corporate network validate other things on that network using a Microsoft innovation called <a href="https://en.wikipedia.org/wiki/Active_Directory" target="_blank" rel="noopener">Active Directory</a>, which is the umbrella term for a broad range of identity-related services in Windows environments. A core part of the way these things find each other involves a Windows feature called “<a href="https://www.itprotoday.com/security/whats-dns-name-devolution" target="_blank" rel="noopener">DNS name devolution</a>,” which is a kind of network shorthand that makes it easier to find other computers or servers without having to specify a full, legitimate domain name for those resources.</p>
<p>For instance, if a company runs an internal network with the name internalnetwork.example.com, and an employee on that network wishes to access a shared drive called “drive1,” there’s no need to type “drive1.internalnetwork.example.com” into Windows Explorer; typing “\\drive1\” alone will suffice, and Windows takes care of the rest.</p>
<p>But things can get far trickier with an internal Windows domain that does not map back to a second-level domain the organization actually owns and controls. And unfortunately, in early versions of Windows that supported Active Directory — Windows 2000 Server, for example — the default or example Active Directory path was given as “corp,” and many companies apparently adopted this setting without modifying it to include a domain they controlled.</p>
<p>Compounding things further, some companies then went on to build (and/or assimilate) vast networks of networks on top of this erroneous setting.</p>
<p>Now, none of this was much of a security concern back in the day when it was impractical for employees to lug their bulky desktop computers and monitors outside of the corporate network. But what happens when an employee working at a company with an Active Directory network path called “corp” takes a company laptop to the local Starbucks?</p>
<p>Chances are good that at least some resources on the employee’s laptop will still try to access that internal “corp” domain. And because of the way DNS name devolution works on Windows, that company laptop online via the Starbucks wireless connection is likely to then seek those same resources at “corp.com.”</p>
<p>In practical terms, this means that whoever controls corp.com can passively intercept private communications from hundreds of thousands of computers that end up being taken outside of a corporate environment which uses this “corp” designation for its Active Directory domain.</p></blockquote>
<p>The story went on to describe how years of testing &#8212; some of which was subsidized by grants from the <strong>U.S. Department of Homeland Security</strong> &#8212; showed hundreds of thousands of Windows computers were constantly trying to send this domain information it had no business receiving, including attempts to log in to internal corporate networks and access specific file shares on those networks.</p>
<p>O&#8217;Connor told me he was selling the domain after doing basically nothing with it for 26 years because he was getting on in years and didn&#8217;t want his kids to inherit this mess. When he put the domain up for sale, I asked if he&#8217;d agree to let me know if and when he sold it.</p>
<p>On Monday evening, he wrote to say that Microsoft had agreed to purchase it. O&#8217;Connor said he could  not discuss the terms of the deal, nor could he offer further comment beyond acknowledging the sale of corp.com to Microsoft.<span id="more-51195"></span></p>
<p>In a written statement, Microsoft said it acquired the domain to protect its customers.</p>
<p>&#8220;To help in keeping systems protected we encourage customers to practice safe security habits when planning for internal domain and network names,&#8221; the statement reads. &#8220;We released a security advisory in June of 2009 and a security update that helps keep customers safe. In our ongoing commitment to customer security, we also acquired the Corp.com domain.&#8221;</p>
<p>Over the years, Microsoft has shipped <a href="https://www.security-database.com/detail.php?alert=KB971888" target="_blank" rel="noopener">several</a> <a href="https://msrc-blog.microsoft.com/2015/02/10/ms15-011-ms15-014-hardening-group-policy/" target="_blank" rel="noopener">software updates</a> to help decrease the likelihood of namespace collisions that <a href="https://www.jasadvisors.com/jasbug-improper-use-of-the-dns-for-authentication-and-over-the-internet-exploitation-scenarios/" target="_blank" rel="noopener">could create a security problem</a> for companies that still rely on Active Directory domains that do not map to a domain they control.</p>
<p>However, experts say hardly any vulnerable organizations have deployed these fixes for two reasons. First, doing so requires the organization to take down its entire Active Directory network simultaneously for some period of time.</p>
<p>Second, according to Microsoft applying the patch(es) will likely break or at least slow down a number of applications that the affected organization relies upon for day-to-day operations. Faced with either or both of these scenarios, most affected companies probably decided the actual risk of not applying these updates was comparatively low.</p>
<p>It should be noted that while Microsoft&#8217;s purchase of corp.com will safeguard companies that built Active Directory infrastructures on top of &#8220;corp&#8221; or &#8220;corp.com,&#8221; any company that has tied their internal Active Directory network to a domain they do not control is opening itself to a similar potential security nightmare.</p>
<p>Further reading:</p>
<p><a href="media/370dcb63.name-collision-mitigation-study-06jun14-en.pdf" data-original-source="https://www.icann.org/en/system/files/files/name-collision-mitigation-study-06jun14-en.pdf" target="_blank" rel="noopener">Mitigating the Risk of DNS Namespace Collisions</a> (PDF)</p>
<p><a href="https://www.youtube.com/watch?v=ZPbyDSvGasw" target="_blank" rel="noopener">DEFCON 21 – DNS May Be Hazardous to your Health (Robert Stucke)</a></p>
<p><a href="media/416e2489.alysis-and-WPAD-Vulnerability-Assessment-in-the-New-gTLD-Era.pdf" data-original-source="https://www.verisign.com/assets/labs/MitM-Attack-by-Name-Collision-Cause-Analysis-and-WPAD-Vulnerability-Assessment-in-the-New-gTLD-Era.pdf" target="_blank" rel="noopener">Mitigating the Risk of Name Collision-Based Man-in-the-Middle Attacks</a> (PDF)</p>


feed_id: https://krebsonsecurity.com/?p=51193
title: New IRS Site Could Make it Easy for Thieves to Intercept Some Stimulus Payments
uri: New-IRS-Site-Could-Make-it-Easy-for-Thieves-to-Intercept-Some-Stimulus
url:
https://krebsonsecurity.com/2020/04/new-irs-site-could-make-it-easy-for-thieves-to-intercept-some-stimulus-payments/

content:
<p>The U.S. federal government is now in the process of sending <strong>Economic Impact Payments</strong> by direct deposit to millions of Americans. Most who are eligible for payments can expect to have funds direct-deposited into the same bank accounts listed on previous years&#8217; tax filings sometime next week. Today, the <strong>Internal Revenue Service</strong> (IRS) stood up a site to collect bank account information from the many Americans who don&#8217;t usually file a tax return. The question is, will those non-filers have a chance to claim their payments before fraudsters do?</p>
<p><img class="aligncenter wp-image-42398" src="media/69b57c63.taxthiefa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/taxthiefa.png" alt="" width="594" height="218" /></p>
<p><a href="https://www.irs.gov/coronavirus/economic-impact-payment-information-center" target="_blank" rel="noopener">The IRS says</a> the Economic Impact Payment will be $1,200 for individual or head of household filers, and $2,400 for married filing jointly if they are not a dependent of another taxpayer and have a work eligible Social Security number with adjusted gross income up to:</p>
<ul>
<li>$75,000 for individuals</li>
<li>$112,500 for head of household filers and</li>
<li>$150,000 for married couples filing joint returns</li>
</ul>
<p>Taxpayers with higher incomes will receive more modest payments (reduced by $5 for each $100 above the $75,000/$112,500/$150,000 thresholds). Most people who who filed a tax return in 2018 and/or 2019 and provided their bank account information for a debit or credit should soon see an Economic Impact Payment direct-deposited into their bank accounts. Likewise, people drawing Social Security payments from the government will receive stimulus payments the same way.</p>
<p>But there are millions of U.S. residents &#8212; including low-income workers and certain veterans and individuals with disabilities &#8212; who aren&#8217;t required to file a tax return but who are still eligible to receive at least a $1,200 stimulus payment. And earlier today, <a href="https://www.freefilefillableforms.com/#/fd/EconomicImpactPayment" target="_blank" rel="noopener">the IRS unveiled a Web site</a> where it is asking those non-filers to provide their bank account information for direct deposits.</p>
<p>However, the possibility that fraudsters may intercept payments to these individuals seems very real, given the relatively lax identification requirements of this non-filer portal and the <a href="https://krebsonsecurity.com/page/3/?s=tax+irs&amp;x=0&amp;y=0" target="_blank" rel="noopener">high incidence of tax refund fraud in years past</a>. Each year, scam artists file phony tax refund requests on millions of Americans, regardless of whether or not the impersonated taxpayer is actually due a refund. In most cases, the victim only finds out when he or she goes to file their taxes and has the return rejected because it has already been filed by scammers.</p>
