# articles

feed_id: https://krebsonsecurity.com/?p=63900
title: Service Rents Email Addresses for Account Signups
uri: Service-Rents-Email-Addresses-for-Account-Signups
url: https://krebsonsecurity.com/2023/06/service-rents-email-addresses-for-account-signups/
content:
<p>One of the most expensive aspects of any cybercriminal operation is the time and effort it takes to constantly create large numbers of new throwaway email accounts. Now a new service offers to help dramatically cut costs associated with large-scale spam and account creation campaigns, by paying people to sell their email account credentials and letting customers temporarily rent access to a vast pool of established accounts at major providers.</p>
<p><img decoding="async" class="alignright size-medium wp-image-24825" src="media/ee10c30a.emaildevil-285x285.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil-285x285.jpg" alt="" width="285" height="285" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil-285x285.jpg 285w, https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil-150x150.jpg 150w, https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil-600x600.jpg 600w, https://krebsonsecurity.com/wp-content/uploads/2014/02/emaildevil.jpg 693w" sizes="(max-width: 285px) 100vw, 285px" /></p>
<p>The service in question &#8212; <strong>kopeechka[.]store</strong> &#8212; is perhaps best described as a kind of unidirectional email confirmation-as-a-service that promises to &#8220;save your time and money for successfully registering multiple accounts.&#8221;</p>
<p>&#8220;Are you working on large volumes and are costs constantly growing?&#8221; Kopeechka&#8217;s website asks. &#8220;Our service will solve all your problems.&#8221;</p>
<p>As a customer of this service, you don&#8217;t get full access to the email inboxes you are renting. Rather, you configure your botnet or spam machine to make an automated application programming interface (API) call to the Kopeechka service, which responds with a working email address at an email provider of your choosing.</p>
<p>Once you&#8217;ve entered the supplied email address into the new account registration page at some website or service, you tell Kopeechka which service or website you&#8217;re expecting an account confirmation link from, and they will then forward any new messages matching that description to your Kopeechka account panel.</p>
<p>Ensuring that customers cannot control inboxes rented through the service means that Kopeechka can rent the same email address to multiple customers (at least until that email address has been used to register accounts at most of the major online services).</p>
<p>Kopeechka also has multiple affiliate programs, including one that pays app developers for embedding Kopeechka&#8217;s API in their software. However, far more interesting is their program for rewarding people who choose to sell Kopeechka usernames and passwords for working email addresses.</p>
<p>Kopeechka means &#8220;penny&#8221; in Russian, which is generous verbiage (and coinage) for a service that charges a tiny fraction of a penny for access to account confirmation links. Their pricing fluctuates slightly based on which email provider you choose, but a form on the service&#8217;s homepage says a single confirmation message from apple.com to outlook.com costs .07 rubles, which is currently equal to about $0.00087 dollars.</p>
<div id="attachment_63902" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63902" decoding="async" loading="lazy" class=" wp-image-63902" src="media/a0b1376e.kopeechkapricing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/kopeechkapricing.png" alt="" width="750" height="392" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/kopeechkapricing.png 1060w, https://krebsonsecurity.com/wp-content/uploads/2023/06/kopeechkapricing-768x401.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/kopeechkapricing-782x409.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/06/kopeechkapricing-267x140.png 267w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-63902" class="wp-caption-text">The pricing for Kopeechka works out to about a fraction of a penny per confirmation message.</p></div>
<p>&#8220;Emails can be uploaded to us for sale, and you will receive a percentage of purchases %,&#8221; the service explains. &#8220;You upload 1 mailbox of a certain domain, discuss percentage with our technical support (it depends on the liquidity of the domain and the number of downloaded emails).&#8221;</p>
<p>We don&#8217;t have to look very far for examples of Kopeechka in action. In May, KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/05/interview-with-a-crypto-scam-investment-spammer/" target="_blank" rel="noopener">interviewed a Russian spammer named &#8220;<strong>Quotpw</strong>&#8220;</a> who was mass-registering accounts on the social media network Mastodon in order to conduct a series of huge spam campaigns advertising scam cryptocurrency investment platforms.</p>
<p>Much of the fodder for that story came from <strong>Renaud Chaput</strong>, a freelance programmer working on modernizing and scaling the Mastodon project infrastructure &#8212; including joinmastodon.org, mastodon.online, and mastodon.social. Chaput told KrebsOnSecurity that his team was forced to temporarily halt all new registrations for these communities last month after the number of new registrations from Quotpw&#8217;s spam campaign started to overwhelm their systems.</p>
<p>&#8220;We suddenly went from like three registrations per minute to 900 a minute,&#8221; Chaput said. &#8220;There was nothing in the Mastodon software to detect that activity, and the protocol is not designed to handle this.&#8221;</p>
<p>After that story ran, Chaput said he discovered that the computer code powering Quotpw&#8217;s spam botnet (which has since been released as open source) contained an API call to Kopeechka&#8217;s service.</p>
<p>&#8220;It allows them to pool many bot-created or compromised emails at various providers and offer them to cyber criminals,&#8221; Chaput said of Kopeechka. &#8220;This is what they used to create thousands of valid Hotmail (and other) addresses when spamming on Mastodon. If you look at the code, it&#8217;s really well done with a nice API that forwards you the confirmation link that you can then fake click with your botnet.&#8221;<span id="more-63900"></span></p>
<p>It&#8217;s doubtful anyone will make serious money selling email accounts to Kopeechka, unless of course that person already happens to run a botnet and has access to ridiculous numbers of email credentials. And in that sense, this service is genius: It essentially offers scammers a new way to wring extra income from resources that are already plentiful for them.</p>
<p>One final note about Quotpw and the spam botnet that ravaged Chaput&#8217;s Mastodon servers last month: <strong>Trend Micro</strong> just published <a href="https://www.trendmicro.com/en_us/research/23/f/impulse-team-massive-cryptocurrency-scam.html" target="_blank" rel="noopener">a report</a> saying Quotpw was spamming to earn money for a Russian-language affiliate program called &#8220;<strong>Impulse Team</strong>,&#8221; which pays people to promote cryptocurrency scams.</p>
<div id="attachment_63903" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63903" decoding="async" loading="lazy" class=" wp-image-63903" src="media/a69640c8.cryptoscamaffiliate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/cryptoscamaffiliate.png" alt="" width="750" height="473" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/cryptoscamaffiliate.png 1076w, https://krebsonsecurity.com/wp-content/uploads/2023/06/cryptoscamaffiliate-768x485.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/cryptoscamaffiliate-782x493.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-63903" class="wp-caption-text">The crypto scam affiliate program &#8220;Project Impulse,&#8221; advertising in 2021.</p></div>
<p>Launched in 2020, websites under the banner of the Impulse Scam Crypto Project are all essentially &#8220;advanced fee&#8221; scams that tell people they have earned a cryptocurrency investment credit. Upon registering at the site, visitors are told they need to make a minimum deposit on the service to collect the award. However, those who make the initial investment never hear from the site again, and their money is gone.</p>
<p>Interestingly, Trend Micro says the scammers behind the Impulse Team also appear to be operating a fake reputation service called <strong>Scam-Doc[.]com,</strong> a website that mimics the legitimate Scamdoc.com site for measuring the trustworthiness and authenticity of various sites. Trend Notes that the phony reputation site routinely gave high trust ratings to a variety of cryptocurrency scam and casino websites.</p>
<p>&#8220;We can only suppose that either the same cybercriminals run operations involving both or that several different cybercriminals share the scam-doc[.]com site,&#8221; the Trend researchers wrote.</p>
<div id="attachment_63901" style="width: 761px" class="wp-caption aligncenter"><a href="media/f1ec1ec2.scamdoc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/scamdoc.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63901" decoding="async" loading="lazy" class="wp-image-63901" src="media/f1ec1ec2.scamdoc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/scamdoc.png" alt="" width="751" height="469" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/scamdoc.png 887w, https://krebsonsecurity.com/wp-content/uploads/2023/06/scamdoc-768x480.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/scamdoc-782x488.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-63901" class="wp-caption-text">The ScamDoc fake reputation websites, which were apparently used to help make fake crypto investment platforms look more trustworthy. Image: Trend Micro.</p></div>
<p>According to the <strong>FBI</strong>, financial losses from cryptocurrency investment scams <a href="https://www.fbi.gov/contact-us/field-offices/springfield/news/internet-crime-complaint-center-releases-2022-statistics" target="_blank" rel="noopener">dwarfed losses for all other types of cybercrime in 2022</a>, rising from $907 million in 2021 to $2.57 billion last year.</p>


feed_id: https://krebsonsecurity.com/?p=63919
title: Barracuda Urges Replacing — Not Patching — Its Email Security Gateways
uri: Barracuda-Urges-Replacing-Not-Patching-Its-Email-Security-Gate
url:
https://krebsonsecurity.com/2023/06/barracuda-urges-replacing-not-patching-its-email-security-gateways/

content:
<p>It&#8217;s not often that a zero-day vulnerability causes a network security vendor to urge customers to physically remove and decommission an entire line of affected hardware &#8212; as opposed to just applying software updates. But experts say that is exactly what transpired this week with <strong>Barracuda Networks</strong>, as the company struggled to combat a sprawling malware threat which appears to have undermined its email security appliances in such a fundamental way that they can no longer be safely updated with software fixes.</p>
<div id="attachment_63921" style="width: 779px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63921" decoding="async" class="size-full wp-image-63921" src="media/c1a9b099.barracuda.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/barracuda.png" alt="" width="769" height="167" /><p id="caption-attachment-63921" class="wp-caption-text">The Barracuda Email Security Gateway (ESG) 900 appliance.</p></div>
<p>Campbell, Calif. based Barracuda said it hired incident response firm <strong>Mandiant</strong> on May 18 after receiving reports about unusual traffic originating from its <strong>Email Security Gateway</strong> (ESG) devices, which are designed to sit at the edge of an organization&#8217;s network and scan all incoming and outgoing email for malware.</p>
<p>On May 19, Barracuda identified that the malicious traffic was taking advantage of a previously unknown vulnerability in its ESG appliances, and on May 20 the company pushed a patch for the flaw to all affected appliances (<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-2868" target="_blank" rel="noopener">CVE-2023-2868</a>).</p>
<p>In <a href="https://www.barracuda.com/company/legal/esg-vulnerability" target="_blank" rel="noopener">its security advisory</a>, Barracuda said the vulnerability existed in the Barracuda software component responsible for screening attachments for malware. More alarmingly, the company said it appears attackers first started exploiting the flaw in October 2022.</p>
<p>But on June 6, Barracuda suddenly began urging its ESG customers to wholesale rip out and replace &#8212; not patch &#8212; affected appliances.</p>
<p>&#8220;Impacted ESG appliances must be immediately replaced regardless of patch version level,&#8221; the company&#8217;s advisory warned. &#8220;Barracuda&#8217;s recommendation at this time is full replacement of the impacted ESG.&#8221;</p>
<p><strong>Rapid7</strong>&#8216;s <strong>Caitlin Condon</strong> called this remarkable turn of events &#8220;fairly stunning,&#8221; and said there appear to be roughly 11,000 vulnerable ESG devices still connected to the Internet worldwide.</p>
<p>&#8220;The pivot from patch to total replacement of affected devices is fairly stunning and implies the malware the threat actors deployed somehow achieves persistence at a low enough level that even wiping the device wouldn’t eradicate attacker access,&#8221; Condon <a href="https://www.rapid7.com/blog/post/2023/06/08/etr-cve-2023-2868-total-compromise-of-physical-barracuda-esg-appliances/" target="_blank" rel="noopener">wrote</a>.<span id="more-63919"></span></p>
<p>Barracuda said the malware was identified on a subset of appliances that allowed the attackers persistent backdoor access to the devices, and that evidence of data exfiltration was identified on some systems.</p>
<p>Rapid7 said it has seen no evidence that attackers are using the flaw to move laterally within victim networks. But that may be small consolation for Barracuda customers now coming to terms with the notion that foreign cyberspies probably have been hoovering up all their email for months.</p>
<p><strong>Nicholas Weaver</strong>, a researcher at University of California, Berkeley&#8217;s <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a> (ICSI), said it is likely that the malware was able to corrupt the underlying firmware that powers the ESG devices in some irreparable way.</p>
<p>&#8220;One of the goals of malware is to be hard to remove, and this suggests the malware compromised the firmware itself to make it really hard to remove and really stealthy,&#8221; Weaver said. &#8220;That&#8217;s not a ransomware actor, that&#8217;s a state actor. Why? Because a ransomware actor doesn&#8217;t care about that level of access. They don&#8217;t need it. If they&#8217;re going for data extortion, it&#8217;s more like a smash-and-grab. If they&#8217;re going for data ransoming, they&#8217;re encrypting the data itself &#8212; not the machines.&#8221;</p>
<p>In addition to replacing devices, Barracuda says ESG customers should also rotate any credentials connected to the appliance(s), and check for signs of compromise dating back to at least October 2022 using the network and endpoint indicators the company has <a href="https://www.barracuda.com/company/legal/esg-vulnerability" target="_blank" rel="noopener">released publicly</a>.</p>