<p>In this case, fraudsters would simply need to identify the personal information for a pool of Americans who don&#8217;t normally file tax returns, which may well include a large number of people who are disabled, poor or simply do not have easy access to a computer or the Internet. Armed with this information, the scammers need only provide the target&#8217;s name, address, date of birth and Social Security number, and then supply their own bank account information to claim at least $1,200 in electronic payments.</p>
<div id="attachment_51225" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/ae90a97a.freefilers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/freefilers.png"><img class="wp-image-51225" src="media/ae90a97a.freefilers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/freefilers.png" alt="" width="599" height="581" /></a><p class="wp-caption-text">Page 1 of 2 in the IRS stimulus payment application page for non-filers.</p></div>
<p>Unfortunately, <a href="https://krebsonsecurity.com/2014/03/who-built-the-id-theft-service-ssndob-ru/" target="_blank" rel="noopener">SSN and DOB data is not secret</a>, nor is it hard to come by. As noted in countless stories here, there are multiple shops in the cybercrime underground that sell SSN and DOB data on tens of millions of Americans for a few dollars per record.</p>
<p>A review of the Web site set up to accept bank account information for the stimulus payments reveals few other mandatory identity checks to complete the filing process. It appears that all applicants need to provide a mobile phone number and verify they can receive text messages at that number, but beyond that the rest of the identity checks seem to be optional.<span id="more-51193"></span></p>
<p>For example, <em>Step 2</em> in the application process requests a number of data points under the &#8220;personal verification&#8221; heading,&#8221; and for verification purposes demands either the amount of the applicant&#8217;s <a href="https://www.irs.gov/e-file-providers/definition-of-adjusted-gross-income" target="_blank" rel="noopener">Adjusted Gross Income</a> (AGI) <em>or </em>last year&#8217;s &#8220;self-selected signature PIN.&#8221; The instructions say if you do not have or do not remember your PIN, skip this step and follow the instructions in step A above.</p>
<p>More importantly, it appears one doesn&#8217;t really need to supply one&#8217;s AGI in 2018. &#8220;<em>If you didn&#8217;t file a return last year, enter 0</em>,&#8221; the site explains.</p>
<div id="attachment_51227" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/6ac07cc9.frefiler2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/frefiler2.png"><img class="wp-image-51227" src="media/6ac07cc9.frefiler2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/frefiler2.png" alt="" width="596" height="719" /></a><p class="wp-caption-text">Step 2 in the application for non-filers.</p></div>
<p>In the &#8220;electronic signature,&#8221; section at the end of the filing, applicants are asked to provide a cell phone number, to choose a PIN, and provide their date of birth. To check the filer&#8217;s identity, the site asks for a state-issued driver&#8217;s license ID number, and the ID&#8217;s issuance and expiration dates. However, the instructions say &#8220;<em>if you don&#8217;t have a driver&#8217;s license or state issued ID, you can leave the following fields blank.</em>&#8221;</p>
<p>Alas, much may depend on how good the IRS is at spotting phony applications, and whether the IRS has access to and bothers to check state driver&#8217;s license records. But given the enormous pressure the agency is under to disburse these payments as rapidly as possible, it seems likely that at least some Americans will get scammed out of their stimulus payments.</p>
<p>The site built to collect payment data from non-filers is a slight variation on the &#8220;<a href="https://www.freefilefillableforms.com/#/fd" target="_blank" rel="noopener">Free File Fillable Forms</a>&#8221; product, which is a free tax filing service maintained by <a href="https://krebsonsecurity.com/?s=intuit+whistleblower&amp;x=0&amp;y=0" target="_blank" rel="noopener">Intuit</a> &#8212; a private company that also processes a huge percentage of tax returns each year through its paid <strong>TurboTax</strong> platform. According to <a href="https://markets.businessinsider.com/news/stocks/turbotax-tax-prep-companies-profit-made-billion-charging-free-services-2020-2-1028882239" target="_blank" rel="noopener">a recent report from the Treasury Inspector General for Tax Administration</a>, more than 14 million Americans paid for tax preparation services in 2019 when they could have filed them for free using the free-file site.</p>
<p>In any case, perhaps Intuit can help the IRS identify fraudulent applications sent through the non-filers site (such as by flagging users who attempt to file multiple applications from the same Internet address, browser or computer).</p>
<p>There is another potential fraud storm brewing with these stimulus payments. An app is set to be released sometime next week called &#8220;<a href="https://www.irs.gov/coronavirus/economic-impact-payments" target="_blank" rel="noopener">Get My Payment</a>,&#8221; which is designed to be a tool for people who filed tax returns in 2018 and 2019 but who need to update their bank account information, or for those who did not provide direct deposit information in previous years&#8217; returns.</p>
<p>It&#8217;s yet not clear how that app will handle verifying the identity of applicants, but KrebsOnSecurity will be taking a look at the Get My Payment app when it launches later this month (the IRS says it should be available in &#8220;mid-April&#8221;).</p>


feed_id: https://krebsonsecurity.com/?p=51191
title: Microsoft Patch Tuesday, April 2020 Edition
uri: Microsoft-Patch-Tuesday-April-2020-Edition
url: https://krebsonsecurity.com/2020/04/microsoft-patch-tuesday-april-2020-edition/
content:
<p><strong>Microsoft</strong> today released updates to fix 113 security vulnerabilities in its various <strong>Windows</strong> operating systems and related software. Those include at least three flaws that are actively being exploited, as well as two others which were publicly detailed prior to today, potentially giving attackers a head start in figuring out how to exploit the bugs.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />Nineteen of the weaknesses fixed on this Patch Tuesday were assigned Microsoft&#8217;s most-dire “critical” rating, meaning malware or miscreants could exploit them to gain complete, remote control over vulnerable computers without any help from users.</p>
<p>Near the top of the heap is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1020" target="_blank" rel="noopener">CVE-2020-1020</a>, a remotely exploitable bug in the <strong>Adobe Font Manager</strong> library that was first detailed in late March when Microsoft said it had seen the flaw being used in active attacks.</p>
<p>The Adobe Font Manager library is the source of yet another zero-day flaw &#8212; <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0938" target="_blank" rel="noopener">CVE-2020-0938</a> &#8212; although experts at security vendor <strong>Tenable</strong> say there is currently no confirmation that the two are related to the same set of in-the-wild attacks. Both flaws could be exploited by getting a Windows users to open a booby-trapped document or viewing one in the Windows Preview Pane.</p>
<p>The other zero-day flaw (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1027" target="_blank" rel="noopener">CVE-2020-1027</a>) affects <strong>Windows 7</strong> and <strong>Windows 10 systems</strong>, and earned a slightly less dire &#8220;important&#8221; rating from Microsoft because it&#8217;s an &#8220;elevation of privilege&#8221; bug that requires the attacker to be locally authenticated.</p>
<p>Many security news sites are reporting that Microsoft addressed a total of four zero-day flaws this month, but it appears the advisory for a critical Internet Explorer flaw (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0968" target="_blank" rel="noopener">CVE-2020-0968</a>) has been revised to indicate Microsoft has not yet received reports of it being used in active attacks. However, the advisory says this IE bug is likely to be exploited soon.</p>
<p>Researchers at security firm <strong>Recorded Future</strong> zeroed in on <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0796" target="_blank" rel="noopener">CVE-2020-0796</a>, a critical vulnerability dubbed &#8220;SMBGhost&#8221; that was rumored to exist in last month&#8217;s Patch Tuesday but for which an out-of-band patch wasn&#8217;t released until March 12. The problem resides in a file-sharing component of Windows, and could be exploited merely by sending the victim machine specially-crafted data packets. Proof-of-concept code showing how to exploit the bug was released April 1, but so far there are no indications this method has been incorporated into malware or active attacks.</p>
<p>Recorded Future&#8217;s <strong>Allan Liska</strong> notes that one reason these past few months have seen so many patches from Microsoft is the company <a href="https://twitter.com/SandboxBear/status/1210133985478791171" target="_blank" rel="noopener">recently hired &#8220;SandboxEscaper,&#8221;</a> a nickname used by the security researcher responsible for <a href="https://arstechnica.com/information-technology/2019/05/serial-publisher-of-windows-0days-drops-exploits-for-3-more-unfixed-flaws/" target="_blank" rel="noopener">releasing more than a half-dozen zero-day flaws</a> against Microsoft products last year.</p>
<p>&#8220;SandboxEscaper has made several contributions to this month’s Patch Tuesday,&#8221; Liska said. &#8220;This is great news for Microsoft and the security community at large.&#8221;<span id="more-51191"></span></p>
<p>Once again, Adobe has blessed us with a respite from updating its Flash Player program with security fixes. I look forward to the end of this year, when the company has promised to sunset this buggy and insecure program once and for all. Adobe did release security updates for its <a href="https://blogs.adobe.com/psirt/?p=1859" target="_blank" rel="noopener">ColdFusion, After Effects and Digital Editions software</a>.</p>
<p>Speaking of buggy software platforms, <strong>Oracle</strong> has released a quarterly patch update to fix more than 400 security flaws across multiple products, including its <strong>Java SE</strong> program. If you&#8217;ve got Java installed and you need/want to keep it installed, please <a href="https://java.com/en/download/help/java_update.xml#manual" target="_blank" rel="noopener">make sure it&#8217;s up-to-date</a>.</p>
<p>Now for my obligatory disclaimers. Just a friendly reminder that while many of the vulnerabilities fixed in today’s Microsoft patch batch affect Windows 7 operating systems &#8212; including all three of the zero-day flaws &#8212; this OS is no longer being supported with security updates (unless you’re an enterprise taking advantage of Microsoft’s <a href="https://support.microsoft.com/en-us/help/4527878/faq-about-extended-security-updates-for-windows-7" target="_blank" rel="noopener">paid extended security updates program</a>, which is available to Windows 7 Professional and Windows 7 enterprise users).</p>
<p>If you rely on Windows 7 for day-to-day use, it’s to think about upgrading to something newer. That something might be a computer with Windows 10. Or maybe you have always wanted that shiny MacOS computer.</p>
<p>If cost is a primary motivator and the user you have in mind doesn’t do much with the system other than browsing the Web, perhaps a <strong>Chromebook</strong> or an older machine with a recent version of <strong>Linux</strong> is the answer (Ubuntu may be easiest for non-Linux natives). Whichever system you choose, it’s important to pick one that fits the owner’s needs and provides security updates on an ongoing basis.</p>
<p>Keep in mind that while staying up-to-date on Windows patches is a must, it’s important to make sure you’re updating only after you’ve backed up your important data and files. A reliable backup means you’re not losing your mind when the odd buggy patch causes problems booting the system.</p>
<p>So do yourself a favor and backup your files before installing any patches. Windows 10 even has <a href="https://lifehacker.com/how-to-back-up-your-computer-automatically-with-windows-1762867473" target="_blank" rel="noopener">some built-in tools</a> to help you do that, either on a per-file/folder basis or by making a complete and bootable copy of your hard drive all at once.</p>
<p>As always, if you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a better-than-even chance other readers have experienced the same and may chime in here with some helpful tips. Also, keep an eye on the <a href="https://www.askwoody.com/2020/february-2020-patch-tuesday-foibles/" target="_blank" rel="noopener">AskWoody blog</a> from <strong>Woody Leonhard</strong>, who keeps a close eye on buggy Microsoft updates each month.</p>
<p>Further reading:</p>
<p><a href="https://blog.qualys.com/laws-of-vulnerabilities/2020/04/14/april-2020-patch-tuesday-113-vulns-19-critical-0-day-patches-sharepoint-adobe-coldfusion" target="_blank" rel="noopener">Qualys breakdown on April 2020 Patch Tuesday</a></p>
<p><a href="https://isc.sans.org/forums/diary/Microsoft+April+2020+Patch+Tuesday/26022/" target="_blank" rel="noopener">SANS Internet Storm Center on Patch Tuesday</a></p>


feed_id: https://krebsonsecurity.com/?p=51249
title: COVID-19 Has United Cybersecurity Experts, But Will That Unity Survive the Pandemic?
uri: COVID-19-Has-United-Cybersecurity-Experts-But-Will-That-Unity-Survive
url:
https://krebsonsecurity.com/2020/04/covid-19-has-united-cybersecurity-experts-but-will-that-unity-survive-the-pandemic/

content:
<p>The Coronavirus has prompted thousands of information security professionals to volunteer their skills in upstart collaborative efforts aimed at frustrating cybercriminals who are seeking to exploit the crisis for financial gain. Whether it&#8217;s helping hospitals avoid becoming the next ransomware victim or kneecapping new COVID-19-themed scam websites, these nascent partnerships may well end up saving lives. But can this unprecedented level of collaboration survive the pandemic?</p>
<p><img class="alignright size-full wp-image-51280" src="media/1699895c.covidlock.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/covidlock.jpg" alt="" width="250" height="300" />At least three major industry groups are working to counter the latest cyber threats and scams. Among the largest in terms of contributors is the <a href="https://www.cyberthreatcoalition.org/contact" target="_blank" rel="noopener">COVID-19 Cyber Threat Coalition</a> (CTC), which comprises rough 3,000 security professionals who are collecting, vetting and sharing new intelligence about new cyber threats.</p>
<p><strong>Nick Espinosa</strong>, a self-described &#8220;security fanatic,&#8221; author and public speaker who&#8217;s handling communications for the CTC, said the group does most of its work remotely via a dedicated Slack channel, where many infosec professionals seem eager to counter the gusto with which the cybercriminal community has sought to profit by exacerbating an already difficult situation.</p>
<p>&#8220;A nurse or doctor can&#8217;t do what we do, and we can&#8217;t do what they do,&#8221; Espinosa said. &#8220;We&#8217;ve seen a massive rise in threats and attacks against healthcare systems, but it&#8217;s worse if someone dies due to a malicious cyberattack when we have the ability to prevent that. A lot of people are involved because they&#8217;re emotionally attached to the idea of helping this critical infrastructure stay safe and online.&#8221;</p>
<p>Using threat intelligence feeds donated by dozens of cybersecurity companies, the CTC is poring over more than 100 million pieces of data about potential threats each day, running those indicators through security products from roughly 70 different vendors. If at least 10 of those flag a specific data point &#8212; such as a domain name &#8212; as malicious or bad, it gets added to <a href="https://blacklist.cyberthreatcoalition.org/vetted/domain.txt" target="_blank" rel="noopener">the CTC&#8217;s blocklist</a>, which is designed to be used by organizations worldwide for blocking malicious traffic.</p>
<p>&#8220;For possible threats, meaning between five and nine vendors detect an indicator as bad, our volunteers manually verify that the indicator is malicious before including it in our blocklist,&#8221; Espinosa said.</p>
<p>Another Slack-based upstart coalition called the COVID-19 CTI League spans more than 40 countries and includes professionals in senior positions at such major companies as Microsoft Corp and Amazon.com Inc.</p>
<p><strong>Mark Rogers</strong>, one of several people helping to manage the CTI League&#8217;s efforts, <a href="https://in.reuters.com/article/coronavirus-cyber/cybersecurity-experts-come-together-to-fight-coronavirus-related-hacking-idINKBN21D09F" target="_blank" rel="noopener">told Reuters</a> the top priority of the group is working to combat hacks against medical facilities and other frontline responders to the pandemic, as well as helping defend communication networks and services that have become essential as more people work from home.</p>
<p>&#8220;The group is also using its web of contacts in internet infrastructure providers to squash garden-variety phishing attacks and another financial crime that is using the fear of COVID-19 or the desire for information on it to trick regular internet users,&#8221; wrote Reuters&#8217; <strong>Joe Menn</strong>.</p>
<p>&#8220;I’ve never seen this volume of phishing,” Rogers told Reuters. “I am literally seeing phishing messages in every language known to man.&#8221;<span id="more-51249"></span></p>
<p>Among the more mature organizations working to counter the threat from COVID-19 scammers is the <a href="https://www.cyberthreatalliance.org/about-cta/" target="_blank" rel="noopener">Cyber Threat Alliance</a>, a industry group founded in 2017 that counts among its members more than two dozen major cybersecurity firms that are all required to regularly share threat intelligence with other members.</p>
<p>&#8220;One thing we&#8217;re paying attention to in addition to phishing and malware attacks is anything targeting stuff involved in the pandemic response, such as the manufacturers of protective gear, testing kits, or hospitals,&#8221; <strong>CTA President</strong> <strong>Michael Daniel</strong> told KrebsOnSecurity. &#8220;One of those organizations getting hit with ransomware now would be really bad, and we want to make sure if we see that we&#8217;re alerting and working with law enforcement.&#8221;</p>
<p>Earlier this month, the international police network INTERPOL <a href="https://www.interpol.int/News-and-Events/News/2020/Cybercriminals-targeting-critical-healthcare-institutions-with-ransomware" target="_blank" rel="noopener">issued a warning</a> to law enforcement in nearly 200 member countries, saying it had detected &#8220;a significant increase in the number of attempted ransomware attacks against key organizations and infrastructure engaged in the virus response.&#8221;</p>
<p>The alert came after several top ransomware gangs pledged a moratorium on attacking hospitals and other care centers for the near future. Nevertheless, these group have continued to target companies on the periphery of the pandemic response, including virus testing labs, N95 mask production facilities, and companies engaged in vaccine research.</p>