feed_id: https://krebsonsecurity.com/?p=63949
title: Microsoft Patch Tuesday, June 2023 Edition
uri: Microsoft-Patch-Tuesday-June-2023-Edition
url: https://krebsonsecurity.com/2023/06/microsoft-patch-tuesday-june-2023-edition/
content:
<p><strong>Microsoft Corp. </strong>today released software updates to fix dozens of security vulnerabilities in its <strong>Windows</strong> operating systems and other software. This month&#8217;s relatively light patch load has another added bonus for system administrators everywhere: It appears to be the first Patch Tuesday since March 2022 that isn&#8217;t marred by the active exploitation of a zero-day vulnerability in Microsoft&#8217;s products.</p>
<p><img decoding="async" class="aligncenter  wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="750" height="528" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>June&#8217;s Patch Tuesday features updates to plug at least 70 security holes, and while none of these are reported by Microsoft as exploited in-the-wild yet, Redmond has flagged several in particular as &#8220;more likely to be exploited.&#8221;</p>
<p>Top of the list on that front is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29357" target="_blank" rel="noopener">CVE-2023-29357</a>, which is a &#8220;critical&#8221; bug in <strong>Microsoft SharePoint Server</strong> that can be exploited by an unauthenticated attacker on the same network. This SharePoint flaw earned a CVSS rating of 9.8 (10.0 is the most dangerous).</p>
<p>&#8220;An attacker able to gain admin access to an internal SharePoint server could do a lot of harm to an organization,&#8221; said <strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>. &#8220;Gaining access to sensitive and privileged documents, stealing and deleting documents as part of a ransomware attack or replacing real documents with malicious copies to further infect users in the organization.&#8221;</p>
<p>There are at least three other vulnerabilities fixed this month that earned a collective 9.8 CVSS score, and they all concern a widely-deployed component called the <strong>Windows Pragmatic General Multicast</strong> (PGM), which is used for delivering multicast data &#8212; such as video streaming or online gaming.</p>
<p>Security firm <strong>Action1</strong> says all three bugs (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32015" target="_blank" rel="noopener">CVE-2023-32015</a>, <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32014" target="_blank" rel="noopener">CVE-2023-32014</a>, and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-29363" target="_blank" rel="noopener">CVE-2023-29363</a>) can be exploited over the network without requiring any privileges or user interaction, and affected systems include all versions of Windows Server 2008 and later, as well as Windows 10 and later.<span id="more-63949"></span></p>
<p>It wouldn&#8217;t be a proper Patch Tuesday if we also didn&#8217;t also have scary security updates for organizations still using <strong>Microsoft Exchange</strong> for email. Breen said this month&#8217;s Exchange bugs (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32031" target="_blank" rel="noopener">CVE-2023-32031</a> and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-28310" target="_blank" rel="noopener">CVE-2023-28310</a>) closely mirror the vulnerabilities identified as part of <a href="https://krebsonsecurity.com/2022/10/microsoft-patch-tuesday-october-2022-edition/" target="_blank" rel="noopener">ProxyNotShell exploits</a>, where an authenticated user in the network could exploit a vulnerability in the Exchange to gain code execution on the server.</p>
<p>Breen said while Microsoft&#8217;s patch notes indicate that an attacker must already have gained access to a vulnerable host in the network, this is typically achieved through social engineering attacks with spear phishing to gain initial access to a host before searching for other internal targets.</p>
<p>&#8220;Just because your Exchange server doesn&#8217;t have internet-facing authentication doesn’t mean it&#8217;s protected,&#8221; Breen said, noting that Microsoft says the Exchange flaws are not difficult for attackers to exploit.</p>
<p>For a closer look at the patches released by Microsoft today and indexed by severity and other metrics, check out the <a href="https://isc.sans.edu/diary/June%202023%20Microsoft%20Patch%20Tuesday/29942" target="_blank" rel="noopener">always-useful Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>As always, please consider backing up your system or at least your important documents and data before applying system updates. And if you run into any problems with these updates, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=63960
title: CISA Order Highlights Persistent Risk at Network Edge
uri: CISA-Order-Highlights-Persistent-Risk-at-Network-Edge
url: https://krebsonsecurity.com/2023/06/cisa-order-highlights-persistent-risk-at-network-edge/
content:
<p>The U.S. government agency in charge of improving the nation&#8217;s cybersecurity posture is ordering all federal agencies to take new measures to restrict access to Internet-exposed networking equipment. The directive comes amid a surge in attacks targeting previously unknown vulnerabilities in widely used security and networking appliances.</p>
<p><img decoding="async" class="aligncenter wp-image-63973" src="media/2ee884cd.networkedge.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/networkedge.png" alt="" width="749" height="497" /></p>
<p>Under <a href="https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02" target="_blank" rel="noopener">a new order</a> from the <strong>Cybersecurity and Infrastructure Security Agency</strong> (CISA), federal agencies will have 14 days to respond to any reports from CISA about misconfigured or Internet-exposed networking equipment. The directive applies to any networking devices &#8212; such as firewalls, routers and load balancers &#8212; that allow remote authentication or administration.</p>
<p>The order requires federal departments to limit access so that only authorized users on an agency&#8217;s local or internal network can reach the management interfaces of these devices. CISA&#8217;s mandate follows a slew of recent attacks wherein attackers exploited zero-day flaws in popular networking products to conduct ransomware and cyber espionage attacks on victim organizations.</p>
<p>Earlier today, incident response firm <strong>Mandiant</strong> <a href="https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally" target="_blank" rel="noopener">revealed</a> that since at least October 2022, Chinese cyber spies have been exploiting a zero-day vulnerability in many email security gateway (ESG) appliances sold by California-based <strong>Barracuda Networks</strong> to hoover up email from organizations using these devices.</p>
<p>Barracuda was alerted to the exploitation of a zero-day in its products in mid-May, and two days later the company pushed a security update to address the flaw in all affected devices. But last week, Barracuda took the <a href="https://krebsonsecurity.com/2023/06/barracuda-urges-replacing-not-patching-its-email-security-gateways/" target="_blank" rel="noopener">highly unusual step of offering to replace compromised ESGs</a>, evidently in response to malware that altered the systems in such a fundamental way that they could no longer be secured remotely with software updates.</p>
<p>According to Mandiant, a previously unidentified Chinese hacking group was responsible for exploiting the Barracuda flaw, and appeared to be searching through victim organization email records for accounts &#8220;belonging to individuals working for a government with political or strategic interest to [China] while this victim government was participating in high-level, diplomatic meetings with other countries.&#8221;</p>
<p>When security experts began raising the alarm about a possible zero-day in Barracuda&#8217;s products, the Chinese hacking group altered their tactics, techniques and procedures (TTPs) in response to Barracuda’s efforts to contain and remediate the incident, Mandiant found.</p>
<p>Mandiant said the attackers will continue to change their tactics and malware, &#8220;especially as network defenders continue to take action against this adversary and their activity is further exposed by the infosec community.&#8221;</p>
<p>Meanwhile, this week we learned more details about the ongoing exploitation of <a href="https://blog.lexfo.fr/xortigate-cve-2023-27997.html" target="_blank" rel="noopener">a zero-day flaw</a> in a broad range of virtual private networking (VPN) products made by <strong>Fortinet</strong> &#8212; devices many organizations rely on to facilitate remote network access for employees.</p>
<p>On June 11, Fortinet released a half-dozen security updates for its <strong>FortiOS</strong> firmware, including a weakness that researchers said allows an attacker to run malware on virtually any Fortinet SSL VPN appliance. The researchers <a href="https://www.bleepingcomputer.com/news/security/fortinet-fixes-critical-rce-flaw-in-fortigate-ssl-vpn-devices-patch-now/" target="_blank" rel="noopener">found</a> that just being able to reach the management interface for a vulnerable Fortinet SSL VPN appliance was enough to completely compromise the devices.</p>
<p>&#8220;This is reachable pre-authentication, on every SSL VPN appliance,&#8221; French vulnerability researcher <strong>Charles Fol</strong> tweeted. &#8220;Patch your #Fortigate.&#8221;<span id="more-63960"></span></p>
<p>In <a href="https://www.fortinet.com/blog/psirt-blogs/analysis-of-cve-2023-27997-and-clarifications-on-volt-typhoon-campaign" target="_blank" rel="noopener">details published on June 12</a>, Fortinet confirmed that one of the vulnerabilities (<a href="https://nvd.nist.gov/vuln/detail/CVE-2023-27997" target="_blank" rel="noopener">CVE-2023-27997</a>) is being actively exploited. The company said it discovered the weakness in an internal code audit that began in January 2023 &#8212; when it learned that Chinese hackers were exploiting <a href="https://www.bleepingcomputer.com/news/security/fortinet-zero-day-attacks-linked-to-suspected-chinese-hackers/" target="_blank" rel="noopener">a different zero-day flaw in its products</a>.</p>
<p><strong>Shodan.io</strong>, the search engine made for finding Internet of Things devices, <a href="https://www.shodan.io/search?query=http.html_hash%3A-1454941180" target="_blank" rel="noopener">reports</a> that there are currently more than a half-million vulnerable Fortinet devices reachable via the public Internet.</p>
<p>The new cybersecurity directive from CISA orders agencies to remove any networking device management interfaces from the internet by making them only accessible from an internal enterprise network (CISA recommends an isolated management network). CISA also says agencies should &#8220;deploy capabilities, as part of a Zero Trust Architecture, that enforce access control to the interface through a policy enforcement point separate from the interface itself (preferred action).&#8221;</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-63974" src="media/b78ffc18.cisa-directive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/cisa-directive.png" alt="" width="749" height="364" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/cisa-directive.png 885w, https://krebsonsecurity.com/wp-content/uploads/2023/06/cisa-directive-768x373.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/cisa-directive-782x380.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Security experts say CISA&#8217;s directive highlights the reality that cyberspies and ransomware gangs are making it increasingly risky for organizations to expose <em>any</em> devices to the public Internet, because these groups have strong incentives to probe such devices for previously unknown security vulnerabilities.</p>
<p>The most glaring example of this dynamic can be seen in the frequency with which ransomware groups have discovered and pounced on zero-day flaws in widely-used file-transfer protocol (FTP) applications. One ransomware gang in particular &#8212; <strong>Cl0p</strong> &#8212; has repeatedly exploited zero day bugs in various FTP appliances to extort tens of millions of dollars from hundreds of ransomware victims.</p>
<p>On February 2, KrebsOnSecurity <a href="https://infosec.exchange/@briankrebs/109795710941843934" target="_blank" rel="noopener">broke the news</a> that attackers were exploiting a zero-day vulnerability in the <strong>GoAnywhere</strong> FTP appliance by <strong>Fortra</strong>. By the time security updates were available to fix the vulnerability, Cl0p had already used it to steal data from more than a hundred organizations running Fortra&#8217;s FTP appliance.</p>
<p>According to <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-158a" target="_blank" rel="noopener">CISA</a>, on May 27, Cl0p began exploiting a previously unknown flaw in <strong>MOVEit Transfer</strong>, a popular Internet-facing file transfer application. MOVEit parent <strong>Progress Software </strong>has since released security updates to address the weakness, but Cl0p <a href="https://cybernews.com/news/cl0p-moveit-ransom-attack-victims-names/" target="_blank" rel="noopener">claims</a> to have already used it to compromise hundreds of victim organizations. <em>TechCrunch</em> has been tracking <a href="https://techcrunch.com/2023/06/15/moveit-clop-mass-hacks-banks-universities/?guccounter=1&amp;guce_referrer=aHR0cHM6Ly93d3cuZ29vZ2xlLmNvbS8&amp;guce_referrer_sig=AQAAAN2EdiwMa23CwN_b4QGjL9fg7SNLyiezaEEUr6fkUR-VtZ8xP-edJiwyyIvTC3swX7HbkHmVC_41MNuHGmYRBWjp39p5PtGJix3vCaabYJ35t4_EhCCYHz9jXLCaJIcFVzaW755UsM_stA2MT2VnTyzZ_Y1TI-K2LzbUZ_ooTwTu" target="_blank" rel="noopener">the fallout from victim organizations</a>, which range from banks and insurance providers to universities and healthcare entities.</p>
<p>The always on-point weekly security news podcast <em>Risky Business</em> has recently been urging organizations to jettison any and all FTP appliances, noting that Cl0p (or another crime gang) is likely to visit the same treatment on other FTP appliance vendors.</p>
<p>But that sound advice doesn&#8217;t exactly scale for mid-tier networking devices like Barracuda ESGs or Fortinet SSL VPNs, which are particularly prominent in small to mid-sized organizations.</p>
<p>&#8220;It&#8217;s not like FTP services, you can&#8217;t tell an enterprise [to] turn off the VPN [because] the productivity hit of disconnecting the VPN is terminal, it&#8217;s a non-starter,&#8221; Risky Business co-host <strong>Adam Boileau</strong> said on <a href="https://risky.biz/RBNEWS159/" target="_blank" rel="noopener">this week&#8217;s show</a>. &#8220;So how to mitigate the impact of having to use a domain-joined network appliance at the edge of your network that is going to get zero-day in it? There&#8217;s no good answer.&#8221;</p>
<p>Risky Business founder <strong>Patrick Gray</strong> said the COVID-19 pandemic breathed new life into entire classes of networking appliances that rely on code which was never designed with today&#8217;s threat models in mind.</p>
<p>&#8220;In the years leading up to the pandemic, the push towards identity-aware proxies and zero trust everything and moving away from this type of equipment was gradual, but it was happening,&#8221; Gray said. &#8220;And then COVID-19 hit and everybody had to go work from home, and there really was one option to get going quickly &#8212; which was to deploy VPN concentrators with enterprise features.&#8221;</p>
<p>Gray said the security industry had been focused on building the next generation of remote access tools that are more security-hardened, but when the pandemic hit organizations scrambled to cobble together whatever they could.</p>
<p>&#8220;The only stuff available in the market was all this old crap that is not QA&#8217;d properly, and every time you shake them CVEs fall out,&#8221; Gray remarked, calling the pandemic, &#8220;a shot in the arm&#8221; to companies like Fortinet and Barracuda.</p>
<p>&#8220;They sold so many VPNs through the pandemic and this is the hangover,&#8221; Gray said. &#8220;COVID-19 extended the life of these companies and technologies, and that&#8217;s unfortunate.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=63993
title: Why Malware Crypting Services Deserve More Scrutiny
uri: Why-Malware-Crypting-Services-Deserve-More-Scrutiny
url: https://krebsonsecurity.com/2023/06/why-malware-crypting-services-deserve-more-scrutiny/
content:
<p><img decoding="async" class="aligncenter wp-image-64012" src="media/0ddb2f9b.bwhatglass.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/bwhatglass.png" alt="" width="750" height="549" /></p>
<p>If you operate a cybercrime business that relies on disseminating malicious software, you probably also spend a good deal of time trying to disguise or &#8220;crypt&#8221; your malware so that it appears benign to antivirus and security products. In fact, the process of &#8220;crypting&#8221; malware is sufficiently complex and time-consuming that most serious cybercrooks will outsource this critical function to a handful of trusted third parties. This story explores the history and identity behind <strong>Cryptor[.]biz</strong>, a long-running crypting service that is trusted by some of the biggest names in cybercrime.</p>
<p>Virtually all malware that is deployed for use in data stealing at some point needs to be crypted. This highly technical, laborious process involves iteratively altering the appearance and behavior of a malicious file until it no longer sets off alarm bells when scanned by different antivirus tools.</p>
<p>Experienced malware purveyors understand that if they&#8217;re not continuously crypting their malware before sending it out, then a lot more of whatever digital disease they are trying to spread is going to get flagged by security tools. In short, if you are running a cybercrime enterprise and you&#8217;re not equipped to handle this crypting process yourself, you probably need to pay someone else to do it for you.</p>
<p>Thanks to the high demand for reliable crypting services, there are countless cybercriminals who&#8217;ve hung out their shingles as crypting service providers. However, most of these people do not appear to be very good at what they do, because most are soon out of business.</p>
<p>One standout is Cryptor[.]biz. This service is actually recommended by the purveyors of the <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer" target="_blank" rel="noopener">RedLine information stealer malware</a>, which is a popular and powerful malware kit that specializes in stealing victim data and is often used to lay the groundwork for ransomware attacks. Cryptor[.]biz also has been recommended to customers of the <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.predator" target="_blank" rel="noopener">Predator information stealer malware family</a> (via the malware&#8217;s Telegram support channels).<span id="more-63993"></span></p>
<h2>WHO RUNS CRYPTOR[.]BIZ?</h2>
<p>As good as Cryptor[.]biz may be at obfuscating malware, its proprietor does not appear to have done a great job covering his own tracks. The registration records for the website Cryptor[.]biz are hidden behind privacy protection services, but the site&#8217;s homepage says potential customers should register by visiting the domain <strong>crypt[.]guru</strong>, or by sending a Jabber instant message to the address &#8220;<strong>masscrypt@exploit.im</strong>.&#8221;</p>
<p>Crypt[.]guru&#8217;s registration records also are hidden, yet <a href="https://securitytrails.com/blog/passive-dns" target="_blank" rel="noopener">passive domain name system (DNS) records</a> for both cryptor[.]biz and crypt[.]guru show that in 2018 the domains were forwarding incoming email to the address <strong>obelisk57@gmail.com</strong>.</p>
<p>Cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> reports that obelisk57@gmail.com was used to register an account on the forum <strong>Blacksoftware</strong> under the nickname &#8220;<strong>Kerens</strong>.&#8221; Meanwhile, the Jabber address masscrypt@exploit.im has been associated with the user Kerens on the Russian hacking forum <strong>Exploit</strong> from 2011 to the present day.</p>
<div id="attachment_63999" style="width: 592px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63999" decoding="async" loading="lazy" class="size-full wp-image-63999" src="media/d65c77e1.cryptorbiz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/cryptorbiz.png" alt="" width="582" height="426" /><p id="caption-attachment-63999" class="wp-caption-text">The login page for Cryptor dot biz contains several clues about who runs the service.</p></div>
<p>The very first post by Kerens on Exploit in 2011 was a negative review of a popular crypting service that predated Cryptor[.]biz called <strong>VIP Crypt</strong>, which Kerens accused of being &#8220;shitty&#8221; and unreliable. But Intel 471 finds that after his critical review of VIP Crypt, Kerens did not post publicly on Exploit again for another four years until October 2016, when they suddenly began advertising Cryptor[.]biz.</p>
<p>Intel 471 found that Kerens used the email address <strong>pepyak@gmail.com</strong>, which also was used to register Kerens accounts on the Russian language hacking forums <strong>Verified</strong> and <strong>Damagelab.</strong></p>
<p>Ironically, Verified has itself been hacked multiple times over the years, with its private messages and user registration details leaked online. Those records indicate the user Kerens registered on Verified in March 2009 from an Internet address in Novosibirsk, a city in the southern Siberian region of Russia.</p>
<p>In 2010, someone with the username Pepyak on the Russian language affiliate forum <strong>GoFuckBiz[.]com</strong> shared that they typically split their time during the year between living in Siberia (during the milder months) and Thailand (when Novosibirsk is typically -15 °C/°5F).</p>
<p>For example, in one conversation about the best car to buy for navigating shoddy roads, Pepyak declared, &#8220;We have shitty roads in Siberia.&#8221; In January 2010, Pepyak asked the GoFuckBiz community where one might find a good USB-based modem in Phuket, Thailand.</p>
<p>DomainTools.com says the email address pepyak@gmail.com was used to register 28 domain names over the years, including a now-defunct Russian automobile sales website called &#8220;<strong>autodoska[.]biz</strong>.&#8221; DomainTools shows this website was registered in 2008 to a <strong>Yuri Churnov</strong> from Sevastpol, Crimea (prior to Russia&#8217;s annexation of Crimea in 2014, the peninsula was part of Ukraine).</p>
<p>The WHOIS records for autodoska[.]biz were changed in 2010 to <strong>Sergey Purtov</strong> (pepyak@gmail.com) from Yurga, a town in Russia&#8217;s <a href="https://en.wikivoyage.org/wiki/Kemerovo_Oblast" target="_blank" rel="noopener">Kemerovo Oblast</a>, which is a relatively populous area in Western Siberia that is adjacent to Novosibirsk.</p>
<div id="attachment_64022" style="width: 760px" class="wp-caption aligncenter"><a href="media/72594089.no-yur-kem.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/no-yur-kem.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64022" decoding="async" loading="lazy" class="wp-image-64022" src="media/72594089.no-yur-kem.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/no-yur-kem.png" alt="" width="750" height="453" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/no-yur-kem.png 1013w, https://krebsonsecurity.com/wp-content/uploads/2023/06/no-yur-kem-768x464.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/no-yur-kem-782x472.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-64022" class="wp-caption-text">A satellite view of the region including Novosibirsk, Yurga and Kemerovo Oblast. Image: Google Maps.</p></div>
<p>Many of the 28 domains registered to pepyak@gmail.com have another email address in their registration records: <strong>unforgiven57@mail.ru</strong>. According to DomainTools, the Unforgiven email address was used to register roughly a dozen domains, including three that were originally registered to Keren&#8217;s email address &#8212; pepyak@gmail.com (e.g., antivirusxp09[.]com).</p>
<p>One of the domains registered in 2006 to the address unforgiven57@mail.ru was <strong>thelib[.]ru</strong>, which for many years was a place to download pirated e-books. DomainTools says thelib[.]ru was originally registered to a <strong>Sergey U Purtov</strong>.</p>
<p>Most of the two-dozen domains registered to pepyak@gmail.com shared a server at one point with a small number of other domains, including <strong>mobile-soft[.]su</strong>, which was registered to the email address <strong>spurtov@gmail.com</strong>.</p>
<p><strong>CDEK</strong>, an express delivery company based in Novosibirsk, was apparently hacked at some point because cyber intelligence firm <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> found that its database shows the email address spurtov@gmail.com was assigned to a <strong>Sergey Yurievich Purtov</strong> (Сергей Юрьевич Пуртов).</p>
<p class="p1">DomainTools says the same phone number in the registration records for autodoska[.]biz (<strong>+7.9235059268</strong>) was used to secure two other domains &#8212; <strong>bile[.]ru</strong> and <strong>thelibrary[.]ru</strong>, both of which were registered to a <strong>Sergey Y Purtov</strong>.</p>
<p class="p1"><img decoding="async" loading="lazy" class="alignright wp-image-63998" src="media/da82ed01.pepyakskype.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/pepyakskype.png" alt="" width="258" height="343" />A search on the phone number 79235059268 in <strong>Skype</strong> reveals these digits belong to a &#8220;Sergey&#8221; from Novosibirsk with the now-familiar username  &#8212; Pepyak.</p>
<p>Bringing things full circle, Constella Intelligence shows that various online accounts tied to the email address unforgiven57@mail.ru frequently relied on the somewhat unique password, &#8220;<strong>plk139t51z</strong>.&#8221; Constella says that same password was used for just a handful of other email addresses, including <strong>gumboldt@gmail.com</strong>.</p>
<p>Hacked customer records from CDEK show gumboldt@gmail.com was tied to a customer named <strong>Sergey Yurievich Purtov</strong>. DomainTools found that virtually all of the 15 domain names registered to gumboldt@gmail.com (including the aforementioned mobile-soft[.]su) were at one point registered to spurtov@gmail.com.</p>
<p>Intel 471 reports that gumboldt@gmail.com was used in 2009 to register a user by the nickname &#8220;<strong>Kolumb</strong>&#8221; on the Russian hacking forum Antichat. From Kolumb&#8217;s posts on Antichat, it seems this user was mostly interested in buying access to compromised computers inside of Russia.</p>
<p>Then in December 2009, Kolumb said they were in desperate need of a reliable crypting service or full-time cryptor.</p>
<p>&#8220;We need a person who will crypt software every day, sometimes even a couple of times a day,&#8221; Kolumb wrote on Antichat.</p>
<p>Mr. Purtov did not respond to requests for comment sent to any of the email addresses referenced in this report. Mail.ru responded that the email address spurtov@mail.ru is no longer active.</p>
<h2>ANALYSIS</h2>
<p>As KrebsOnSecurity <a href="https://infosec.exchange/@briankrebs/110572085317709900" target="_blank" rel="noopener">opined on Mastodon earlier this week</a>, it makes a lot of sense for cybersecurity researchers and law enforcement alike to focus attention on the top players in the crypting space &#8212; for several reasons. Most critically, the cybercriminals offering time-tested crypting services also tend to be among the most experienced and connected malicious coders on the planet.</p>
<p>Think of it this way: By definition, a crypting service scans and examines all types of malware <em>before</em> those new nasties are first set loose in the wild. This fact alone should make these criminal enterprises a primary target of cybersecurity firms looking to gain more timely intelligence about new malware.</p>
<p>Also, a review of countless posts and private messages from Pepyak and other crypting providers shows that a successful crypting service will have direct and frequent contact with some of the world&#8217;s most advanced malware authors.</p>
<p>In short, infiltrating or disrupting a trusted crypting service can be an excellent way to slow down or even sideline a large number of cybercrime operations all at once.</p>
<p>Further reading on the crypting industry:</p>
<p><a href="https://krebsonsecurity.com/2020/05/this-service-helps-malware-authors-fix-flaws-in-their-code/" target="_blank" rel="noopener">This Service Helps Malware Authors Fix Flaws in Their Code</a><br />
<a href="https://krebsonsecurity.com/2014/05/antivirus-is-dead-long-live-antivirus/" target="_blank" rel="noopener">Antivirus is Dead: Long Live Antivirus!</a></p>