<p>The CTC&#8217;s Espinoza said it would be a potentially fatal mistake to assume all cybercriminal groups might observe such a cease-fire.</p>
<p>&#8220;We might have independent criminal groups saying they won&#8217;t hit hospitals but they&#8217;ll hit everyone else, but that doesn&#8217;t prevent them from sending phishing emails and masquerading as the World Health Organization or the Centers for Disease Control,&#8221; he said. &#8220;These are people who have no problems locking out little old ladies out of their computers for 800 bucks, and of course there are state-sponsored hackers who love any opportunity to sow discord and disrupt things.&#8221;</p>
<p><H4>SURVIVING THE PANDEMIC</H4></p>
<p>The CTA&#8217;s Daniel said while it&#8217;s great to see so much voluntary collaboration between the cybersecurity industry, governments and law enforcement, he&#8217;s been thinking a lot lately about how to sustain these relationships and networks once the urgency of the pandemic subsides.</p>
<p>Formerly special assistant to President Obama and cybersecurity coordinator on the National Security Council, Daniel said he sees preserving and enhancing this information sharing effort post-COVID as one of the biggest policy issues facing the federal government over the next few years.</p>
<p>&#8220;Information sharing is easy to talk about, and hard to do in practice,&#8221; Daniel said. &#8220;I don&#8217;t use the term &#8216;public-private partnership&#8217; because it&#8217;s been bandied about so much over the years that I don&#8217;t know what it means anymore. It&#8217;s probably best described as &#8216;working together on an operation.'&#8221;</p>
<p>What prevents private companies from working more closely and frequently with governments on operations to target cybercrime organizations and networks? Daniel said on the government side, there are real concerns that working with one or two particularly clueful or effective companies (versus all of them) might give the impression that the government is showing favoritism, or picking winners and losers in the market.</p>
<p>&#8220;But you have to do that to some extent because the truth is some companies matter in this space, and a lot don&#8217;t,&#8221; Daniel said. &#8220;The government has to accept that, determine what are the objective rules, and establish transparency so that [their efforts] aren&#8217;t seen as some secret club but as part of a normal process.&#8221;</p>
<p>Daniel said governments in general also need to get more comfortable sharing information about operations targeting specific crime groups in advance of those actions.</p>
<p>&#8220;The government has to figure out how to let the private sector in on some of the planning and preparation,&#8221; he said. &#8220;If you want [the cybersecurity industry&#8217;s] help against certain targets, you have to tell us who they are ahead of time. But this goes against how  governments operate in almost every way.&#8221;</p>
<p>On the private sector side are issues of how for-profit companies can closely collaborate with the government without being perceived as potentially compromising the privacy and security of their customers, or as simply an agent of the government.</p>
<p>&#8220;For companies, the question is how do you deal with the liability and other questions that come with that,&#8221; Daniel said. &#8220;These are very real impediments, and why I think we need to get past the endless discussions of public-private partnerships and start talking about what we can do to coordinate actions against these groups so we can have a more strategic impact on the adversary.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=51289
title: Sipping from the Coronavirus Domain Firehose
uri: Sipping-from-the-Coronavirus-Domain-Firehose
url: https://krebsonsecurity.com/2020/04/sipping-from-the-coronavirus-domain-firehose/
content:
<p>Security experts are poring over thousands of new Coronavirus-themed domain names registered each day, but this often manual effort struggles to keep pace with the flood of domains invoking the virus to promote malware and phishing sites, as well as non-existent healthcare products and charities. As a result, domain name registrars are under increasing pressure to do more to combat scams and misinformation during the COVID-19 pandemic.</p>
<p>By most measures, the volume of new domain registrations that include the words &#8220;Coronavirus&#8221; or &#8220;Covid&#8221; has closely tracked the spread of the deadly virus. The <strong>Cyber Threat Coalition </strong>(CTC), a group of <a href="https://krebsonsecurity.com/2020/04/covid-19-has-united-cybersecurity-experts-but-will-that-unity-survive-the-pandemic/" target="_blank" rel="noopener">several thousand security experts volunteering their time</a> to fight COVID-related criminal activity online, recently <a href="https://www.cyberthreatcoalition.org/covid-19-cyber-threat-updates-blog/2020-04-14-weekly-threat-advisory" target="_blank" rel="noopener">published data</a> showing the rapid rise in new domains began in the last week of February, around the same time the <strong>Centers for Disease Control</strong> began publicly warning that a severe global pandemic was probably inevitable.</p>
<div id="attachment_51295" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/ec401b05.dt-cc-domains.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/dt-cc-domains.png"><img class="wp-image-51295" src="media/ec401b05.dt-cc-domains.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/dt-cc-domains.png" alt="" width="597" height="519" /></a><p class="wp-caption-text">The total number of domains registered per day that contain a COVID-19 related term, according to DomainTools. The red line indicates the count of domains that DomainTools determined are &#8220;likely malicious.&#8221; The blue line refers to domains that are likely benign.</p></div>
<p>&#8220;Since March 20th, the number of risky domains registered per day has been decreasing, with a notable spike around March 30th,&#8221; wrote <a href="https://twitter.com/turboCodr" target="_blank" rel="noopener">John Conwell</a>, principal data scientist at <strong>DomainTools</strong> [an advertiser on this site]. &#8220;Interestingly, legitimate organizations creating domains in response to the COVID-19 crisis were several weeks behind the curve from threat actors trying to take advantage of this situation. This is a pattern DomainTools hasn’t seen before in other crises.&#8221;</p>
<p>Security vendor <strong>Sophos</strong> looked at telemetry from customer endpoints to illustrate the number of new COVID-related domains that actually received traffic of late. As the company noted, one challenge in identifying potentially malicious domains is that many of them can sit dormant for days or weeks before being used for anything.</p>
<div id="attachment_51294" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/b9291c98.soph-dom-data.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/soph-dom-data.png"><img class="wp-image-51294" src="media/b9291c98.soph-dom-data.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/soph-dom-data.png" alt="" width="597" height="438" /></a><p class="wp-caption-text">Data from security vendor Sophos, published by the Cyber Threat Coalition, shows the number of Coronavirus or COVID-19 themed domains registered per week that received traffic.</p></div>
<p>&#8220;We can see a rapid and dramatic increase of visits to potentially malicious domains exploiting the Coronavirus pandemic week over week, beginning in late February,&#8221; wrote Sophos&#8217; <strong>Rich Harang</strong>. &#8220;Even though still a minority of cyber threats use the pandemic as a lure, some of these new domains will eventually be used for malicious purposes.&#8221;</p>
<p>CTC spokesman <strong>Nick Espinosa</strong> said the first spike in visits was on February 25, when group members saw about 4,000 visits to the sites they were tracking.</p>
<p>&#8220;The following two weeks starting on March 9 saw rapid growth, and from March 23 onwards we&#8217;re seeing between 75,000 to 130,000 visits per weekday, and about 40,000 on the weekends,&#8221; Espinosa said. &#8220;Looking at the data collected, the pattern of visits are highest on Monday and Friday, and the lowest visit count is on the weekend. Our data shows that there were virtually no customer hits on <a href="https://blacklist.cyberthreatcoalition.org/vetted/domain.txt" target="_blank" rel="noopener">COVID-related domains</a> prior to February 23.&#8221;</p>
<p>Milwaukee-based <strong>Hold Security</strong> has been publishing <a href="https://covid.holdintegrity.com/download/" target="_blank" rel="noopener">daily and weekly lists of all COVID-19 related domain registrations</a> (without any scoring assigned). Here&#8217;s a graph KrebsOnSecurity put together based on that data set, which also shows a massive spike in new domain registrations in the third week of March, trailing off considerably over the past couple of weeks.</p>
<div id="attachment_51296" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/b801df75.coronadomains-by-week.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/coronadomains-by-week.png"><img class="wp-image-51296" src="media/b801df75.coronadomains-by-week.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/coronadomains-by-week.png" alt="" width="594" height="359" /></a><p class="wp-caption-text">Data: Hold Security.</p></div>
<p>Not everyone is convinced we&#8217;re measuring the right things, or that the current measurements are accurate. <strong>Neil Schwartzman</strong>, executive director of the anti-spam group <a href="https://www.cauce.org/" target="_blank" rel="noopener">CAUCE</a>, said he believes DomainTool&#8217;s estimates on the percentage of new COVID/Coronavirus-themed domains that are malicious are too high, and that many are likely benign and registered by well-meaning people seeking to share news or their own thoughts about the outbreak.</p>
<p>&#8220;But there&#8217;s the rub,&#8221; he said. &#8220;Bad guys get to hide amidst the good really effectively, so each one needs to be reviewed on its own. And that&#8217;s a substantial amount of work.&#8221;<span id="more-51289"></span></p>
<p>At the same time, Schwartzman said, focusing purely on domains may obscure the true size and scope of the overall threat. That&#8217;s because scammers very often will establish multiple subdomains for each domain, meaning that a single COVID-related new domain registration could eventually be tied to a number of different scammy or malicious sites.</p>
<p>Subdomains <a href="https://krebsonsecurity.com/2020/01/phishing-for-apples-bobbing-for-links/" target="_blank" rel="noopener">can not only make phishing domains appear more legitimate</a>, but they also tend to lengthen the domain so that key parts of it get pushed off the URL bar in mobile browsers.</p>
<p>To that end, he said, it makes perhaps the most sense to focus on new domain registrations that have encryption certificates tied to them, since the issuance of an SSL certificate for a domain is usually a sign that it is about to be put to use. As noted in previous stories here, <a href="https://krebsonsecurity.com/2020/03/us-government-sites-give-bad-security-advice/" target="_blank" rel="noopener">roughly 75 percent of all phishing sites now have the padlock</a> (start with &#8220;https://&#8221;), mainly because the major Web browsers display security alerts on sites that don&#8217;t.</p>
<p>Schwartzman said more domain registrars should follow the example of Los Angeles-based <strong>Namecheap Inc.</strong>, which last month <a href="https://abcnews.go.com/Technology/wireStory/internet-firm-restricts-virus-themed-website-registrations-69825166" target="_blank" rel="noopener">pledged</a> to stop accepting the automated registration of website names that include words or phrases tied to the COVID-19 pandemic. Since then, a handful of other registrars have said they plan to manually review all such registrations going forward.</p>
<p>The <strong>Internet Corporation for Assigned Names and Numbers</strong> (ICANN), the organization that oversees the registrar industry, recently <a href="media/7b2d9db0.dns-security-covid-19-07apr20-en.pdf" data-original-source="https://www.icann.org/en/system/files/files/dns-security-covid-19-07apr20-en.pdf" target="_blank" rel="noopener">sent a letter</a> urging registrars to be more proactive, but stopped short of mandating any specific actions.</p>
<p>Schwartzman called ICANN&#8217;s response &#8220;weak tea.&#8221;</p>
<p><span class="pullquote pqright">&#8220;It&#8217;s absolutely ludicrous that ICANN hasn&#8217;t stepped up, and they will bear significant responsibility for any deaths that may happen as a result of all this,&#8221; Schwartzman said.</span> &#8220;This is a CYA response at best, and dictates to no one that they should do anything.&#8221;</p>
<p><strong>Michael Daniel</strong>, president of the <a href="https://www.cyberthreatalliance.org/about-cta/" target="_blank" rel="noopener">Cyber Threat Alliance</a> &#8212; a cybersecurity industry group that&#8217;s also been working to fight COVID-19 related fraud &#8212; agreed, saying more pressure needs to be applied to the registrar community.</p>
<p>&#8220;It&#8217;s really hard to do anything about this unless the registrars step up and do something on their own,&#8221; Daniel said. &#8220;It&#8217;s either that or the government gets involved. That doesn&#8217;t mean some [registrars] aren&#8217;t doing what they can, but in general what the industry is doing is nowhere near as fast as the bad guys are generating these domains.&#8221;</p>
<p>The U.S. government may well soon get more involved. Earlier this week, Senators <strong>Cory Booker</strong> (D-N.J.), <strong>Maggie Hassan</strong> (D-N.H.) and <strong>Mazie K. Hirono</strong> (D-Hawaii) <a href="https://www.hirono.senate.gov/news/press-releases/hirono-booker-hassan-call-on-domain-name-gatekeepers-to-combat-coronavirus-related-scams-and-misinformation" target="_blank" rel="noopener">sent letters</a> to eight domain name company leaders, demanding to know what they were doing to combat the threat of malicious domains, and urging them to do more.</p>
<p>“As cybercriminals and other malevolent actors seek to take advantage of the Coronavirus pandemic, it is critical that domain name registrars like yours (1) exercise diligence and ensure that only legitimate organizations can register Coronavirus-related domain names and domain names referencing online communications platforms; (2) act quickly to suspend, cancel, or terminate registrations for domains that are involved in unlawful or harmful activity; and (3) cooperate with law enforcement to help bring to justice cybercriminals profiting from the Coronavirus pandemic,” the senators wrote.</p>


feed_id: https://krebsonsecurity.com/?p=51320
title: Who’s Behind the “Reopen” Domain Surge?
uri: Who-s-Behind-the-Reopen-Domain-Surge
url: https://krebsonsecurity.com/2020/04/whos-behind-the-reopen-domain-surge/
content:
<p>The past few weeks have seen a large number of new domain registrations beginning with the word &#8220;reopen&#8221; and ending with U.S. city or state names. The largest number of them were created just hours after <strong>President Trump</strong> sent a series of all-caps tweets urging citizens to &#8220;liberate&#8221; themselves from new gun control measures and state leaders who&#8217;ve enacted strict social distancing restrictions in the face of the COVID-19 pandemic. Here&#8217;s a closer look at who and what appear to be behind these domains.</p>
<div id="attachment_51326" style="width: 604px" class="wp-caption aligncenter"><img class=" wp-image-51326" src="media/846daaff.liberate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/liberate.png" alt="" width="594" height="291" /><p class="wp-caption-text">A series of inciteful tweets sent by President Trump on April 17, the same day dozens of state-themed &#8220;reopen&#8221; domains were registered &#8212; mostly by conservative groups and gun rights advocates.</p></div>
<p>KrebsOnSecurity began this research after reading <a href="https://www.reddit.com/r/maryland/comments/g3niq3/i_simply_cannot_believe_that_people_are/fnstpyl/" target="_blank" rel="noopener">a fascinating Reddit thread</a> over the weekend on several &#8220;reopen&#8221; sites that seemed to be engaged in <a href="https://en.wikipedia.org/wiki/Astroturfing" target="_blank" rel="noopener">astroturfing</a>, which involves masking the sponsors of a message or organization to make it appear as thought it originates from and is supported by grassroots participants.</p>
<p>The Reddit discussion focused on a handful of new domains &#8212; including <strong>reopenmn.com</strong>, <strong>reopenpa.com</strong>, and <strong>reopenva.com</strong> &#8212; that appeared to be tied to various gun rights groups in those states. Their registrations have roughly coincided with contemporaneous demonstrations in Minnesota, California and Tennessee where people showed up to protest quarantine restrictions over the past few days.</p>
<div id="attachment_51330" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-51330" src="media/abe0972e.reopen-ca.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/reopen-ca.png" alt="" width="591" height="480" /><p class="wp-caption-text">A &#8220;reopen California&#8221; protest over the weekend in Huntington Beach, Calif. Image: Reddit.</p></div>
<p>Suspecting that these were but a subset of a larger corpus of similar domains registered for every state in the union, KrebsOnSecurity ran a domain search report at <strong>DomainTools</strong> [an advertiser on this site], <a href="https://research.domaintools.com/research/domain-search" target="_blank" rel="noopener">requesting</a> any and all domains registered in the past month that begin with &#8220;reopen&#8221; and end in &#8220;.com.&#8221;</p>
<p>That lookup returned approximately 150 domains; in addition to those named after the individual 50 states, some of the domains refer to large American cities or counties, and others to more general concepts, such as &#8220;<strong>reopeningchurch.com</strong>&#8221; or &#8220;<strong>reopenamericanbusiness.com</strong>.&#8221;</p>
<p>Many of the domains are still dormant, leading to parked pages and registration records obscured behind privacy protection services. But a review of other details about these domains suggests a majority of them are tied to various gun rights groups, state Republican Party organizations, and conservative think tanks, religious and advocacy groups.</p>
<p>For example, reopenmn.com forwards to <a href="https://www.minnesotagunrights.org/about-us/" target="_blank" rel="noopener">minnesotagunrights.org</a>, but the site&#8217;s WHOIS registration records (obscured since the Reddit thread went viral) point to an individual living in Florida. That same Florida resident registered <strong>reopenpa.com</strong>, a site that forwards to the <a href="https://action.pennsylvaniafirearmsassociation.org/action/end-wolfs-shutdown/" target="_blank" rel="noopener">Pennsylvania Firearms Association</a>, and urges the state&#8217;s residents to contact their governor about easing the COVID-19 restrictions.</p>
<p>Reopenpa.com is tied to a Facebook page called <a href="https://www.facebook.com/groups/525702768306093" target="_blank" rel="noopener">Pennsylvanians Against Excessive Quarantine</a>, which sought to organize an &#8220;Operation Gridlock&#8221; protest at noon today in Pennsylvania among its 68,000 members.</p>