feed_id: https://krebsonsecurity.com/?p=64033
title: SMS Phishers Harvested Phone Numbers, Shipment Data from UPS Tracking Tool
uri: SMS-Phishers-Harvested-Phone-Numbers-Shipment-Data-from-UPS-Tracking
url:
https://krebsonsecurity.com/2023/06/sms-phishers-harvested-phone-numbers-shipment-data-from-ups-tracking-tool/

content:
<p>The<strong> United Parcel Service</strong> (UPS) says fraudsters have been harvesting phone numbers and other information from its online shipment tracking tool in Canada to send highly targeted SMS phishing (a.k.a. &#8220;smishing&#8221;) messages that spoofed UPS and other top brands. The missives addressed recipients by name, included details about recent orders, and warned that those orders wouldn&#8217;t be shipped unless the customer paid an added delivery fee.</p>
<p>In a snail mail letter sent this month to Canadian customers, <strong>UPS Canada Ltd.</strong> said it is aware that some package recipients have received fraudulent text messages demanding payment before a package can be delivered, and that it has been working with partners in its delivery chain to try to understand how the fraud was occurring.</p>
<div id="attachment_64038" style="width: 310px" class="wp-caption alignright"><a href="media/a3c53ae2.ups-smishing-letter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/ups-smishing-letter.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64038" decoding="async" class="wp-image-64038" src="media/a3c53ae2.ups-smishing-letter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/ups-smishing-letter.png" alt="" width="300" height="400" /></a><p id="caption-attachment-64038" class="wp-caption-text">The recent letter from UPS about SMS phishers harvesting shipment details and phone numbers from its website.</p></div>
<p>&#8220;During that review, UPS discovered a method by which a person who searched for a particular package or misused a package look-up tool could obtain more information about the delivery, potentially including a recipient&#8217;s phone number,&#8221; the letter reads. &#8220;Because this information could be misused by third parties, including potentially in a smishing scheme, UPS has taken steps to limit access to that information.&#8221;</p>
<p>The written notice goes on to say UPS believes the data exposure &#8220;affected packages for a small group of shippers and some of their customers from February 1, 2022 to April 24, 2023.&#8221;</p>
<p>As early as April 2022, KrebsOnSecurity began receiving tips from Canadian readers who were puzzling over why they&#8217;d just received one of these SMS phishing messages that referenced information from a recent order they&#8217;d legitimately placed at an online retailer.</p>
<p>In March, 2023, a reader named <strong>Dylan</strong> from British Columbia wrote in to say he&#8217;d received one of these shipping fee scam messages not long after placing an order to buy gobs of building blocks directly from Lego.com. The message included his full name, phone number, and postal code, and urged him to click a link to <strong>mydeliveryfee-ups[.]info</strong> and pay a $1.55 delivery fee that was supposedly required to deliver his Legos.</p>
<p>&#8220;From searching the text of this phishing message, I can see that a lot of people have experienced this scam, which is more convincing because of the information the phishing text contains,&#8221; Dylan wrote. &#8220;It seems likely to me that UPS is leaking information somehow about upcoming deliveries.&#8221;</p>
<p>Josh is a reader who works for a company that ships products to Canada, and in early January 2023 he inquired whether there was any information about a breach at UPS Canada.</p>
<p>&#8220;We&#8217;ve seen many of our customers targeted with a fraudulent UPS text message scheme after placing an order,&#8221; Josh said. &#8220;A link is provided (often only after the customer responds to the text) which takes you to a captcha page, followed by a fraudulent payment collection page.&#8221;</p>
<p>Pivoting on the domain in the smishing message sent to Dylan shows the phishing domain shared an Internet host in Russia [91.215.85-166] with nearly two dozen other smishing related domains, including <strong>upsdelivery[.]info</strong>, <strong>legodelivery[.]info</strong>, <strong>adidascanadaltd[.]com</strong>, <strong>crocscanadafee[.]info</strong>, <strong>refw0234apple[.]info, </strong><strong>vista-printcanada[.]info</strong> and <strong>telus-ca[.]info</strong>.</p>
<p>The inclusion of big-name brands in the domains of these UPS smishing campaigns suggests the perpetrators had the ability to focus their lookups on UPS customers who had recently ordered items from specific companies.</p>
<p>Attempts to visit these domains with a web browser failed, but loading them in a mobile device (or in my case, emulating a mobile device using a virtual machine and <a href="https://firefox-source-docs.mozilla.org/devtools-user/" target="_blank" rel="noopener">Developer Tools in Firefox</a>) revealed the first stage of this smishing attack. As Josh mentioned, what first popped up was a <a href="https://en.wikipedia.org/wiki/CAPTCHA" target="_blank" rel="noopener">CAPTCHA</a>; after the visitor solved the CAPTCHA, they were taken through several more pages that requested the user&#8217;s full name, date of birth, credit card number, address, email and phone number.</p>
<div id="attachment_64037" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64037" decoding="async" loading="lazy" class=" wp-image-64037" src="media/30901253.upssmish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/upssmish.png" alt="" width="751" height="522" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/upssmish.png 1070w, https://krebsonsecurity.com/wp-content/uploads/2023/06/upssmish-768x534.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/upssmish-782x544.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/06/upssmish-100x70.png 100w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-64037" class="wp-caption-text">A smishing website targeting Canadians who recently purchased from Adidas online. The site would only load in a mobile browser.</p></div>
<p>In April 2022, KrebsOnSecurity heard from Alex, the CEO of a technology company in Canada who asked to leave his last name out of this story. Alex reached out when he began receiving the smishing messages almost immediately after ordering two sets of <strong>Airpods</strong> directly from Apple&#8217;s website.</p>
<p>What puzzled Alex most was that he&#8217;d instructed Apple to send the Airpods as a gift to two different people, and less than 24 hours later the phone number he uses for his Apple account received two of the phishing messages, both of which contained salutations that included the names of the people for whom he&#8217;d bought Airpods.</p>
<p>&#8220;I&#8217;d put the recipient as different people on my team, but because it was my phone number on both orders I was the one getting the texts,&#8221; Alex explained. &#8220;That same day, I got text messages referring to me as two different people, neither of whom were me.&#8221;<span id="more-64033"></span></p>
<p>Alex said he believes UPS Canada either doesn&#8217;t fully understand what happened yet, or it is being coy about what it knows. He said the wording of UPS&#8217;s response misleadingly suggests the smishing attacks were somehow the result of hackers randomly looking up package information via the company&#8217;s tracking website.</p>
<p>Alex said it&#8217;s likely that whoever is responsible figured out how to query the UPS Canada website for only pending orders from specific brands, perhaps by exploiting some type of application programming interface (API) that UPS Canada makes or made available to its biggest retail partners.</p>
<p>&#8220;It wasn&#8217;t like I put the order through [on Apple.ca] and some days or weeks later I got a targeted smishing attack,&#8221; he said. &#8220;It was more or less the same day. And it was as if [the phishers] were being notified the order existed.&#8221;</p>
<p>The letter to UPS Canada customers does not mention whether any other customers in North America were affected, and it remains unclear whether any UPS customers outside of Canada may have been targeted.</p>
<p>In a statement provided to KrebsOnSecurity, Sandy Springs, Ga. based <strong>UPS</strong> [<a href="https://www.nyse.com/quote/XNYS:UPS" target="_blank" rel="noopener">NYSE:UPS</a>] said the company has been working with partners in the delivery chain to understand how that fraud was being perpetrated, as well as with law enforcement and third-party experts to identify the cause of this scheme and to put a stop to it.</p>
<p>&#8220;Law enforcement has indicated that there has been an increase in smishing impacting a number of shippers and many different industries,&#8221; reads an email from <strong>Brian Hughes</strong>, director of financial and strategy communications at UPS.</p>
<p>&#8220;Out of an abundance of caution, UPS is sending privacy incident notification letters to individuals in Canada whose information may have been impacted,&#8221; Hughes said. &#8220;We encourage our customers and general consumers to learn about the ways they can stay protected against attempts like this by visiting the <a href="https://www.ups.com/ms/en/help-center/legal-terms-conditions/fight-fraud.page" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://www.ups.com/ms/en/help-center/legal-terms-conditions/fight-fraud.page&amp;source=gmail&amp;ust=1687528910308000&amp;usg=AOvVaw3E_2zF78eVyvKvTuUwbD5G">UPS Fight Fraud website</a>.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=64057
title: U.K. Cyber Thug “PlugwalkJoe” Gets 5 Years in Prison
uri: U-K-Cyber-Thug-PlugwalkJoe-Gets-5-Years-in-Prison
url: https://krebsonsecurity.com/2023/06/u-k-cyber-thug-plugwalkjoe-gets-5-years-in-prison/
content:
<p><strong>Joseph James &#8220;PlugwalkJoe&#8221; O&#8217;Connor</strong>, a 24-year-old from the United Kingdom who earned his 15 minutes of fame by participating in the July 2020 hack of <strong>Twitter</strong>, has been sentenced to five years in a U.S. prison. That may seem like harsh punishment for a brief and very public cyber joy ride. But O&#8217;Connor also pleaded guilty in a separate investigation involving a years-long spree of cyberstalking and cryptocurrency theft enabled by &#8220;<strong>SIM swapping</strong>,&#8221; a crime wherein fraudsters trick a mobile provider into diverting a customer&#8217;s phone calls and text messages to a device they control.</p>
<div id="attachment_56400" style="width: 263px" class="wp-caption alignright"><img aria-describedby="caption-attachment-56400" decoding="async" class="size-full wp-image-56400" src="media/4f795f9c.plugwalkjoe.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/plugwalkjoe.png" alt="" width="253" height="386" /><p id="caption-attachment-56400" class="wp-caption-text">Joseph &#8220;PlugwalkJoe&#8221; O&#8217;Connor, in a photo from a Globe Newswire press release Sept. 02, 2020, pitching O&#8217;Connor as a cryptocurrency expert and advisor.</p></div>
<p>On July 16, 2020 &#8212; the day after some of Twitter&#8217;s most recognizable and popular users had their accounts hacked and used to tweet out a bitcoin scam &#8212;  KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/07/whos-behind-wednesdays-epic-twitter-hack/" target="_blank" rel="noopener">observed</a> that several social media accounts tied to O&#8217;Connor appeared to have inside knowledge of the intrusion. That story also noted that thanks to COVID-19 lockdowns at the time, O&#8217;Connor was stuck on an indefinite vacation at a popular resort in Spain.</p>
<p>Not long after the Twitter hack, O’Connor was quoted in <em>The New York Times</em> denying any involvement. “I don’t care,” O’Connor told The Times. “They can come arrest me. I would laugh at them. I haven’t done anything.”</p>
<p>Speaking with KrebsOnSecurity via Instagram instant message just days after the Twitter hack, PlugwalkJoe demanded that his real name be kept out of future blog posts here. After he was told that couldn’t be promised, he remarked that some people in his circle of friends had been known to hire others to deliver physical beatings on people they didn’t like.</p>
<p>O&#8217;Connor was still in Spain a year later when prosecutors in the Northern District of California <a href="https://krebsonsecurity.com/2021/07/plugwalkjoe-does-the-perp-walk/" target="_blank" rel="noopener">charged him with conspiring to hack Twitter</a>. At the same time, prosecutors in the Southern District of New York charged O&#8217;Connor with an impressive array of cyber offenses involving the exploitation of social media accounts, online extortion, and cyberstalking, and the theft of cryptocurrency then valued at nearly USD $800,000.</p>
<p>In late April 2023, O&#8217;Connor was extradited from Spain to face charges in the United States. Two weeks later, he entered guilty pleas in both California and New York, admitting to all ten criminal charges levied against him. On June 23, O&#8217;Connor was <a href="https://www.justice.gov/usao-sdny/pr/uk-citizen-sentenced-five-years-prison-cybercrime-offenses" target="_blank" rel="noopener">sentenced to five years in prison</a>.</p>
<p>PlugwalkJoe was part of a community that specialized in SIM-swapping victims to take over their online identities. <a href="https://krebsonsecurity.com/tag/sim-swapping/" target="_blank" rel="noopener">Unauthorized SIM swapping</a> is a scheme in which fraudsters trick or bribe employees at wireless phone companies into redirecting the target’s text messages and phone calls to a device they control. </p>
<p>From there, the attackers can reset the password for any of the victim&#8217;s online accounts that allow password resets via SMS. SIM swapping also lets attackers intercept one-time passwords needed for SMS-based multi-factor authentication (MFA).</p>
<p>O&#8217;Connor admitted to conducting SIM swapping attacks to take control over financial accounts tied to several cryptocurrency executives in May 2019, and to stealing digital currency currently valued at more than $1.6 million.</p>
<p>PlugwalkJoe also copped to SIM-swapping his way into the Snapchat accounts of several female celebrities and threatening to release nude photos found on their phones.</p>
<p>Victims who refused to give up social media accounts or submit to extortion demands were often visited with &#8220;swatting attacks,&#8221; wherein O&#8217;Connor and others would falsely report a shooting or hostage situation in the hopes of tricking police into visiting potentially lethal force on a target&#8217;s address.</p>
<p>Prosecutors said O’Connor even swatted and cyberstalked a 16-year-old girl, sending her nude photos and threatening to rape and/or murder her and her family.<span id="more-64057"></span></p>
<p>In the case of the Twitter hack, O&#8217;Connor pleaded guilty to conspiracy to commit computer intrusions, conspiracy to commit wire fraud, and conspiracy to commit money laundering.</p>
<div id="attachment_52283" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-52283" decoding="async" loading="lazy" class=" wp-image-52283" src="media/ddea8d43.shinji-r-580x373.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r-580x373.png" alt="" width="749" height="482" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r-580x373.png 580w, https://krebsonsecurity.com/wp-content/uploads/2020/07/shinji-r.png 651w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-52283" class="wp-caption-text">The account &#8220;@shinji,&#8221; a.k.a. &#8220;PlugWalkJoe,&#8221; tweeting a screenshot of Twitter&#8217;s internal tools interface, on July 15, 2020.</p></div>
<p>To resolve the case against him in New York, O&#8217;Connor pleaded guilty to conspiracy to commit computer intrusion, two counts of committing computer intrusions, making extortive communications, two counts of stalking, and making threatening communications.</p>
<p>In addition to the prison term, O&#8217;Connor was sentenced to three years of supervised release, and ordered to pay $794,012.64 in forfeiture.</p>
<p>To be clear, the Twitter hack of July 2020 did not involve SIM-swapping. Rather, Twitter said the intruders tricked a Twitter employee over the phone into providing access to internal tools.</p>
<p><a href="https://krebsonsecurity.com/2020/07/three-charged-in-july-15-twitter-compromise/" target="_blank" rel="noopener">Three others were charged</a> along with O&#8217;Connor in the Twitter compromise. The alleged mastermind of the hack, then 17-year-old <strong>Graham Ivan Clarke</strong> from Tampa, Fla., <a href="https://www.tampabay.com/news/crime/2021/03/16/tampa-twitter-hacker-agrees-to-three-years-in-prison-in-plea-deal/" target="_blank" rel="noopener">pleaded guilty in 2021</a> and agreed to serve three years in prison, followed by three years probation.</p>
<p>This story is good reminder about the need to <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" rel="noopener" target="_blank">minimize your reliance on the mobile phone companies</a> for securing your online identity. This means reducing the number of ways your life could be turned upside down if someone were to <a href="https://krebsonsecurity.com/2023/02/hackers-claim-they-breached-t-mobile-more-than-100-times-in-2022/" rel="noopener" target="_blank">hijack your mobile phone number</a>.</p>
<p>Most online services require users to validate a mobile phone number as part of setting up an account, but some services will let you remove your phone number after the fact. Those services that do you let you remove your phone number or disable SMS/phone calls for account recovery probably also offer more secure multi-factor authentication options, such as app-based one-time passwords and <a href="https://krebsonsecurity.com/2019/04/android-7-0-phones-can-now-double-as-google-security-keys/" rel="noopener" target="_blank">security keys</a>. Check out <a href="https://2fa.directory/us/" rel="noopener" target="_blank">2fa.directory</a> for a list of multi-factor options available across hundreds of popular sites and services.</p>