<p>Both the Minnesota and Pennsylvania gun advocacy sites include the same Google Analytics tracker in their source code: <strong>UA-60996284</strong>. A cursory Internet search on that code shows it also is present on <strong>reopentexasnow.com</strong>, <strong>reopenwi.com </strong>and <strong>reopeniowa.com</strong>.</p>
<p>More importantly, the same code shows up on a number of other anti-gun control sites registered by <a href="https://www.midwestfreedomenterprises.com/" target="_blank" rel="noopener">the Dorr Brothers</a>, real-life brothers who have created nonprofits (in name only) across dozens of states that are so extreme in their stance they make the National Rifle Association look like a liberal group by comparison.</p>
<p><a href="https://www.cleveland.com/open/2019/08/how-one-ohio-gun-rights-group-aims-to-upend-the-public-debate-by-scaring-republicans.html" target="_blank" rel="noopener">This 2019 article at cleveland.com</a> quotes several 2nd Amendment advocates saying the Dorr brothers simply seek &#8220;to stir the pot and make as much animosity as they can, and then raise money off that animosity.&#8221; The site <a href="https://www.dorrbrotherscams.com/p/how-dorr-brothers-work.html" target="_blank" rel="noopener">dorrbrotherscams.com</a> also is instructive here.</p>
<p>A number of other sites &#8212; such as <strong>reopennc.com</strong> &#8212; seem to exist merely to sell t-shirts, decals and yard signs with such slogans as &#8220;Know Your Rights,&#8221; &#8220;Live Free or Die,&#8221; and &#8220;Facts not Fear.&#8221; WHOIS records show the same Florida resident who registered this North Carolina site also registered one for New York &#8212; <strong>reopenny.com</strong> &#8212; just a few minutes later.</p>
<div id="attachment_51328" style="width: 603px" class="wp-caption aligncenter"><img class=" wp-image-51328" src="media/7e80a9fe.reopennc-sales.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/reopennc-sales.png" alt="" width="593" height="324" /><p class="wp-caption-text">Merchandise available from reopennc.com.</p></div>
<p>Some of the concept reopen domains &#8212; including <strong>reopenoureconomy.com</strong> (registered Apr. 15) and <strong>reopensociety.com</strong> (Apr. 16) &#8212; trace back to <strong>FreedomWorks</strong>, a conservative group that the <em>Associated Press</em> <a href="https://apnews.com/57f673f31fb343042e3806b9806e8f7d" target="_blank" rel="noopener">says</a> has been holding weekly virtual town halls with members of Congress, &#8220;igniting an activist base of thousands of supporters across the nation to back up the effort.&#8221;</p>
<p><strong>Reopenoc.com</strong> &#8212; which advocates for lifting social restrictions in Orange County, Calif. &#8212; links to <a href="https://m.facebook.com/groups/234070164617125?view=permalink&amp;id=234861651204643" target="_blank" rel="noopener">a Facebook page for Orange County Republicans</a>, and has been chronicling the street protests there. The messaging on <strong>Reopensc.com</strong> &#8212; urging visitors to digitally sign a reopen petition to the state governor &#8212; is identical to the message on the Facebook page of the <a href="https://www.facebook.com/groups/66933899691" target="_blank" rel="noopener">Horry County, SC Conservative Republicans</a>.</p>
<p><strong>Reopenmississippi.com</strong> was registered on April 16 to <strong>In Pursuit of LLC</strong>, an Arlington, Va.-based conservative group with a number of former employees <a href="https://projects.propublica.org/trump-town/organizations/in-pursuit-of-llc" target="_blank" rel="noopener">who currently work at the White House or in cabinet agencies</a>. A <a href="https://www.usatoday.com/story/news/politics/elections/2016/2016/12/07/charles-koch-launches-marketing-firm-major-overhaul-political-empire/95109784/" target="_blank" rel="noopener">2016 story from <em>USA Today</em></a> says In Pursuit Of LLC is a for-profit communications agency launched by <a href="https://en.wikipedia.org/wiki/Charles_Koch" target="_blank" rel="noopener">billionaire industrialist Charles Koch</a>.<span id="more-51320"></span></p>
<p>Many of the reopen sites that have redacted names and other information about their registrants nevertheless hold other clues, mainly based on <em>precisely when</em> they were registered. Each domain registration record includes a date and timestamp down to the second that the domain was registered. By grouping the timestamps for domains that have obfuscated registration details and comparing them to domains that do include ownership data, we can infer more information.</p>
<p>For example, more than 50 reopen domains were registered within an hour of each other on April 17 &#8212; between 3:25 p.m. ET and 4:43 ET. Most of these lack registration details, but a handful of them did (until the Reddit post went viral) include the registrant name <strong>Michael Murphy</strong>, the same name tied to the aforementioned Minnesota and Pennsylvania gun rights domains (reopenmn.com and reopenpa.com) that were registered within seconds of each other on April 8.</p>
<div id="attachment_51337" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/391a0150.4-17.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/4-17.png"><img class="wp-image-51337" src="media/391a0150.4-17.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/4-17.png" alt="" width="598" height="356" /></a><p class="wp-caption-text">A large number of &#8220;reopen&#8221; domains were registered within the same one-hour period on April 17, and tie back to the same name used in the various reopen domains connected to gun rights groups. A link to the spreadsheet where this screen shot is drawn from is included below.</p></div>
<p>A Google spreadsheet documenting much of the domain information sourced in this story is available <a href="https://docs.google.com/spreadsheets/d/1HQnx-RvMM7BrpX1ysgjqzu8XkaDeu0w4gJgTtzB3dfk/edit?usp=sharing" target="_blank" rel="noopener">here</a>.</p>
<p>No one responded to the email addresses and phone numbers tied to Mr. Murphy, who may or may not have been involved in this domain registration scheme. Those contact details suggest he runs a store in Florida that makes art out of reclaimed or discarded items, and that he operates <a href="http://www.nassauwebdesign.com/about-us.html" target="_blank" rel="noopener">a Web site design company</a> in Florida.</p>
<p>However, various social media profiles tied to Mr. Murphy&#8217;s contact details suggest this persona may not present a complete picture. A <a href="https://twitter.com/lowerpigpen/with_replies" target="_blank" rel="noopener">Twitter account</a> tied to Murphy&#8217;s email address promoted nothing but spammy paid surveys for years. And a Skype lookup on his phone number curiously returns a Russian profile under the name валентина сынах (translated as &#8220;Valentine Sons&#8221;).</p>
<p><img class="aligncenter size-full wp-image-51325" src="media/8c5396e6.valentinasons.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/valentinasons.png" alt="" width="472" height="506" /></p>
<p>As much as President Trump likes to refer to stories critical of him and his administration as &#8220;fake news,&#8221; this type of astroturfing is not only dangerous to public health, but it&#8217;s reminiscent of the playbook used by Russia to sow discord, <a href="https://thehill.com/policy/technology/358025-thousands-attended-protest-organized-by-russians-on-facebook" target="_blank" rel="noopener">create phony protest events</a>, and spread disinformation across America in the lead-up to the 2016 election.</p>
<p>This entire astroturfing campaign also brings to mind a &#8220;local news&#8221; network called <a href="https://lgis.co/contact" target="_blank" rel="noopener">Local Government Information Services</a> (LGIS), an organization founded in 2018 which operates <a href="https://docs.google.com/spreadsheets/d/1k-GgWMNhg1se5302MCBhHxmBJnEhvlc9OL_ONDfEsas/edit?usp=sharing" target="_blank" rel="noopener">a huge network of hundreds of sites</a> that purport to be local news sites in various states. However, most of the content is generated by automated computer algorithms that consume data from reports released by U.S. executive branch federal agencies.</p>
<p>The relatively scarce actual bylined content on these LGIS sites is authored by freelancers who are in most cases nowhere near the localities they cover. Other content not drawn from government reports often repurpose press releases from conservative Web sites, including gunrightswatch.com, taxfoundation.org, and <a href="https://en.wikipedia.org/wiki/The_Heritage_Foundation" target="_blank" rel="noopener">The Heritage Foundation</a>. For more on LGIS, check out the 2018 coverage from <a href="https://www.chicagotribune.com/news/ct-met-illinois-conservative-news-20180327-story.html" target="_blank" rel="noopener">The Chicago Tribune</a> and the <a href="https://www.cjr.org/united_states_project/lgis-proft-news-illinois.php" target="_blank" rel="noopener">Columbia Journalism Review</a>.</p>


feed_id: https://krebsonsecurity.com/?p=51346
title: When in Doubt: Hang Up, Look Up, & Call Back
uri: When-in-Doubt-Hang-Up-Look-Up-Call-Back
url: https://krebsonsecurity.com/2020/04/when-in-doubt-hang-up-look-up-call-back/
content:
<p>Many security-conscious people probably think they&#8217;d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here&#8217;s how one security and tech-savvy reader got taken for more than $10,000 in an elaborate, weeks-long ruse.</p>
<p><img class="aligncenter wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="598" height="377" /></p>