feed_id: https://krebsonsecurity.com/?p=64079
title: Russian Cybersecurity Executive Arrested for Alleged Role in 2012 Megahacks
uri: Russian-Cybersecurity-Executive-Arrested-for-Alleged-Role-in-2012-Mega
url:
https://krebsonsecurity.com/2023/06/russian-cybersecurity-executive-arrested-for-alleged-role-in-2012-megahacks/

content:
<p><strong>Nikita Kislitsin</strong>, formerly the head of network security for one of Russia&#8217;s top cybersecurity firms, was arrested last week in Kazakhstan in response to 10-year-old hacking charges from the U.S. Department of Justice. Experts say Kislitsin&#8217;s prosecution could soon put the Kazakhstan government in a sticky diplomatic position, as the Kremlin is already signaling that it intends to block his extradition to the United States.</p>
<div id="attachment_64086" style="width: 326px" class="wp-caption alignright"><img aria-describedby="caption-attachment-64086" decoding="async" class=" wp-image-64086" src="media/a0668127.kislitsin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/kislitsin.png" alt="" width="316" height="255" /><p id="caption-attachment-64086" class="wp-caption-text">Nikita Kislitsin, at a security conference in Russia.</p></div>
<p>Kislitsin is accused of hacking into the now-defunct social networking site <strong>Formspring</strong> in 2012, and conspiring with another Russian man convicted of stealing tens of millions of usernames and passwords from <strong>LinkedIn</strong> and <strong>Dropbox</strong> that same year.</p>
<p>In March 2020, the DOJ unsealed two criminal hacking indictments against Kislitsin, who was then head of security at <strong>Group-IB</strong>, a cybersecurity company that was founded in Russia in 2003 and operated there for more than a decade before relocating to Singapore.</p>
<p>Prosecutors in Northern California indicted Kislitsin in 2014 for his alleged role in stealing account data from Formspring. Kislitsin also was indicted in Nevada in 2013, but the Nevada indictment does not name his alleged victim(s) in that case.</p>
<p>However, documents unsealed in the California case indicate Kislitsin allegedly conspired with <strong>Yevgeniy Nikulin</strong>, a Russian man <a href="https://www.justice.gov/usao-ndca/pr/russian-hacker-sentenced-over-7-years-prison-hacking-three-bay-area-tech-companies" target="_blank" rel="noopener">convicted in 2020</a> of stealing 117 million usernames and passwords from Dropbox, Formspring and LinkedIn in 2012. Nikulin is currently serving a seven-year sentence in the U.S. prison system.</p>
<p>As first reported by <a href="https://cyberscoop.com/nikulin-trial-linkedin-oleksandr-ieremenko/" target="_blank" rel="noopener">Cyberscoop</a> in 2020, <a href="https://www.documentcloud.org/documents/6793888-Nikulin-pre-trial-filing-alleging-Ieremenko.html%E2%80%9D%20responsive=true" target="_blank" rel="noopener">a trial brief</a> in the California investigation identified Nikulin, Kislitsin and two alleged cybercriminals &#8212; <strong>Oleg Tolstikh</strong> and <strong>Oleksandr Vitalyevich Ieremenko</strong> &#8212; as being present during a 2012 meeting at a Moscow hotel, where participants allegedly discussed starting an internet café business.</p>
<p>A 2010 indictment out of New Jersey accuses Ieremenko and six others with siphoning nonpublic information from the <strong>U.S. Securities &amp; Exchange Commission</strong> (SEC) and public relations firms, and making $30 million in illegal stock trades based on the proprietary information they stole.</p>
<p>[The <strong>U.S. Secret Service</strong> has <a href="https://www.secretservice.gov/investigation/mostwanted/ieremenko" target="_blank" rel="noopener">an outstanding $1 million reward</a> for information leading to the arrest of Ieremenko (Александр Витальевич Еременко), who allegedly went by the hacker handles &#8220;<strong>Zl0m</strong>&#8221; and &#8220;<strong>Lamarez</strong>.&#8221;]</p>
<p>Kislitsin was hired by Group-IB in January 2013, nearly six months after the Formspring hack. Group-IB has since moved its headquarters to Singapore, and in April 2023 the company announced it had fully exited the Russian market.</p>
<p>In a statement provided to KrebsOnSecurity, Group-IB said Mr. Kislitsin is no longer an employee, and that he now works for a Russian organization called <strong>FACCT</strong>, which stands for &#8220;<strong>Fight Against Cybercrime Technologies</strong>.&#8221;</p>
<p>&#8220;Dmitry Volkov, co-founder and CEO, sold his stake in Group-IB’s Russia-based business to the company’s local management,&#8221; the statement reads. &#8220;The stand-alone business in Russia has been operating under the new brand FACCT ever since and will continue to operate as a separate company with no connection to Group-IB.&#8221;</p>
<p>FACCT says on its website that it is a &#8220;Russian developer of technologies for combating cybercrime,&#8221; and that it works with clients to fight targeted attacks, data leaks, fraud, phishing and brand abuse. In a statement <a href="https://www.facct.ru/media-center/press-releases/zayavlenie-kompanii-otnositelno-zaderzhaniya-nikity-kislitsina/" target="_blank" rel="noopener">published online</a>, FACCT said Kislitsin is responsible for developing its network security business, and that he remains under temporary detention in Kazakhstan &#8220;to study the basis for extradition arrest at the request of the United States.&#8221;</p>
<p>&#8220;According to the information we have, the claims against Kislitsin are not related to his work at FACCT, but are related to a case more than 10 years ago when Nikita worked as a journalist and independent researcher,&#8221; FACCT wrote.</p>
<p>From 2006 to 2012, Kislitsin was editor-in-chief of &#8220;<em>Hacker</em>,&#8221; a popular Russian-language monthly magazine that includes articles on information and network security, programming, and frequently features interviews with and articles penned by notable or wanted Russian hackers.</p>
<p>&#8220;We are convinced that there are no legal grounds for detention on the territory of Kazakhstan,&#8221; the FACCT statement continued. &#8220;The company has hired lawyers who have been providing Nikita with all the necessary assistance since last week, and we have also sent an appeal to the Consulate General of the Russian Federation in Kazakhstan to assist in protecting our employee.&#8221;</p>
<p>FACCT indicated that the Kremlin has already intervened in the case, and the Russian government claims Kislitsin is wanted on criminal charges in Russia and must instead be repatriated to his homeland.</p>
<p>&#8220;The FACCT emphasizes that the announcement of Nikita Kislitsin on the wanted list in the territory of the Russian Federation became known only today, June 28, 6 days after the arrest in Kazakhstan,&#8221; FACCT wrote. &#8220;The company is monitoring developments.&#8221;<span id="more-64079"></span></p>
<p>The Kremlin followed a similar playbook in the case of<strong> Aleksei Burkov</strong>, a cybercriminal who long operated two of Russia’s most exclusive underground hacking forums. Burkov was arrested in 2015 by Israeli authorities, and the Russian government fought Burkov’s extradition to the U.S. for four years — even arresting and jailing an Israeli woman on phony drug charges to force a prisoner swap.</p>
<p>That effort ultimately failed: Burkov was <a href="https://krebsonsecurity.com/2019/11/why-were-the-russians-so-set-against-this-hacker-being-extradited/" target="_blank" rel="noopener">sent to America</a>, <a href="https://krebsonsecurity.com/2020/01/russian-cybercrime-boss-burkov-pleads-guilty/" target="_blank" rel="noopener">pleaded guilty</a>, and was <a href="https://krebsonsecurity.com/2020/06/russian-cybercrime-boss-burkov-gets-9-years/" target="_blank" rel="noopener">sentenced to nine years in prison</a>.</p>
<div id="attachment_49530" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-49530" decoding="async" loading="lazy" class=" wp-image-49530" src="media/a23ec59c.burkov-jerusalem-getty.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/11/burkov-jerusalem-getty.png" alt="" width="749" height="472" /><p id="caption-attachment-49530" class="wp-caption-text">Alexei Burkov, seated second from right, attends a hearing in Jerusalem in 2015. Image: Andrei Shirokov / Tass via Getty Images.</p></div>
<p><strong>Arkady Bukh</strong> is a U.S. attorney who has represented dozens of accused hackers from Russia and Eastern Europe who were extradited to the United States over the years. Bukh said Moscow is likely to turn the Kislitsin case into a diplomatic time bomb for Kazakhstan, which shares an enormous border and a great deal of cultural ties with Russia. A 2009 census found that Russians make up about 24 percent of the population of Kazakhstan.</p>
<p>&#8220;That would put Kazakhstan at a crossroads to choose between unity with Russia or going with the West,&#8221; Bukh said. &#8220;If that happens, Kazakhstan may have to make some very unpleasant decisions.&#8221;</p>
<p>Group-IB&#8217;s exodus from Russia comes as its former founder and CEO <strong>Ilya Sachkov</strong> remains languishing in a Russian prison, <a href="https://www.rferl.org/a/russia-sachkov-treason-cybersecurity/31871716.html" target="_blank" rel="noopener">awaiting a farcical trial and an inevitable conviction</a> on charges of treason. In September 2021, the Kremlin issued treason charges against Sachkov, although it has so far refused to disclose any details about the allegations.</p>
<p>Sachkov&#8217;s pending treason trial has been the subject of much speculation among denizens of Russian cybercrime forums, and the consensus seems to be that Sachkov and Group-IB were seen as a little too helpful to the DOJ in its various investigations involving top Russian hackers.</p>
<p>Indeed, since its inception in 2003, Group-IB&#8217;s researchers have helped to <a href="https://krebsonsecurity.com/2014/12/gang-hacked-atms-from-inside-banks/" target="_blank" rel="noopener">identify</a>, <a href="https://krebsonsecurity.com/2014/10/seleznev-arrest-explains-2pac-downtime/#more-28281" target="_blank" rel="noopener">disrupt</a> and even <a href="https://krebsonsecurity.com/2013/12/meet-paunch-the-accused-author-of-the-blackhole-exploit-kit/" target="_blank" rel="noopener">catch</a> a number of high-profile Russian hackers, most of whom got busted after years of criminal hacking because they made the unforgivable mistake of stealing from their own citizens.</p>
<p>When the indictments against Kislitsin were unsealed in 2020, Group-IB issued a lengthy statement attesting to his character and saying they would help him with his legal defense. As part of that statement, Group-IB noted that &#8220;representatives of the Group-IB company and, in particular, Kislitsin, in 2013, on their own initiative, met with employees of the US Department of Justice to inform them about the research work related to the underground, which was carried out by Kislitsin in 2012.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=64076
title: Who’s Behind the DomainNetworks Snail Mail Scam?
uri: Who-s-Behind-the-DomainNetworks-Snail-Mail-Scam
url: https://krebsonsecurity.com/2023/07/whos-behind-the-domainnetworks-snail-mail-scam/
content:
<p>If you&#8217;ve ever owned a domain name, the chances are good that at some point you&#8217;ve received a snail mail letter which appears to be a bill for a domain or website-related services. In reality, these misleading missives try to trick people into paying for useless services they never ordered, don&#8217;t need, and probably will never receive. Here&#8217;s a look at the most recent incarnation of this scam &#8212; <strong>DomainNetworks</strong> &#8212; and some clues about who may be behind it.</p>
<p>The DomainNetworks mailer may reference a domain that is or was at one point registered to your name and address. Although the letter includes the words &#8220;marketing services&#8221; in the upper right corner, the rest of the missive is deceptively designed to look like a bill for services already rendered.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-64110" src="media/0874a652.domainnetworksletter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/domainnetworksletter.png" alt="" width="720" height="953" /></p>
<p>DomainNetworks claims that listing your domain with their promotion services will result in increased traffic to your site. This is a dubious claim for a company that appears to be a complete fabrication, as we&#8217;ll see in a moment.  But happily, the proprietors of this enterprise were not so difficult to track down.</p>
<p>The website <strong>Domainnetworks[.]com</strong> says it is a business with a post office box in Hendersonville, N.C., and another address in Santa Fe, N.M. There are a few random, non-technology businesses tied to the phone number listed for the Hendersonville address, and the New Mexico address was used by several no-name web hosting companies.</p>
<p>However, there is little connected to these addresses and phone numbers that get us any closer to finding out who&#8217;s running Domainnetworks[.]com. And neither entity appears to be an active, official company in their supposed state of residence, at least according to each state&#8217;s Secretary of State database.</p>
<p>The <strong>Better Business Bureau</strong> <a href="https://www.bbb.org/us/nm/santa-fe/profile/internet-marketing-services/domain-networks-0806-99172251" target="_blank" rel="noopener">listing for DomainNetworks</a> gives it an &#8220;F&#8221; rating, and includes more than 100 reviews by people angry at receiving one of these scams via snail mail. Helpfully, the BBB says DomainNetworks previously operated under a different name: <strong>US Domain Authority LLC.</strong></p>
<div id="attachment_64109" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64109" decoding="async" loading="lazy" class=" wp-image-64109" src="media/b8285994.bbb-domainnetworks.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/bbb-domainnetworks.png" alt="" width="749" height="542" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/bbb-domainnetworks.png 1139w, https://krebsonsecurity.com/wp-content/uploads/2023/06/bbb-domainnetworks-768x556.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/bbb-domainnetworks-782x566.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-64109" class="wp-caption-text">DomainNetworks has an &#8220;F&#8221; reputation with the Better Business Bureau.</p></div>
<p>Copies of snail mail scam letters from US Domain Authority posted online show that this entity used the domain <strong>usdomainauthority[.]com</strong>, registered in May 2022. The Usdomainauthority mailer also featured a Henderson, NC address, albeit at a different post office box.</p>
<p>Usdomainauthority[.]com is no longer online, and the site seems to have blocked its pages from being indexed by the Wayback Machine at archive.org. But searching on a long snippet of text from DomainNetworks[.]com about refund requests shows that this text was found on just one other active website, according to <a href="https://www.publicwww.com" target="_blank" rel="noopener">publicwww.com</a>, a service that indexes the HTML code of existing websites and makes it searchable.</p>
<div id="attachment_64112" style="width: 752px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64112" decoding="async" loading="lazy" class=" wp-image-64112" src="media/443379fe.usdomainauthority.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/usdomainauthority.png" alt="" width="742" height="573" /><p id="caption-attachment-64112" class="wp-caption-text">A deceptive snail mail solicitation from DomainNetwork&#8217;s previous iteration &#8212; US Domain Authority. Image: Joerussori.com</p></div>
<p>That other website is a domain registered in January 2023 called <strong>thedomainsvault[.]com</strong>, and its registration details are likewise hidden behind privacy services. Thedomainsvault&#8217;s &#8220;Frequently Asked Questions&#8221; page is quite similar to the one on the DomainNetworks website; both begin with the question of why the company is sending a mailer that looks like a bill for domain services.</p>
<p>Thedomainsvault[.]com includes no useful information about the entity or people who operate it; clicking the &#8220;Contact-us&#8221; link on the site brings up a page with <a href="https://krebsonsecurity.com/2014/08/lorem-ipsum-of-good-evil-google-china/" target="_blank" rel="noopener">placeholder Lorem Ipsum text</a>, a contact form, and a phone number of 123456789.</p>
<p>However, searching <a href="https://www.domaintools.com/products/farsight-dnsdb/" target="_blank" rel="noopener">passive DNS records</a> at <strong>DomainTools.com</strong> for thedomainsvault[.]com shows that at some point whoever owns the domain instructed incoming email to be sent to <strong>ubsagency@gmail.com</strong>.</p>
<p>The first result that currently pops up when searching for &#8220;ubsagency&#8221; in Google is <strong>ubsagency[.]com</strong>, which says it belongs to a Las Vegas-based Search Engine Optimization (SEO) and digital marketing concern generically named both <strong>United Business Service</strong> and <strong>United Business Services</strong>. UBSagency&#8217;s website is hosted at the same Ann Arbor, Mich. based hosting firm (A2 Hosting Inc) as thedomainsvault[.]com.</p>
<p>UBSagency&#8217;s <a href="https://www.linkedin.com/company/ubs-agency/about/" target="_blank" rel="noopener">LinkedIn page</a> says the company has offices in Vegas, Half Moon Bay, Calif., and Renton, Wash. But once again, none of the addresses listed for these offices reveal any obvious clues about who runs UBSagency. And once again, none of these entities appear to exist as official businesses in their claimed state of residence.</p>
<p>Searching on ubsagency@gmail.com in <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a> shows the address was used sometime before February 2019 to create an account under the name &#8220;<strong>Sammy\Sam_Alon</strong>&#8221; at the interior decorating site <strong>Houzz.com</strong>. In January 2019, Houzz <a href="https://techcrunch.com/2019/01/31/houzz-data-breach/" target="_blank" rel="noopener">acknowledged</a> that a data breach exposed account information on an undisclosed number of customers, including user IDs, one-way encrypted passwords, IP addresses, city and ZIP codes, as well as Facebook information.</p>
<p>Sammy\Sam_Alon registered at Houzz using an Internet address in Huntsville, Ala. (68.35.149.206). Constella says this address was associated with the email <strong>tropicglobal@gmail.com</strong>, which also is tied to several other &#8220;Sammy&#8221; accounts at different stores online.</p>
<p>Constella also says a highly unique password re-used by tropicglobal@gmail.com across numerous sites was used in connection with just a few other email accounts, including <strong>shenhavgroup@gmail.com</strong>, and <strong>distributorinvoice@mail.com</strong>.</p>
<p>The shenhavgroup@gmail.com address was used to register <a href="https://twitter.com/shenhavgroup/with_replies" target="_blank" rel="noopener">a Twitter account for a <strong>Sam Orit Alon</strong></a> in 2013, whose account says they are affiliated with the Shenhav Group. According to DomainTools, shenhavgroup@gmail.com was responsible for registering roughly two dozen domains, including the now-defunct unitedbusinessservice[.]com.</p>
<p>Constella further finds that the address distributorinvoice@mail.com was used to register an account at <strong>whmcs.com</strong>, a web hosting platform that suffered a breach of its user database several years back. The name on the WHMCS account was <strong>Shmuel Orit Alon</strong>, from Kidron, Israel.</p>
<p>UBSagency also <a href="https://www.facebook.com/UBSagency" target="_blank" rel="noopener">has a Facebook page</a>, or maybe &#8220;had&#8221; is the operative word because someone appears to have defaced it. Loading the Facebook page for UBSagency shows several of the images have been overlaid or replaced with a message from someone who is <em>really</em> disappointed with <strong>Sam Alon</strong>.</p>
<p>&#8220;Sam Alon is a LIAR, THIEF, COWARD AND HAS A VERY SMALL D*CK,&#8221; reads one of the messages:</p>
<div id="attachment_64111" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64111" decoding="async" loading="lazy" class=" wp-image-64111" src="media/021617c9.ubshomepage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/ubshomepage.png" alt="" width="750" height="443" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/ubshomepage.png 1466w, https://krebsonsecurity.com/wp-content/uploads/2023/06/ubshomepage-768x453.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/ubshomepage-782x461.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-64111" class="wp-caption-text">The current Facebook profile page for UBSagency includes a logo that is similar to the DomainNetworks logo.</p></div>
<p>The logo in the UBSagency profile photo includes a graphic of what appears to be a magnifying glass with a line that zig-zags through bullet points inside and outside the circle, a unique pattern that is remarkably similar to the logo for DomainNetworks:</p>
<div id="attachment_64128" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64128" decoding="async" loading="lazy" class=" wp-image-64128" src="media/6f29eb1b.dnlogocomp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/dnlogocomp.png" alt="" width="750" height="238" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/dnlogocomp.png 1049w, https://krebsonsecurity.com/wp-content/uploads/2023/06/dnlogocomp-768x244.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/dnlogocomp-782x248.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-64128" class="wp-caption-text">The logos for DomainNetworks (left) and UBSagency.</p></div>
<p>Constella also found that the same Huntsville IP address used by Sam Alon at Houzz was associated with yet another Houzz account, this one for someone named &#8220;<strong>Eliran</strong>.&#8221;</p>
<p>The UBSagency Facebook page features several messages from an <a href="https://www.facebook.com/eliran.dani.benz/" target="_blank" rel="noopener">Eliran &#8220;Dani&#8221; Benz</a>, who is referred to by commenters as an employee or partner with UBSagency. The last check-in on Benz&#8217;s profile is from a beach at <a href="https://en.wikipedia.org/wiki/Rishon_LeZion" target="_blank" rel="noopener">Rishon Letziyon in Israel</a> earlier this year.</p>
<p>Neither Mr. Alon nor Mr. Benz responded to multiple requests for comment.</p>
<p>It may be difficult to believe that anyone would pay an invoice for a domain name or SEO service they never ordered. However, there is plenty of evidence that these phony bills often get processed by administrative personnel at organizations that end up paying the requested amount because they assume it was owed for some services already provided.</p>
<p>In 2018, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2018/12/how-internet-savvy-are-your-leaders/" target="_blank" rel="noopener">How Internet Savvy are Your Leaders?</a>, which examined public records to show that dozens of cities, towns, school districts and even political campaigns across the United States got snookered into paying these scam domain invoices from a similar scam company called <strong>WebListings Inc.</strong></p>
<p>In 2020, KrebsOnSecurity featured <a href="https://krebsonsecurity.com/2020/03/whos-behind-the-web-listings-mail-scam/" target="_blank" rel="noopener">a deep dive into who was likely behind the WebListings scam</a>, which had been sending out these snail mail scam letters for over a decade. That investigation revealed the scam&#8217;s connection to a multi-level marketing operation run out of the U.K., and to two brothers living in Scotland.</p>


feed_id: https://krebsonsecurity.com/?p=63941
title: Top Suspect in 2015 Ashley Madison Hack Committed Suicide in 2014
uri: Top-Suspect-in-2015-Ashley-Madison-Hack-Committed-Suicide-in-2014
url:
https://krebsonsecurity.com/2023/07/top-suspect-in-2015-ashley-madison-hack-committed-suicide-in-2014/

content:
<p>When the marital infidelity website <strong>AshleyMadison.com</strong> learned in July 2015 that hackers were threatening to publish data stolen from 37 million users, the company&#8217;s then-CEO <strong>Noel Biderman</strong> was quick to point the finger at an unnamed former contractor. But as a new documentary series on <strong>Hulu</strong> reveals [<em>SPOILER ALERT!</em>], there was just one problem with that theory: Their top suspect had killed himself more than a year before the hackers began publishing stolen user data.</p>
<p>The new documentary, <em>The Ashley Madison Affair</em>, begins airing today on Hulu in the United States and on <strong>Disney+</strong> in the United Kingdom. The series features interviews with security experts and journalists, Ashley Madison executives, victims of the breach and jilted spouses.</p>
<p><img decoding="async" class="aligncenter wp-image-64159" src="media/6493943f.amaffair.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/amaffair.png" alt="" width="749" height="515" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/07/amaffair.png 1088w, https://krebsonsecurity.com/wp-content/uploads/2023/07/amaffair-768x528.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/07/amaffair-782x538.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/07/amaffair-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The series also touches on shocking new details unearthed by KrebsOnSecurity and <strong>Jeremy Bullock</strong>, a data scientist who worked with the show&#8217;s producers at the Warner Bros. production company Wall to Wall Media. Bullock had spent many hours poring over the hundreds of thousands of emails that the Ashley Madison hackers stole from Biderman and published online in 2015.</p>
<p>Wall to Wall reached out in July 2022 about collaborating with Bullock after KrebsOnSecurity published <a href="https://krebsonsecurity.com/2022/07/a-retrospective-on-the-2015-ashley-madison-breach/" target="_blank" rel="noopener">A Retrospective on the 2015 Ashley Madison Breach</a>. That piece explored how Biderman &#8212; who is Jewish &#8212; had become the target of concerted harassment campaigns by anti-Semitic and far-right groups online in the months leading up to the hack.</p>
<p>Whoever hacked Ashley Madison had access to all employee emails, but they only released Biderman&#8217;s messages &#8212; three years worth. Apropos of my retrospective report, Bullock found that a great many messages in Biderman&#8217;s inbox were belligerent and anti-Semitic messages from a former Ashley Madison employee named <strong>William Brewster Harrison</strong>.</p>
<div id="attachment_64160" style="width: 632px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64160" decoding="async" loading="lazy" class="wp-image-64160 size-full" src="media/39de15c0.willhired.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/willhired.png" alt="" width="622" height="726" /><p id="caption-attachment-64160" class="wp-caption-text">William Harrison&#8217;s employment contract with Ashley Madison parent Avid Life Media.</p></div>
<p>The messages show that Harrison was hired in March 2010 to help promote Ashley Madison online, but the messages also reveal Harrison was heavily involved in helping to create and cultivate phony female accounts on the service.</p>
<p>There is evidence to suggest that in 2010 Harrison was directed to harass the owner of <strong>Ashleymadisonsucks.com </strong>into closing the site or selling the domain to Ashley Madison.</p>
<p>Ashley Madison&#8217;s parent company &#8212; Toronto-based <strong>Avid Life Media</strong> &#8212; filed a trademark infringement complaint in 2010 that succeeded in revealing a man named <strong>Dennis Bradshaw</strong> as the owner. But after being informed that Bradshaw was not subject to Canadian trademark laws, Avid Life offered to buy AshleyMadisonSucks.com for $10,000.</p>
<p>When Bradshaw refused to sell the domain, he and his then-girlfriend were subject to an unrelenting campaign of online harassment and blackmail. It now appears those attacks were perpetrated by Harrison, who sent emails from different accounts at the free email service <strong>Vistomail</strong> pretending to be Bradshaw, his then-girlfriend and their friends.</p>
<p>[As the documentary points out, the domain AshleyMadisonSucks.com was eventually transferred to Ashley Madison, which then shrewdly used it for advertising and to help debunk theories about why its service was supposedly untrustworthy].<span id="more-63941"></span></p>
<p>Harrison even went after Bradshaw&#8217;s lawyer and wife, listing them both on a website he created called <strong>Contact-a-CEO[.]com</strong>, which Harrison used to besmirch the name of major companies &#8212; including several past employers &#8212; all entities he believed had slighted him or his family in some way. The site also claimed to include the names, addresses and phone numbers of top CEOs.</p>
<div id="attachment_64163" style="width: 706px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64163" decoding="async" loading="lazy" class="wp-image-64163 size-full" src="media/d5b1d89a.contactaceo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/contactaceo.png" alt="" width="696" height="627" /><p id="caption-attachment-64163" class="wp-caption-text">A cached copy of Harrison&#8217;s website, contact-the-ceo.com.</p></div>
<p>An exhaustive analysis of domains registered to the various Vistomail pseudonyms used by Harrison shows he also ran <a href="https://web.archive.org/web/20090203030040/http://www.bash-a-business.com/" target="_blank" rel="noopener"><strong>Bash-a-Business[.]com</strong></a>, which Harrison dedicated to &#8220;all those sorry ass corporate executives out there profiting from your hard work, organs, lives, ideas, intelligence, and wallets.&#8221; Copies of the site at archive.org show it was the work of someone calling themselves &#8220;<strong>The Chaos Creator</strong>.&#8221;</p>
<p>Will Harrison was terminated as an Ashley Madison in November 2011, and by early 2012 he&#8217;d turned his considerable harassment skills squarely against the company. Ashley Madison&#8217;s long-suspected army of fake female accounts came to the fore in August 2012 after the former sex worker turned activist and blogger <strong>Maggie McNeill</strong> <a href="https://maggiemcneill.com/2012/08/15/show-and-tell/" target="_blank" rel="noopener">published screenshots</a> apparently taken from Ashley Madison&#8217;s internal systems suggesting that a large percentage of the female accounts on the service were computer-operated bots.</p>
<p>Ashley Madison&#8217;s executives understood that only a handful of employees at the time would have had access to the systems needed to produce the screenshots McNeill published online. In one exchange on Aug. 16, 2012, Ashley Madison&#8217;s director of IT was asked to produce a list of all company employees with all-powerful administrator access.</p>
<p>&#8220;Who or what is <strong>asdfdfsda@asdf.com</strong>?,&#8221; Biderman asked, after being sent a list of nine email addresses.</p>
<p>&#8220;It appears to be the email address Will used for his profiles,&#8221; the IT director replied.</p>
<p>&#8220;And his access was never shut off until today?,&#8221; asked the company&#8217;s general counsel Mike Daks.</p>
<div id="attachment_64165" style="width: 782px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64165" decoding="async" loading="lazy" class="size-full wp-image-64165" src="media/d0dc0c61.alm-users.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/alm-users.png" alt="" width="772" height="726" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/07/alm-users.png 772w, https://krebsonsecurity.com/wp-content/uploads/2023/07/alm-users-768x722.png 768w" sizes="(max-width: 772px) 100vw, 772px" /><p id="caption-attachment-64165" class="wp-caption-text">A Biderman email from 2012.</p></div>
<p>What prompted the data scientist Bullock to reach out were gobs of anti-Semitic diatribes from Harrison, who had taken to labeling Biderman and others &#8220;greedy Jew bastards.&#8221;</p>
<p>&#8220;So good luck, I&#8217;m sure we&#8217;ll talk again soon, but for now, Ive got better things in the oven,&#8221; Harrison wrote to Biderman after his employment contract with Ashley Madison was terminated. &#8220;Just remember I outsmarted you last time and I will outsmart and out maneuver you this time too, by keeping myself far far away from the action and just enjoying the sideline view, cheering for the opposition.&#8221;</p>
<div id="attachment_64162" style="width: 618px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64162" decoding="async" loading="lazy" class="size-full wp-image-64162" src="media/c8dea664.noelbuddy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/noelbuddy.png" alt="" width="608" height="539" /><p id="caption-attachment-64162" class="wp-caption-text">A 2012 email from William Harrison to former Ashley Madison CEO Noel Biderman.</p></div>
<p>Harrison signed his threatening missive with the salutation, &#8220;We are legion,&#8221; suggesting that whatever comeuppance he had in store for Ashley Madison would come from a variety of directions and anonymous hackers.</p>
<p>The leaked Biderman emails show that Harrison made good on his threats, and that in the months that followed Harrison began targeting Biderman and other Ashley Madison executives with menacing anonymous emails and spoofed phone calls laced with profanity and anti-Semitic language.</p>
<p>But on Mar. 5, 2014, Harrison committed suicide by shooting himself in the head with a handgun. This fact was apparently unknown to Biderman and other Ashley Madison executives more than a year later when their July 2015 hack was first revealed.</p>
<p>Does Harrison&#8217;s untimely suicide rule him out as a suspect in the 2015 hack? Who is The Chaos Creator, and what else transpired between Harrison and Ashley Madison prior to his death? We&#8217;ll explore these questions in Part II of this story, to be published early next week.</p>