<p>Today&#8217;s lesson in how not to get scammed comes from &#8220;Mitch,&#8221; the pseudonym I picked for a reader in California who shared his harrowing tale on condition of anonymity. Mitch is a veteran of the tech industry &#8212; having worked in security for several years at a fairly major cloud-based service &#8212; so he&#8217;s understandably embarrassed that he got taken in by this confidence scheme.</p>
<p>On Friday, April 17, Mitch received a call from what he thought was his financial institution, warning him that fraud had been detected on his account. Mitch said the caller ID for that incoming call displayed the same phone number that was printed on the back of his debit card.</p>
<p>But Mitch knew enough of scams to understand that fraudsters can and often do spoof phone numbers. So while still on the phone with the caller, he quickly logged into his account and saw that there were indeed multiple unauthorized transactions going back several weeks. Most were relatively small charges &#8212; under $100 apiece &#8212; but there were also two very recent $800 ATM withdrawals from cash machines in Florida.</p>
<p>If the caller had been a fraudster, he reasoned at the time, they would have asked for personal information. But the nice lady on the phone didn&#8217;t ask Mitch for any personal details. Instead, she calmly assured him the bank would reverse the fraudulent charges and said they&#8217;d be sending him a new debit card via express mail. After making sure the representative knew which transactions were not his, Mitch thanked the woman for notifying him, and hung up.</p>
<p>The following day, Mitch received another call about suspected fraud on his bank account. Something about that conversation didn&#8217;t seem right, and so Mitch decided to use another phone to place a call to his bank&#8217;s customer service department &#8212; while keeping the first caller on hold.</p>
<p>&#8220;When the representative finally answered my call, I asked them to confirm that I was on the phone with them on the other line in the call they initiated toward me, and so the rep somehow checked and saw that there was another active call with Mitch,&#8221; he said. &#8220;But as it turned out, that other call was the attackers also talking to my bank pretending to be me.&#8221;</p>
<p>Mitch said his financial institution has in the past verified his identity over the phone by sending him a one-time code to the cell phone number on file for his account, and then asking him to read back that code. After he hung up with the customer service rep he&#8217;d phoned, the person on the original call said the bank would be sending him a one-time code to validate his identity.</p>
<p>Now confident he was speaking with a representative from his bank and not some fraudster, Mitch read back the code that appeared via text message shortly thereafter. After more assurances that any additional phony charges would be credited to his account and that he&#8217;d be receiving a new card soon, Mitch was annoyed but otherwise satisfied. He said he checked his account online several times over the weekend, but saw no further signs of unauthorized activity.</p>
<p><img class="aligncenter wp-image-45226" src="media/c61b924f.cell8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/cell8.png" alt="" width="598" height="688" /></p>
<p>That is, until the following Monday, when Mitch once again logged in and saw that a $9,800 outgoing wire transfer had been posted to his account. At that point, it dawned on Mitch that both the Friday and Saturday calls he received had likely been from scammers &#8212; not from his bank.</p>
<p>Another call to his financial institution and some escalation to its fraud department confirmed that suspicion: The investigator said another man had called in on Saturday posing as Mitch, had provided a one-time code the bank texted to the phone number on file for Mitch&#8217;s account &#8212; the same code the real Mitch had been tricked into giving up &#8212; and then initiated an outgoing wire transfer.</p>
<p>It appears the initial call on Friday was to make him think his bank was aware of and responding to active fraud against his account, when in actuality the bank was not at that time. Also, the Friday call helped to set up the bigger heist the following day.</p>
<p>Mitch said he and his bank now believe that at some point his debit card and PIN were stolen, most likely by a skimming device planted at a compromised point-of-sale terminal, gas pump or ATM he&#8217;d used in the past few weeks. Armed with a counterfeit copy of his debit card and PIN, the fraudsters could pull money out of his account at ATMs and go shopping in big box stores for various items. But to move lots of money out of his account all at once, they needed Mitch&#8217;s help.<span id="more-51346"></span></p>
<p>To make matters worse, the fraud investigator said the $9,800 wire transfer had been sent to an account at an online-only bank that also was in Mitch&#8217;s name. Mitch said he didn&#8217;t open that account, but that this may have helped the fraudsters sidestep any fraud flags for the unauthorized wire transfer, since from the bank&#8217;s perspective Mitch was merely wiring money to another one of his accounts. Now, he&#8217;s facing the arduous task of getting identity theft (new account fraud) cleaned up at the online-only bank.</p>
<p>Mitch said that in retrospect, there were several oddities that should have been additional red flags. For one thing, on his outbound call to the bank on Saturday while he had the fraudsters on hold, the customer service rep asked if he was visiting family in Florida.</p>
<p>Mitch replied that no, he didn&#8217;t have any family members living there. But when he spoke with the bank&#8217;s fraud department the following Monday, the investigator said the fraudsters posing as Mitch had succeeded in adding a phony &#8220;travel notice&#8221; to his account &#8212; essentially notifying the bank that he was traveling to Florida and that it should disregard any geographic-based fraud alerts created by card-present transactions in that region. That would explain why his bank didn&#8217;t see anything strange about their California customer suddenly using his card in Florida.</p>
<p>Also, when the fake customer support rep called him, she stumbled a bit when Mitch turned the tables on her. As part of her phony customer verification script, she asked Mitch to state his physical address.</p>
<p>&#8220;I told her, &#8216;You tell me,&#8217; and she read me the address of the house I grew up in,&#8221; Mitch recalled. &#8220;So she was going through some public records she&#8217;d found, apparently, because they knew my previous employers and addresses. And she said, &#8216;Sir, I&#8217;m in a call center and there&#8217;s cameras over my head. I&#8217;m just doing my job.&#8217; I just figured she was just new or shitty at her job, but who knows maybe she was telling the truth. Anyway, the whole time my girlfriend is sitting next to me listening to this conversation and she&#8217;s like, &#8216;This sounds like bullshit.'&#8221;</p>
<p><img class="aligncenter size-full wp-image-40414" src="media/af546167.phonefraud-580x580.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraud-580x580.jpg" alt="" width="580" height="580" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraud-580x580.jpg 580w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraud-580x580-150x150.jpg 150w" sizes="(max-width: 580px) 100vw, 580px" /></p>
<p>Mitch&#8217;s bank managed to reverse the unauthorized wire transfer before it could complete, and they&#8217;ve since put all the stolen funds back into his account and issued a new card. But he said he still feels like a chump for not observing the golden rule: If someone calls saying they&#8217;re from your bank, just hang up and call them back &#8212; ideally using a phone number that came from the bank&#8217;s Web site or from the back of your payment card. As it happened, Mitch only followed half of that advice.</p>
<p>What else could have made it more difficult for fraudsters to get one over on Mitch? He could have enabled mobile alerts to receive text messages anytime a new transaction posts to his account. Barring that, he could have kept a closer eye on his bank account balance.</p>
<p>If Mitch had previously <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">placed a security freeze on his credit file with the three major consumer credit bureaus</a>, the fraudsters likely would not have been able to open a new online checking account in his name with which to receive the $9,800 wire transfer (although they might have still been able to wire the money to another account they controlled).</p>
<p>As Mitch&#8217;s experience shows, many security-conscious people tend to focus on protecting their online selves, while perhaps discounting the threat from less technically sophisticated phone-based scams. In this case, Mitch and his bank determined that his assailants never once tried to log in to his account online.</p>
<p>&#8220;What&#8217;s interesting here is the entirety of the fraud was completed over the phone, and at no time did the scammers compromise my account online,&#8221; Mitch said. &#8220;I absolutely should have hung up and initiated the call myself. And as a security professional, that&#8217;s part of the shame that I will bear for a long time.&#8221;</p>
<p>Further reading:</p>
<p><a href="https://krebsonsecurity.com/2018/10/voice-phishing-scams-are-getting-more-clever/" target="_blank" rel="noopener">Voice Phishing Scams are Getting More Clever</a><br />
<a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener">Why Phone Numbers Stink as Identity Proof</a><br />
<a href="https://krebsonsecurity.com/2019/01/apple-phone-phishing-scams-getting-better/" target="_blank" rel="noopener">Apple Phone Phishing Scams Getting Better</a><br />
<a href="https://krebsonsecurity.com/2018/11/sms-phishing-cardless-atm-profit/" target="_blank" rel="noopener">SMS Phishing + Cardless ATM = Profit</a></p>