feed_id: https://krebsonsecurity.com/?p=64180
title: Apple & Microsoft Patch Tuesday, July 2023 Edition
uri: Apple-Microsoft-Patch-Tuesday-July-2023-Edition
url: https://krebsonsecurity.com/2023/07/apple-microsoft-patch-tuesday-july-2023-edition/
content:
<p><strong>Microsoft Corp.</strong> today released software updates to quash 130 security bugs in its <strong>Windows</strong> operating systems and related software, including at least five flaws that are already seeing active exploitation. Meanwhile, <strong>Apple</strong> customers have their own zero-day woes again this month: On Monday, Apple issued (and then quickly pulled) an emergency update to fix a zero-day vulnerability that is being exploited on <strong>MacOS</strong> and <strong>iOS</strong> devices.</p>
<p><img decoding="async" class="aligncenter wp-image-64187" src="media/9467610d.applegear.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/applegear.png" alt="" width="753" height="335" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/07/applegear.png 924w, https://krebsonsecurity.com/wp-content/uploads/2023/07/applegear-768x342.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/07/applegear-782x348.png 782w" sizes="(max-width: 753px) 100vw, 753px" /></p>
<p>On July 10, Apple pushed a &#8220;Rapid Security Response&#8221; update to fix a code execution flaw in the Webkit browser component built into iOS, iPadOS, and macOS Ventura. Almost as soon as the patch went out, Apple pulled the software because it was reportedly causing problems loading certain websites. <em>MacRumors</em> <a href="https://www.macrumors.com/2023/07/10/apple-pulls-ios-16-5-1-macos-13-4-1-rsrs/" target="_blank" rel="noopener">says</a> Apple will likely re-release the patches when the glitches have been addressed.</p>
<p>Launched in May, Apple&#8217;s Rapid Security Response updates are designed to address time-sensitive vulnerabilities, and this is the second month Apple has used it. July marks the sixth month this year that Apple has released updates for zero-day vulnerabilities &#8212; those that get exploited by malware or malcontents before there is an official patch available.</p>
<p>If you rely on Apple devices and don&#8217;t have automatic updates enabled, please take a moment to check the patch status of your various iDevices. The latest security update that includes the fix for the zero-day bug should be available in <strong>iOS/iPadOS 16.5.1</strong>, <strong>macOS 13.4.1</strong>, and <strong>Safari 16.5.2</strong>.</p>
<p>On the Windows side, there are at least four vulnerabilities patched this month that earned high CVSS (badness) scores and that are already being exploited in active attacks, according to Microsoft. They include <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32049" target="_blank" rel="noopener">CVE-2023-32049</a>, which is a hole in <strong>Windows SmartScreen</strong> that lets malware bypass security warning prompts; and <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35311" target="_blank" rel="noopener">CVE-2023-35311</a> allows attackers to bypass security features in <strong>Microsoft Outlook</strong>.</p>
<p>The two other zero-day threats this month for Windows are both privilege escalation flaws. <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-32046" target="_blank" rel="noopener">CVE-2023-32046</a> affects a core Windows component called MSHTML, which is used by Windows and other applications, like <strong>Office</strong>, Outlook and <strong>Skype</strong>. <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36874" target="_blank" rel="noopener">CVE-2023-36874</a> is an elevation of privilege bug in the <strong>Windows Error Reporting Service</strong>.</p>
<p>Many security experts expected Microsoft to address a fifth zero-day flaw &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36884" target="_blank" rel="noopener">CVE-2023-36884 </a>&#8212; a remote code execution weakness in Office and Windows.</p>
<p>&#8220;Surprisingly, there is no patch yet for one of the five zero-day vulnerabilities,&#8221; said <strong>Adam Barnett</strong>, lead software engineer at Rapid7. &#8220;Microsoft is actively investigating publicly disclosed vulnerability, and promises to update the advisory as soon as further guidance is available.&#8221;</p>
<p>Barnett notes that Microsoft links exploitation of this vulnerability with <strong>Storm-0978</strong>, the software giant&#8217;s name for a cybercriminal group based out of Russia that is identified by the broader security community as <a href="https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine" target="_blank" rel="noopener">RomCom</a>.</p>
<p>&#8220;Exploitation of CVE-2023-36884 may lead to installation of the eponymous RomCom trojan or other malware,&#8221; Barnett said. &#8220;[Microsoft] suggests that RomCom / Storm-0978 is operating in support of Russian intelligence operations. The same threat actor has also been associated with ransomware attacks targeting a wide array of victims.&#8221;<span id="more-64180"></span></p>
<p>Microsoft&#8217;s <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36884" target="_blank" rel="noopener">advisory on CVE-2023-36884</a> is pretty sparse, but it does include a Windows registry hack that should help mitigate attacks on this vulnerability. Microsoft has also published <a href="https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/" target="_blank" rel="noopener">a blog post</a> about phishing campaigns tied to Storm-0978 and to the exploitation of this flaw.</p>
<p>Barnett said it&#8217;s while it&#8217;s possible that a patch will be issued as part of next month&#8217;s Patch Tuesday, Microsoft Office is deployed just about everywhere, and this threat actor is making waves.</p>
<p>&#8220;Admins should be ready for an out-of-cycle security update for CVE-2023-36884,&#8221; he said.</p>
<p><img decoding="async" loading="lazy" class="aligncenter size-full wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="841" height="592" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 841px) 100vw, 841px" /></p>
<p>Microsoft also today released new details about how it plans to address the existential threat of malware that is cryptographically signed by&#8230;wait for it&#8230;.Microsoft.</p>
<p>In late 2022, security experts at <strong>Sophos</strong>, <strong>Trend Micro</strong> and <strong>Cisco</strong> warned that ransomware criminals were using signed, malicious drivers in an attempt to evade antivirus and endpoint detection and response (EDR) tools.</p>
<p>In a blog post today, Sophos&#8217;s <strong>Andrew Brandt</strong> <a href="https://news.sophos.com/en-us/2023/07/11/microsoft-revokes-malicious-drivers-in-patch-tuesday-culling/" target="_blank" rel="noopener">wrote</a> that Sophos identified 133 malicious Windows driver files that were digitally signed since April 2021, and <em>found 100 of those were actually signed by Microsoft.</em> Microsoft <a href="https://msrc.microsoft.com/update-guide/vulnerability/ADV220005" target="_blank" rel="noopener">said</a> today it is taking steps to ensure those malicious driver files can no longer run on Windows computers.</p>
<p>As KrebsOnSecurity noted in <a href="https://krebsonsecurity.com/2023/06/ask-fitis-the-bear-real-crooks-sign-their-malware/" target="_blank" rel="noopener">last month&#8217;s story on malware signing-as-a-service</a>, code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. Both of these qualities make stolen or ill-gotten code-signing certificates attractive to cybercriminal groups, who prize their ability to add stealth and longevity to malicious software.</p>
<p>For a closer look at the patches released by Microsoft today, check out the <a href="https://isc.sans.edu/diary/July%202023%20Microsoft%20Patch%20Update/30018" target="_blank" rel="noopener">always-thorough Patch Tuesday roundup</a> from the <strong>SANS Internet Storm Center</strong>. And it’s not a bad idea to hold off updating for a few days until Microsoft works out any kinks in the updates: <a href="https://www.askwoody.com/" target="_blank" rel="noopener">AskWoody.com</a> usually has the lowdown on any patches that may be causing problems for Windows users.</p>
<p>And as ever, please consider backing up your system or at least your important documents and data before applying system updates. If you encounter any problems with these updates, please drop a note about it here in the comments.</p>


feed_id: https://krebsonsecurity.com/?p=64197
title: SEO Expert Hired and Fired By Ashley Madison Turned on Company, Promising Revenge
uri: SEO-Expert-Hired-and-Fired-By-Ashley-Madison-Turned-on-Company-Promis
url:
https://krebsonsecurity.com/2023/07/seo-expert-hired-and-fired-by-ashley-madison-turned-on-company-promising-revenge/

content:
<p><em>[This is Part II of <a href="https://krebsonsecurity.com/2023/07/top-suspect-in-2015-ashley-madison-hack-committed-suicide-in-2014/" target="_blank" rel="noopener">a story published here last week</a> on reporting that went into a new <strong>Hulu</strong> documentary series on the 2015 Ashley Madison hack.]</em></p>
<p>It was around 9 p.m. on Sunday, July 19, when I received a message through the contact form on KrebsOnSecurity.com that the marital infidelity website AshleyMadison.com had been hacked. The message contained links to confidential Ashley Madison documents, and included a manifesto that said a hacker group calling itself the <strong>Impact Team</strong> was prepared to leak data on all 37 million users unless Ashley Madison and a sister property voluntarily closed down within 30 days.</p>
<div id="attachment_31653" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-31653" decoding="async" class=" wp-image-31653" src="media/46977228.impactteam-580x657.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam-580x657.png" alt="" width="750" height="850" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam-580x657.png 580w, https://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam.png 671w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-31653" class="wp-caption-text">A snippet of the message left behind by the Impact Team.</p></div>
<p>The message included links to files containing highly sensitive information, including snippets of leaked user account data, maps of internal AshleyMadison company servers, employee network account information, company bank account data and salary information.</p>
<p>A master employee contact list was among the documents leaked that evening. Helpfully, it included the cell phone number for <strong>Noel Biderman</strong>, then the CEO of Ashley Madison parent firm <strong>Avid Life Media</strong> (ALM). To my everlasting surprise, Biderman answered on the first ring and acknowledged they&#8217;d been hacked without even waiting to be asked.</p>
<p>“We’re on the doorstep of [confirming] who we believe is the culprit, and unfortunately that may have triggered this mass publication,” Biderman told me on July 19, just minutes before I published <a href="https://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/" target="_blank" rel="noopener">the first known public report about the breach</a>. “I’ve got their profile right in front of me, all their work credentials. It was definitely a person here that was not an employee but certainly had touched our technical services.”</p>
<p>On Aug 18, 2015, the Impact Team posted a “Time’s up!” message online, along with links to 60 gigabytes of Ashley Madison user data. The data leak led to the public shaming and extortion of many Ashley Madison users, and to at least two suicides. Many other users lost their jobs or their marriages. To this day, nobody has been charged in the hack, and incredibly Ashley Madison remains a thriving company.</p>
<h2>THE CHAOS MAKER</h2>
<p>The former employee that Biderman undoubtedly had in mind on July 19, 2015 was <strong>William Brewster Harrison</strong>, a self-described expert in search engine optimization (SEO) tricks that are designed to help websites increase their rankings for various keywords in Google and other search engines.</p>
<p>It is evident that Harrison was Biderman&#8217;s top suspect immediately after the breach became public because &#8212; in addition to releasing data on 37 million users a month later in August 2015 &#8212; the hackers also dumped three years worth of email they stole from Biderman. And Biderman&#8217;s inbox is full of messages about hate-filled personal attacks from Harrison.</p>
<p>A Native of Northern Virginia, Harrison eventually settled in North Carolina, had a son with his then-wife, and started a fence-building business. ALM hired Harrison in March 2010 to promote its various adult brands online, and it is clear that one of his roles was creating and maintaining female profiles on Ashley Madison, and creating <a href="https://web.archive.org/web/20100623223703/http://www.marriage-playground.com:80/" target="_blank" rel="noopener">blogs</a> that were made to look like they were written by women who&#8217;d just joined Ashley Madison.</p>
<div id="attachment_64202" style="width: 321px" class="wp-caption alignright"><a href="media/1f3579c5.willharrisonfb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/willharrisonfb.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64202" decoding="async" loading="lazy" class="wp-image-64202" src="media/1f3579c5.willharrisonfb.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/willharrisonfb.png" alt="" width="311" height="501" /></a><p id="caption-attachment-64202" class="wp-caption-text">A selfie that William B. Harrison posted to his Facebook page in 2013 shows him holding a handgun and wearing a bulletproof vest.</p></div>
<p>It appears Harrison was working as an affiliate of Ashley Madison prior to his official employment with the company, which suggests that Harrison had already demonstrated he could drive signups to the service and help improve its standing in the search engine rankings.</p>
<p>What is less clear is whether anyone at ALM ever performed a basic background check on Harrison before hiring him. Because if they had, the results almost certainly would have given them pause. Virginia prosecutors charged the young 20-something Harrison with a series of misdemeanors, including trespassing, unlawful entry, drunk in public, and making obscene phone calls.</p>
<p>In 2008, North Carolina authorities charged Harrison with criminal extortion, a case that was transferred to South Carolina before ultimately being dismissed. In December 2009, Harrison faced charges of <a href="https://en.wikipedia.org/wiki/False_imprisonment" target="_blank" rel="noopener">false imprisonment</a>, charges that were also dropped by the local district attorney.</p>
<p>By the time Ashley Madison officially <a href="media/39de15c0.willhired.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/willhired.png" target="_blank" rel="noopener">hired him</a>, Harrison&#8217;s life was falling apart. His fence business had failed, and he&#8217;d just filed for bankruptcy. Also, his marriage had soured, and after a new arrest for driving under the influence, he was in danger of getting divorced, losing access to his son, and/or going to jail.</p>
<p>It also seems likely that nobody at ALM bothered to look at the dozens of domain names registered to Harrison&#8217;s various Vistomail.com email addresses, because had they done so they likely would have noticed two things.</p>
<p>One is that Harrison had a history of creating websites to lambaste companies he didn&#8217;t like, or that he believed had slighted him or his family in some way. Some of these websites included content that defamed and doxed executives, such as <strong>bash-a-business[.]com</strong>, <strong>google-your-business[.]com</strong>, <strong>contact-a-ceo[.]com</strong>, lowes-is-a-cancer[.]com (according to Harrison, the home improvement chain once employed his wife).</p>
<p>A background check on Harrison&#8217;s online footprint also would have revealed he was a self-styled rapper who claimed to be an active menace to corporate America. Harrison&#8217;s website <strong>lyrical-gangsta[.]com</strong> included a number of works, such as &#8220;<strong>Slim Thug &#8212; I Run &#8212; Remix Spoof</strong>,&#8221; which are replete with menacing words for unnamed corporate executives:</p>
<p><em>[HOOK]</em><br />
<em>I surf the net all night n day (the web love thug)</em><br />
<em>cuz I still surf the net all night n day</em><br />
<em>yuhh I type for my mind, got smart for my ego</em><br />
<em>still running circles round them, what&#8217;s good?</em><br />
<em>cuz I still surf, the net all night n day,</em><br />
<em>I cant stay away.</em></p>
<p><em>They don&#8217;t make to [sic] many hackers like me</em><br />
<em>bonafide hustler certified G</em><br />
<em>still pumpin&#8217; the TOP 10 results</em><br />
<em>if you got the right dough!</em><br />
<em>think the results are fake? sucka Google ME</em><br />
<em>smarter than executives, bigger then Wal-Mart</em><br />
<em>Nelly strugglin&#8217; with the fact that I&#8217;m #1 NOW</em><br />
<em>street boys know me, ain&#8217;t nuttin&#8217; new</em><br />
<em>about to make my mill, with an all new crew</em><br />
<em>I-95 execs don&#8217;t know what to do, or where to go</em><br />
<em>watchin them stocks evaporate all their dough</em><br />
<em>I already left the hood, got up off the streets</em><br />
<em>its in my blood im a gangsta till Im deceased</em></p>
<p><em>moving lumber for money or typin&#8217; in a zone</em><br />
<em>all night hackin&#8217; till 6 in the mornin</em><br />
<em>that shit im focusin&#8217; on, stronger then cologne</em><br />
<em>you can prolly smell the jealousy</em><br />
<em>through your LCD screen</em><br />
<em>if you still broke&#8211; better work for some green</em><br />
<em>called them Fortune execs on that legal bluff</em><br />
<em>cuz the Feds busy raidin other stuff</em><br />
<em>Imma run the Net til im six feet under</em><br />
<em>I&#8217;m a leave my mark &#8212; no reason to wonder</em><br />
<em>(Yea Yea)</em><span id="more-64197"></span></p>
<div id="attachment_64206" style="width: 628px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64206" decoding="async" loading="lazy" class="size-full wp-image-64206" src="media/fa885347.willsrap2.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/willsrap2.png" alt="" width="618" height="759" /><p id="caption-attachment-64206" class="wp-caption-text">Some of the anti-corporate rhymes busted by Harrison&#8217;s hacker/rapper alter ego &#8220;Chaos Dog.&#8221; Image: Archive.org.</p></div>
<p>The same theme appears in another rap (&#8220;The Hacker Backstage&#8221;) penned by Harrison&#8217;s rapper alter ego &#8212; &#8220;Chaos Dog:&#8221;</p>
<p><em>&#8230;this hacker was born to write</em><br />
<em>bust off the rhymes and watch em take flight</em><br />
<em>you know all about them corporate jets</em><br />
<em>and handing out pinkslips without regrets</em><br />
<em>oversized companies are the problem</em></p>
<p><em>well, I&#8217;ve got a solution</em><br />
<em>It&#8217;s called good ol&#8217; fashioned retribution</em><br />
<em>file bankruptcy, boycott you like Boston colonists</em><br />
<em>Corporate America cant stop this Eminem style columnist</em><br />
<em>2pac would have honored my style</em><br />
<em>Im the next generation of hacker inspiration</em><br />
<em>Americans don&#8217;t want a corporate nation</em><br />
<em>All that DOW Jones shit is a dying sensation</em></p>
<p>In addition to pimping Ashley Madison with fake profiles and phony user blogs, it appears Harrison also went after the company&#8217;s enemies during the brief time he was an employee. As noted in Part I of this story, Harrison used multiple pseudonymous Vistomail.com email addresses to harass the owners of <strong>AshleyMadisonSucks[.]com</strong> into selling or shutting down the site.</p>
<p>When the owner of AshleyMadisonSucks[.]com refused to sell the domain, he and his then-girlfriend were subject to an unrelenting campaign of online harassment and blackmail. It now appears those attacks were perpetrated by Harrison, who sent emails from different accounts at the free email service <strong>Vistomail</strong> pretending to be the domain owner, his then-girlfriend and their friends. Harrison even went after the domain owner&#8217;s lawyer and wife, listing them both on his Contact-A-CEO[.]com website.</p>
<h2>TURNABOUT IS FAIR PLAY</h2>
<p>Things started going sideways for Ashley Madison when Harrison&#8217;s employment contract was terminated in November 2011. The leaked emails do not explain why Harrison was fired, but his mercurial temperament likely played a major role. According to Harrison, it was because he had expressed some moral reservations with certain aspects of his duties, although he was not specific on that point and none of this could be confirmed.</p>
<p>Shortly after Harrison was fired, the company&#8217;s executives began noticing that <strong>Google</strong> was auto-completing the words &#8220;Jew&#8221; and &#8220;Jewish&#8221; whenever someone searched for Biderman&#8217;s name. The results returned when one accepted Google&#8217;s recommended search at the time filled the first page with links to <strong>Stormfront</strong>, a far-right, neo-Nazi hate group. The company strongly suspected someone was using underhanded SEO techniques to slander and attack its CEO.</p>
<p>In July 2022, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2022/07/a-retrospective-on-the-2015-ashley-madison-breach/" target="_blank" rel="noopener">a retrospective on the 2015 Ashley Madison breach</a> which found that Biderman had become the subject of increasing ire from members of Stormfront and other extremists groups in the years leading up to the hack. According to the neo-Nazi groups, Biderman was a worthy target of their harassment not just because he was a successful Jewish CEO, but also because his company was hellbent on destroying Christian morals and families.</p>
<p>Biderman&#8217;s leaked emails show that in February 2021 he hired <strong>Brian Cuban</strong> &#8212; the attorney brother of <strong>Mark Cuban</strong>, the owner of the Dallas Mavericks and one the main &#8220;sharks&#8221; on the ABC reality television series <strong>Shark Tank</strong>. Through Cuban, Ashley Madison appealed their case to both Google and to the Anti-Defamation League, but neither was apparently able or willing to help.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-60580" src="media/ac0194a1.ashmadbill.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/ashmadbill.png" alt="" width="750" height="408" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/ashmadbill.png 616w, https://krebsonsecurity.com/wp-content/uploads/2022/07/ashmadbill-370x200.png 370w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Also in early January 2012, Biderman and other Ashley Madison executives found themselves inundated with anonymous Vistomail.com emails that were replete with profanity and slurs against Jews. Although he used fake names and email addresses, Harrison made little effort to hide his identity in several of these nastygrams.</p>
<p>One particularly ugly message from Harrison even included a link to a Youtube video he&#8217;d put online of his young son playing basketball for a school team. That Youtube video was included in an email wherein Harrison &#8211; then separated from his wife &#8212; lamented all the hours he spent working for Ashley Madison up in Canada instead of spending time with his son.</p>
<p>Harrison then turned to making threatening phone calls to Ashley Madison executives. In one incident in March 2012, Harrison called the company&#8217;s former director of Human Resources using a caller ID spoofing service to make it look like he was calling from inside the building.</p>
<p>ALM&#8217;s lawyers contacted the Toronto police in response to Harrison&#8217;s harassment.</p>
<p>&#8220;For Will to have disguised his phone number as Mark’s strongly suggest he has hacked my email, legal counsel for the opposing side in a perceived legal dispute,&#8221; ALM VP and general counsel Mike Dacks wrote in a letter to a detective at the Toronto Police. &#8220;Over the months of his many hundreds of emails he alluded a number of times to undertaking cyberattacks against us and this was noted in my original report to police.&#8221;</p>
<p>Based on the exchanges in Bidernman&#8217;s inbox it appears those appeals to the Toronto authorities were successful in having Harrison barred from being able to enter Canada.</p>
<p>ALM also contacted a detective in Harrison&#8217;s home county in North Carolina. But when the local police paid a visit to Harrison&#8217;s home to follow up on the harassment complaints, Harrison fled out his back porch, injuring himself after jumping off the second-story deck.</p>
<p>It is unclear if the police ever succeeded in interviewing Harrison in response to the harassment complaints from ALM. The Raleigh police officer contacted by ALM did not respond to requests for information. But the visit from the local cops only seemed to embolden and anger Harrison even more, and Biderman&#8217;s emails indicate the harassment continued after this incident.</p>
<h2>HUMAN DECOYS</h2>
<p>Then in August 2012, the former sex worker turned blogger and activist <strong>Maggie McNeill</strong> published screenshots from an internal system that Ashley Madison used called the &#8220;<strong>Human Decoy Interface</strong>,&#8221; which was a fancy way of describing a system built to manage phony female accounts on the service.</p>
<p>The screenshots appeared to show that a great many female accounts were in fact bots designed to bring in paying customers. Ashley Madison was always free to join, but users had to pay if they wished to chat directly with other users.</p>
<p>Although Harrison had been fired nearly a year earlier, Biderman&#8217;s leaked emails show that Harrison&#8217;s access to Ashley Madison&#8217;s internal tools wasn&#8217;t revoked until after the screenshots were posted online and the company began reviewing which employee accounts had access to the Human Decoy Interface.</p>
<p>“Who or what is <strong>asdfdfsda@asdf.com</strong>?,” Biderman asked, after being sent a list of nine email addresses.</p>
<p>“It appears to be the email address Will used for his profiles,” the IT director replied.</p>
<p>“And his access was never shut off until today?,” asked the company’s general counsel Mike Dacks.</p>
<h2>TRUTH BOMBS</h2>
<p>Biderman&#8217;s leaked emails suggest that Harrison stopped his harassment campaign sometime after 2012. A decade later, KrebsOnSecurity sought to track down and interview Harrison. Finding nobody at his former addresses and phone numbers in North Carolina, KrebsOnSecurity wound up speaking with Will&#8217;s stepmother, <strong>Tena Nauheim</strong>, who lives with Will&#8217;s dad in Northern Virginia.</p>
<p>Nauheim quickly dropped two big truth bombs after patiently listening to my spiel about why I was calling and looking for Mr. Harrison. The first was that Will was brought up Jewish, although he did not practice the faith: A local rabbi and friend of the family gave the service at Will&#8217;s funeral in 2014.</p>
<p>Nauheim also shared that her stepson had killed himself in 2014, shooting himself in the head with a handgun. Will&#8217;s mother discovered his body.</p>
<p>&#8220;Will committed suicide in March 2014,&#8221; Nauheim shared. &#8220;I&#8217;ve heard all those stories you just mentioned. Will was severely mentally ill. He was probably as close to a sociopath as I can imagine anyone being. He was also a paranoid schizophrenic who wouldn&#8217;t take his medication.&#8221;</p>
<p>William B. Harrison died on March 5, 2014, <em>nearly 16 months before The Impact Team announced they&#8217;d hacked Ashley Madison</em>.</p>
<p>Nauheim said she constantly felt physically threatened when Will was around. But she had trouble believing that her stepson was a raging anti-Semite. She also said she thought the timing of Will&#8217;s suicide effectively ruled him out as a suspect in the 2015 Ashley Madison hack.</p>
<p>&#8220;Considering the date of death, I’m not sure if he’s your guy,&#8221; Nauheim offered toward the end of our conversation.</p>
<p>[There is one silver lining to Will Harrison&#8217;s otherwise sad tale: His widow has since remarried, and her new husband agreed to adopt their son as his own.]</p>
<h2>ANALYSIS</h2>
<p>Does Harrison&#8217;s untimely death rule him out as a suspect, as his stepmom suggested? This remains an open question. In <a href="media/c8dea664.noelbuddy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/noelbuddy.png" target="_blank" rel="noopener">a parting email to Biderman in late 2012</a>, Harrison signed his real name and said he was leaving, but not going away.</p>
<p>&#8220;So good luck, I&#8217;m sure we&#8217;ll talk again soon, but for now, I&#8217;ve got better things in the oven,&#8221; Harrison wrote. &#8220;Just remember I outsmarted you last time and I will outsmart you and out maneuver you this time too, by keeping myself far far away from the action and just enjoying the sideline view, cheering for the opposition.&#8221;</p>
<p>Nothing in the leaked Biderman emails suggests that Ashley Madison did much to revamp the security of its computer systems in the wake of Harrison&#8217;s departure and subsequent campaign of harassment &#8212; apart from removing an administrator account of his a year after he&#8217;d already left the company.</p>
<p>KrebsOnSecurity found nothing in Harrison&#8217;s extensive domain history suggesting he had any real malicious hacking skills. But given the clientele that typically employed his skills &#8212; the adult entertainment industry &#8212; it seems likely Harrison was at least conversant in the dark arts of &#8220;Black SEO,&#8221; which involves using underhanded or else downright illegal methods to game search engine results.</p>
<p>Armed with such experience, it would not have been difficult for Harrison to have worked out a way to maintain access to working administrator accounts at Ashley Madison. If that in fact did happen, it would have been trivial for him to sell or give those credentials to someone else.</p>
<p>Or to <em>something</em> else. Like Nazi groups. As KrebsOnSecurity reported last year, in the six months leading up to the July 2015 hack, Ashley Madison and Biderman became a frequent subject of derision across multiple neo-Nazi websites.</p>
<p>On Jan. 14, 2015, a member of the neo-Nazi forum Stormfront posted a lively thread about Ashley Madison in the general discussion area titled, “Jewish owned dating website promoting adultery.”</p>
<p>On July 3, 2015, <a href="https://en.wikipedia.org/wiki/Andrew_Anglin" target="_blank" rel="noopener">Andrew Anglin</a>, the editor of the alt-right publication <a href="https://www.splcenter.org/fighting-hate/extremist-files/individual/andrew-anglin" target="_blank" rel="noopener">Daily Stormer</a>, posted excerpts about Biderman from a story titled, “Jewish Hyper-Sexualization of Western Culture,” which referred to Biderman as the “Jewish King of Infidelity.”</p>
<p>On July 10, a mocking montage of Biderman photos with racist captions was posted to the extremist website <a href="https://www.splcenter.org/hatewatch/2014/04/14/vanguard-news-network-track-record-violence" target="_blank" rel="noopener">Vanguard News Network</a>, as part of a thread called “Jews normalize sexual perversion.”</p>
<p>Some readers have suggested that the data leaked by the Impact Team could have originally been stolen by Harrison. But that timeline does not add up given what we know about the hack. For one thing, the financial transaction records leaked from Ashley Madison show charges up until mid-2015. Also, the final message in the archive of Biderman’s stolen emails was dated July 7, 2015 — almost two weeks before the Impact Team would announce their hack.</p>
<p>Whoever hacked Ashley Madison clearly wanted to disrupt the company as a business, and disgrace its CEO as the endgame. The Impact Team&#8217;s intrusion struck just as Ashley Madison&#8217;s parent was preparing go public with an initial public offering (IPO) for investors. Also, the hackers stated that while they stole all emplyee emails, they were only interested in leaking Biderman&#8217;s.</p>
<p>Also, the Impact Team had to know that ALM would never comply with their demands to dismantle Ashley Madison and Established Men. In 2014, ALM reported revenues of $115 million. There was little chance the company was going to shut down some of its biggest money machines.</p>
<p>Hence, it appears the Impact Team’s goal all along was to create prodigious amounts of drama and tension by announcing the hack of a major cheating website, and then let that drama play out over the next few months as millions of exposed Ashley Madison users freaked out and <a href="https://krebsonsecurity.com/2015/08/extortionists-target-ashley-madison-users/" target="_blank" rel="noopener">became the targets of extortion attacks and public shaming</a>.</p>
<p>After the Impact Team released Biderman&#8217;s email archives, several media outlets pounced on salacious exchanges in those messages as supposed proof he had carried on multiple affairs. Biderman resigned as CEO of Ashley Madison on Aug. 28, 2015.</p>
<p>Complicating things further, it appears more than one malicious party may have gained access to Ashley&#8217;s Madison&#8217;s network in 2015 or possibly earlier. Cyber intelligence firm <a href="https://www.intel471.com/" target="_blank" rel="noopener">Intel 471</a> recorded a series of posts by a user with the handle “<strong>Brutium</strong>” on the Russian-language cybercrime forum <strong>Antichat</strong> between 2014 and 2016.</p>
<p>Brutium routinely advertised the sale of large, hacked databases, and on Jan. 24, 2015, this user posted a thread offering to sell data on 32 million Ashley Madison users. However, there is no indication whether anyone purchased the information. Brutium’s profile has since been removed from the Antichat forum.</p>
<p>I realize this ending may be unsatisfying for many readers, as it is for me. The story I wrote in 2015 about the Ashley Madison hack is still the biggest scoop I&#8217;ve published here (in terms of traffic), yet it remains perhaps the single most frustrating investigation I&#8217;ve ever pursued. But my hunch is that there is still more to this story that has yet to unfold.</p>