feed_id: https://krebsonsecurity.com/?p=51316
title: Unproven Coronavirus Therapy Proves Cash Cow for Shadow Pharmacies
uri: Unproven-Coronavirus-Therapy-Proves-Cash-Cow-for-Shadow-Pharmacies
url:
https://krebsonsecurity.com/2020/04/unproven-coronavirus-therapy-proves-cash-cow-for-shadow-pharmacies/

content:
<p>Many of the same shadowy organizations that pay people to promote male erectile dysfunction drugs via spam and hacked websites recently have enjoyed a surge in demand for medicines used to fight malaria, lupus and arthritis, thanks largely to unfounded suggestions that these therapies can help combat the COVID-19 pandemic.</p>
<p>A review of the sales figures from some of the top pharmacy affiliate programs suggests sales of drugs containing <strong>hydroxychloroquine</strong> rivaled that of their primary product &#8212; generic <strong>Viagra</strong> and <strong>Cialis</strong> &#8212; and that this as-yet-unproven Coronavirus treatment accounted for as much as 25 to 30 percent of all sales over the past month.</p>
<div id="attachment_51404" style="width: 600px" class="wp-caption aligncenter"><a class="lightbox" href="media/413fe0c3.gt-chlor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/gt-chlor.png"><img class="wp-image-51404" src="media/413fe0c3.gt-chlor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/gt-chlor.png" alt="" width="590" height="267" /></a><p class="wp-caption-text">A Google Trends graph depicting the incidence of Web searches for &#8220;chloroquine&#8221; over the past 90 days.</p></div>
<p>KrebsOnSecurity reviewed a number of the most popular online pharmacy enterprises, in part by turning to some of the same accounts at these invite-only affiliate programs I relied upon for researching my 2014 book, <em><a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank" rel="noopener">Spam Nation: The Inside Story of Organized Cybercrime, from Global Epidemic to Your Front Door</a>.</em></p>
<p>Many of these affiliate programs &#8212; going by names such as <a href="https://krebsonsecurity.com/?s=eva+pharmacy&amp;x=0&amp;y=0" target="_blank" rel="noopener">EvaPharmacy</a>, <a href="https://krebsonsecurity.com/?s=rx-partners&amp;x=0&amp;y=0" target="_blank" rel="noopener">Rx-Partners</a> and <a href="https://krebsonsecurity.com/?s=mailien&amp;x=0&amp;y=0" target="_blank" rel="noopener">Mailien/Alientarget</a> &#8212; have been around for more than a decade, and were major, early catalysts for the creation of large-scale botnets and malicious software designed to enslave computers for the sending of junk email.</p>
<p>Their products do not require a prescription, are largely sourced directly from pharmaceutical production facilities in India and China, and are shipped via international parcel post to customers around the world.</p>
<p>In mid-March, two influential figures &#8212; <strong>President Trump</strong> and <strong>Tesla CEO Elon Musk</strong> &#8212; <a href="https://www.whitehouse.gov/briefings-statements/remarks-president-trump-vice-president-pence-members-coronavirus-task-force-press-briefing-6/" target="_blank" rel="noopener">began</a> <a href="https://www.vox.com/recode/2020/3/19/21185417/elon-musk-coronavirus-tweets-panic-ventilators-chloroquine-tesla-factory" target="_blank" rel="noopener">suggesting</a> that hydroxychloroquine should be more strongly considered as a treatment for COVID-19.</p>
<p>The pharmacy affiliate programs immediately took notice of a major moneymaking opportunity, noting that keyword searches for terms related to chloroquine suddenly were many times more popular than for the other mainstays of their business.</p>
<p>&#8220;Everyone is hysterical,&#8221; wrote one member of the Russian language affiliate forum <strong>gofuckbiz[.]com</strong> on Mar. 17. &#8220;Time to make extra money. Do any [pharmacy affiliate] programs sell drugs for Coronavirus or flu?&#8221;</p>
<p>The larger affiliate programs quickly pounced on the opportunity, which turned out to be a major &#8212; albeit short-lived &#8212; moneymaker. Below is a screenshot of the overall product sales statistics for the previous 30 days from all affiliates of <strong>PharmCash</strong>. As we can see, <a href="https://www.rxlist.com/aralen-drug.htm" target="_blank" rel="noopener">Aralen</a> &#8212; a chloroquine drug used to treat and prevent malaria &#8212; was the third biggest seller behind Viagra and Cialis.</p>
<div id="attachment_51401" style="width: 533px" class="wp-caption aligncenter"><img class=" wp-image-51401" src="media/e57e335d.pctop10.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/pctop10.png" alt="" width="523" height="597" /><p class="wp-caption-text">Recent 30-day sales figures from the pharmacy affiliate program PharmCash.</p></div>
<p>In mid-March, the affiliate program <strong>Rx-Partners</strong> saw a huge spike in demand for Aralen and other drugs containing chloroquine phosphate, and began encouraging affiliates to promote a new set of product teasers targeting people anxiously seeking remedies for COVID-19.</p>
<p>Their main promotion page &#8212; still online at <strong>about-coronavirus2019[.]com</strong> &#8212; touts the potential of <a href="media/54aaff05.aralen.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/aralen.png" target="_blank" rel="noopener">Aralen, generic hydroxychloroquine, and generic Kaletra/Lopinavir</a>, a drug used to treat HIV/AIDS.</p>
<div id="attachment_51402" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/3bc858b3.rxp-aboutcoronavirus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/rxp-aboutcoronavirus.png"><img class="wp-image-51402" src="media/3bc858b3.rxp-aboutcoronavirus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/rxp-aboutcoronavirus.png" alt="" width="599" height="338" /></a><p class="wp-caption-text">An ad promoting various unproven remedies for COVID-19, from the pharmacy affiliate program Rx-Partners.</p></div>
<p>On Mar. 18, a manager for Rx-Partners said that like PharmCash, drugs which included chloroquine phosphate had already risen to the top of sales for non-erectile dysfunction drugs across the program.<span id="more-51316"></span></p>
<p>But the boost in sales from the global chloroquine frenzy would be short-lived. Demand for chloroquine phosphate became so acute worldwide that India &#8212; the world&#8217;s largest producer of hydroxychloroquine &#8212; <a href="https://fortune.com/2020/03/25/coronavirus-hydroxychloroquine-trump-india-export/" target="_blank" rel="noopener">announced it would ban exports of the drug</a>. On Mar. 25, India also began <a href="https://www.bloomberg.com/news/articles/2020-03-25/indian-ports-declare-force-majeure-amid-national-virus-lockdown" target="_blank" rel="noopener">shutting down its major international shipping ports</a>, leaving the pharmacy affiliate programs scrambling to source their products from other countries.</p>
<div id="attachment_51408" style="width: 496px" class="wp-caption aligncenter"><img class="size-full wp-image-51408" src="media/2a574685.up-ms.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/04/up-ms.png" alt="" width="486" height="137" /><p class="wp-caption-text">A Mar. 31 message to affiliates working with the Union Pharm program, noting that supplies of Aralen had dried up due to the shipping closures in India.</p></div>
<p>India recently said it would resume exports of the drug, and judging from recent posts at the aforementioned affiliate site gofuckbiz[.]com, denizens of various pharmacy affiliate programs are anxiously awaiting news of exactly when shipments of chloroquine drugs will continue.</p>
<p>&#8220;As soon as India opens and starts mail, then we will start everything, so get ready,&#8221; wrote one of Rx-Partners&#8217; senior recruiters. &#8220;I am sure that there will still be demand for pills.&#8221;</p>
<p>Global demand for these pills, combined with India&#8217;s recent ban on exports, have conspired to <a href="https://www.newsweek.com/fda-shortage-hydroxychloroquine-chloroquine-1495555" target="_blank" rel="noopener">create shortages of the drug</a> for patients who rely on it to treat chronic autoimmune diseases, including <a href="https://www.mayoclinic.org/diseases-conditions/lupus/symptoms-causes/syc-20365789" target="_blank" rel="noopener">lupus</a> and <a href="https://www.healthline.com/health/rheumatoid-arthritis" target="_blank" rel="noopener">rheumatoid arthritis</a>.</p>
<p>While hydroxychloroquine has long been considered a relatively safe drug, some people have been so anxious to secure their own stash of the drug that they&#8217;ve turned to unorthodox sources.</p>
<p>On March 19, <em>Fox News</em> <a href="https://www.foxnews.com/health/trump-fda-coronavirus-drug-testing-fish-tanks-ebay-price-human-consumption" target="_blank" rel="noopener">ran a story</a> about how demand for hydroxychloroquine had driven up prices on eBay for bottles of chloroquine phosphate designed for removing parasites from fish tanks. A week later, <a href="https://www.cnn.com/2020/03/23/health/arizona-coronavirus-chloroquine-death/index.html" target="_blank" rel="noopener">an Arizona man died and his wife was hospitalized</a> after the couple ingested one such fish tank product in hopes of girding their immune systems against the Coronavirus.</p>
<p>Despite many claims that hydroxychloroquine can be effective at fighting COVID-19, there is little real data showing how it benefits patients stricken with the disease. The <a href="https://apnews.com/a5077c7227b8eb8b0dc23423c0bbe2b2" target="_blank" rel="noopener">largest test of the drug&#8217;s efficacy against Coronavirus</a> showed no benefit in a large analysis of its use in U.S. veterans hospitals. On the contrary, there were more deaths among those given hydroxychloroquine versus standard care, researchers reported.</p>