feed_id: https://krebsonsecurity.com/?p=64247
title: LeakedSource Owner Quit Ashley Madison a Month Before 2015 Hack
uri: LeakedSource-Owner-Quit-Ashley-Madison-a-Month-Before-2015-Hack
url:
https://krebsonsecurity.com/2023/07/leakedsource-owner-quit-ashley-madison-a-month-before-2015-hack/

content:
<p><em>[This is Part III in a series on research conducted for a recent <a href="https://www.hulu.com/series/the-ashley-madison-affair-fc03be18-6dc9-4047-9be3-111e2bc962ef" target="_blank" rel="noopener">Hulu documentary</a> on the 2015 hack of marital infidelity website AshleyMadison.com.]</em></p>
<p>In 2019, a Canadian company called <strong>Defiant Tech Inc.</strong> pleaded guilty to running <strong>LeakedSource[.]com</strong>, a service that sold access to billions of passwords and other data exposed in countless data breaches. KrebsOnSecurity has learned that the owner of Defiant Tech, a 32-year-old Ontario man named <strong>Jordan Evan Bloom</strong>, was hired in late 2014 as a developer for the marital infidelity site <strong>AshleyMadison.com</strong>. Bloom resigned from AshleyMadison citing health reasons in June 2015 &#8212; less than one month before unidentified hackers stole data on 37 million users &#8212; and launched LeakedSource three months later.</p>
<div id="attachment_64268" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64268" decoding="async" class=" wp-image-64268" src="media/92767bea.bloom-lambo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/bloom-lambo.png" alt="" width="750" height="566" /><p id="caption-attachment-64268" class="wp-caption-text">Jordan Evan Bloom, posing in front of his Lamborghini.</p></div>
<p>On Jan. 15, 2018, the <strong>Royal Canadian Mounted Police</strong> (RCMP) charged then 27-year-old Bloom, of Thornhill, Ontario, with selling stolen personal identities online through the website <a href="https://web.archive.org/web/20161213230117/https://www.leakedsource.com/" target="_blank" rel="noopener">LeakedSource[.]com</a>.</p>
<p>LeakedSource was advertised on a number of popular cybercrime forums as a service that could help hackers break into valuable or high-profile accounts. LeakedSource also tried to pass itself off as a legal, legitimate business that was marketing to security firms and professionals.</p>
<p>The RCMP arrested Bloom in December 2017, and said he made approximately $250,000 selling hacked data, which included information on 37 million user accounts leaked in the 2015 Ashley Madison breach.</p>
<p>Subsequent press releases from the RCMP about the LeakedSource investigation omitted any mention of Bloom, and referred to the defendant only as Defiant Tech. In <a href="https://web.archive.org/web/20190623032126/http://www.rcmp.gc.ca/en/news/2019/defiant-tech-inc-enters-guilty-plea-rcmp-cybercrime-investigation" target="_blank" rel="noopener">a legal settlement</a> that is quintessentially Canadian, the matter was resolved in 2019 after Defiant Tech agreed to plead guilty. The RCMP did not respond to requests for comment.</p>
<h2>A GREY MARKET</h2>
<p>The <strong>Impact Team</strong>, the hacker group that <a href="media/01af327f.impactteam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/07/impactteam.png" target="_blank" rel="noopener">claimed responsibility</a> for stealing and leaking the AshleyMadison user data, also leaked several years worth of email from then-CEO <strong>Noel Biderman</strong>. A review of those messages shows that Ashley Madison hired Jordan Evan Bloom as a PHP developer in December 2014 &#8212; even though the company understood that Bloom&#8217;s success as a programmer and businessman was tied to shady and legally murky enterprises.</p>
<p>Bloom&#8217;s recommendation came to Biderman via <strong>Trevor Sykes,</strong> then chief technology officer for Ashley Madison parent firm Avid Life Media (ALM). The following is an email from Sykes to Biderman dated Nov. 14, 2014:</p>
<p>&#8220;Greetings Noel,</p>
<p>&#8220;We&#8217;d like to offer Jordan Bloom the position of PHP developer reporting to Mike Morris for 75k CAD/Year. He did well on the test, but he also has a great understanding of the business side of things having run small businesses himself. This was an internal referral.&#8221;</p>
<p>When Biderman responded that he needed more information about the candidate, Sykes <a href="media/c73a578a.bloomrequesttohire.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/bloomrequesttohire.png" target="_blank" rel="noopener">replied</a> that Bloom was independently wealthy as a result of his forays into the shadowy world of &#8220;<a href="https://www.youtube.com/watch?v=eQ-bUgTZJuc" target="_blank" rel="noopener">gold farming</a>&#8221;  &#8212; the semi-automated use of large numbers of player accounts to win some advantage that is usually related to cashing out game accounts or inventory. Gold farming is particularly prevalent in massively multiplayer online role-playing games (MMORPGs), such as <strong>RuneScape</strong> and <strong>World of Warcraft</strong>.</p>
<p>&#8220;In his previous experience he had been doing RMT (Real Money Trading),&#8221; Sykes wrote. &#8220;This is the practice of selling virtual goods in games for real world money. This is a grey market, which is usually against the terms and services of the game companies.&#8221; Here&#8217;s the rest of his message to Biderman:</p>
<p>&#8220;RMT sellers traditionally have a lot of problems with chargebacks, and payment processor compliance. During my interview with him, I spent some time focusing in on this. He had to demonstrate to the processor, Paypal, at the time he had a business and technical strategy to address his charge back rate.&#8221;</p>
<p>&#8220;He ran this company himself, and did all the coding, including the integration with the processors,&#8221; Sykes continued in his assessment of Bloom. &#8220;Eventually he was squeezed out by Chinese gold farmers, and their ability to market with much more investment than he could. In addition the cost of &#8216;farming&#8217; the virtual goods was cheaper in China to do than in North America.&#8221;<span id="more-64247"></span></p>
<h2>COME, ABUSE WITH US</h2>
<p>The gold farming reference is fascinating because in 2017 KrebsOnSecurity published <a href="https://krebsonsecurity.com/2017/02/who-ran-leakedsource-com/" target="_blank" rel="noopener">Who Ran LeakedSource?</a>, which examined clues suggesting that one of the administrators of LeakedSource also was the admin of <strong>abusewith[.]us</strong>, a site unabashedly dedicated to helping people hack email and online gaming accounts.</p>
<div id="attachment_38074" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-38074" decoding="async" loading="lazy" class=" wp-image-38074" src="media/adced928.abusewithus-current-580x372.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current-580x372.png" alt="" width="750" height="481" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current-580x372.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current-768x492.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current-940x602.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/02/abusewithus-current.png 1497w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-38074" class="wp-caption-text">An administrator account Xerx3s on Abusewithus.</p></div>
<p>Abusewith[.]us began in September 2013 as a forum for learning and teaching how to hack accounts at Runescape, an MMORPG set in a medieval fantasy realm where players battle for kingdoms and riches.</p>
<p>The currency with which Runescape players buy and sell weapons, potions and other in-game items are virtual gold coins, and many of Abusewith[dot]us’s early members traded in a handful of commodities: Phishing kits and exploits that could be used to steal Runescape usernames and passwords from fellow players; virtual gold plundered from hacked accounts; and databases from hacked forums and websites related to Runescape and other online games.</p>
<p>That 2017 report here interviewed a Michigan man who acknowledged being administrator of Abusewith[.]us, but denied being the operator of LeakedSource. Still, the story noted that LeakedSource likely had more than one operator, and breached records show Bloom was a prolific member of Abusewith[.]us.</p>
<p>In an email to all employees on Dec. 1, 2014, Ashley Madison&#8217;s director of HR said Bloom graduated from <a href="https://www.linkedin.com/school/york-university/" target="_blank" rel="noopener">York University</a> in Toronto with a degree in theoretical physics, and that he has been an active programmer since high school.</p>
<p>&#8220;He&#8217;s a proprietor of a high traffic multiplayer game and developer/publisher of utilities such as <strong>PicTrace</strong>,&#8221; the HR director enthused. &#8220;He will be a great addition to the team.&#8221;</p>
<p>PicTrace appears to have been a service that allowed users to glean information about anyone who viewed an image hosted on the platform, such as their Internet address, browser type and version number. A copy of <strong>pictrace[.]com</strong> from Archive.org in 2012 redirects to the domain <strong>qksnap.com</strong>, which <strong>DomainTools.com</strong> says was registered to a Jordan Bloom from Thornhill, ON that same year.</p>
<p>The street address listed in the registration records for qksnap.com &#8212; 204 Beverley Glen Blvd &#8212; also shows up in the registration records for <strong>leakadvisor[.]com</strong>, a domain registered in 2017 just months after Canadian authorities seized the servers running LeakedSource.</p>
<div id="attachment_64267" style="width: 757px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64267" decoding="async" loading="lazy" class=" wp-image-64267" src="media/dba0d7af.pictrace.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/pictrace.png" alt="" width="747" height="463" /><p id="caption-attachment-64267" class="wp-caption-text">Pictrace, one of Jordan Bloom&#8217;s early IT successes.</p></div>
<p>A review of passive DNS records from DomainTools indicates that in 2013 pictrace[.]com shared a server with just a handful of other domains, including <strong>Near-Reality[.]com</strong> &#8212; a popular <strong>RuneScape Private Server</strong> (RSPS) game based on the RuneScape MMORPG.</p>
<p>Copies of near-reality[.]com <a href="https://web.archive.org/web/20130502043108/http://www.near-reality.com/forums" target="_blank" rel="noopener">from 2013 via Archive.org</a> show the top of the community&#8217;s homepage was retrofitted with a message saying Near Reality was no longer available due to a copyright dispute. Although the site doesn&#8217;t specify the other party to the copyright dispute, it appears Near-Reality got sued by <strong>Jagex</strong>, the owner of RuneScape.</p>
<p>The message goes on to say the website will no longer &#8220;encourage, facilitate, enable or condone (i) any infringement of copyright in RuneScape or any other Jagex product; nor (ii) any breach of the terms and conditions of RuneScape or any other Jagex product.&#8221;</p>
<div id="attachment_38073" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-38073" decoding="async" loading="lazy" class="wp-image-38073" src="media/3a6d832b.runescape-580x328.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/02/runescape-580x328.png" alt="" width="748" height="423" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/02/runescape-580x328.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/02/runescape-768x434.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/02/runescape-940x531.png 940w, https://krebsonsecurity.com/wp-content/uploads/2017/02/runescape.png 984w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-38073" class="wp-caption-text">A scene from the MMORPG RuneScape.</p></div>
<h2>AGENTJAGS</h2>
<p>Near Reality also has <a href="https://www.linkedin.com/in/jordan-bloom-78b3b9b0/" target="_blank" rel="noopener">a Facebook page</a> that was last updated in 2019, when its owner posted a link to a news story about Defiant Tech&#8217;s guilty plea in the LeakedSource investigation. That Facebook page indicates Bloom also went by the nickname &#8220;<strong>Agentjags</strong>.&#8221;</p>
<p>&#8220;Just a quick PSA,&#8221; reads a post to the Near Reality Facebook page dated Jan. 21, 2018, which linked to a story about the charges against Bloom and a photo of Bloom standing in front of his lime-green Lamborghini. &#8220;Agentjags has got involved in some shady shit that may have compromised your personal details. I advise anyone who is using an old NR [Near Reality] password for anything remotely important should change it ASAP.&#8221;</p>
<p>By the beginning of 2016, Bloom was nowhere to be found, and was suspected of having fled his country for the Caribbean, according to the people commenting on the Near Reality Facebook page:</p>
<p>&#8220;Jordan aka Agentjags has gone missing,&#8221; wrote a presumed co-owner of the Facebook page. &#8220;He is supposedly hiding in St. Lucia, doing what he loved, scuba-diving. Any information to his whereabouts will be appreciated.&#8221;</p>
<p>KrebsOnSecurity ran the unusual nickname &#8220;AgentJags&#8221; through a search at <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a commercial service that tracks breached data sets. That search returned just a few dozen results &#8212; and virtually all were accounts at various RuneScape-themed sites, including a half-dozen accounts at Abusewith[.]us.</p>
<p>Constella found other &#8220;AgentJags&#8221; accounts tied to the email address <strong>ownagegaming1@gmail.com</strong>. The marketing firm <strong>Apollo.io</strong> experienced a data breach several years back, and according to Apollo the email address ownagegaming1@gmail.com belongs to Jordan Bloom in Ontario.</p>
<p>Constella also revealed that the password frequently used by ownagegaming1@gmail.com across many sites was some variation on &#8220;<strong>niggapls</strong>,&#8221; which <a href="https://krebsonsecurity.com/2017/02/who-ran-leakedsource-com/" target="_blank" rel="noopener">my 2017 report</a> found was also the password used by the administrator of LeakedSource.</p>
<p>Curiously, Constella discovered that the email <strong>eric.malek@rogers.com</strong> comes up when one searches for &#8220;AgentJags.&#8221; This is curious because emails leaked from Ashley Madison&#8217;s then-CEO Biderman show that Eric Malek from Toronto was the Ashley Madison employee who initially recommended Bloom for the PHP developer job.</p>
<p>According to DomainTools.com, Eric.Malek@rogers.com was used to register the domain <a href="https://web.archive.org/web/20160314104151/http://devjobs.ca/" target="_blank" rel="noopener">devjobs.ca</a>, which previously advertised &#8220;the most exciting developer jobs in Canada, delivered to you weekly.&#8221; Constella says eric.malek@rogers.com also had an account at Abusewith[.]us &#8212; under the nickname &#8220;<strong>Jags.</strong>&#8221;</p>
<p>Biderman&#8217;s email records show Eric Malek was also a PHP developer for Ashley Madison, and that he was hired into this position just a few months before Bloom &#8212; on Sept. 2, 2014.</p>
<p>The CEO&#8217;s leaked emails show Eric Malek resigned from his developer position at Ashley Madison on June 19, 2015 &#8212; just four days before Bloom would announce his departure. Both men left the company less than a month before the Impact Team announced they&#8217;d hacked Ashley Madison, and both said they were leaving for health-related reasons.</p>
<p>&#8220;Please note that Eric Malek has resigned from this position with Avid and his last day will be June 19th,&#8221; read <a href="media/a16d1c60.malek-departure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/malek-departure.png" target="_blank" rel="noopener">a June 5, 2015 email</a> from ALM&#8217;s HR director. &#8220;He is resigning to deal with some personal issues which include health issues. Because he is not sure how much time it will take to resolve, he is not requesting a leave of absence (his time off will be indefinite). Overall, he likes the company and plans to reach out to Trevor or I when the issues are resolved to see what is available at that time.&#8221;</p>
<p>A follow-up email from Biderman demanded, &#8220;want to know where he&#8217;s truly going&#8230;.,&#8221; and it&#8217;s unclear why there was friction with Malek&#8217;s departure. But <strong>ALM General Counsel Avi Weisman</strong> replied indicating that Malek probably would not sign an &#8220;Exit Acknowledgment Form&#8221; prior to leaving, and that the company had unanswered questions for Malek.</p>
<p>&#8220;Aneka should dig during exit interview,&#8221; Weisman wrote. &#8220;Let&#8217;s see if he balks at signing the Acknowledgment.&#8221;</p>
<div id="attachment_64285" style="width: 765px" class="wp-caption aligncenter"><a href="media/b173b6ac.malek-dig.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/malek-dig.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64285" decoding="async" loading="lazy" class="wp-image-64285" src="media/b173b6ac.malek-dig.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/malek-dig.png" alt="" width="755" height="360" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/07/malek-dig.png 885w, https://krebsonsecurity.com/wp-content/uploads/2023/07/malek-dig-768x366.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/07/malek-dig-782x373.png 782w" sizes="(max-width: 755px) 100vw, 755px" /></a><p id="caption-attachment-64285" class="wp-caption-text">An email dated June 5, 2015, from ALM General Counsel to Biderman, regarding an exit interview with Malek.</p></div>
<p>Bloom&#8217;s <a href="media/6b0c259f.jordanleaving.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/jordanleaving.png" target="_blank" rel="noopener">departure notice</a> from Ashley Madison&#8217;s HR person, dated June 23, 2015, read:</p>
<p>&#8220;Please note that Jordan Bloom has resigned from his position as PHP Developer with Avid. He is leaving for personal reasons. He has a neck issue that will require surgery in the upcoming months and because of his medical appointment schedule and the pain he is experiencing he can no longer commit to a full-time schedule. He may pick up contract work until he is back to 100%.&#8221;</p>
<p>A follow-up note to Biderman about this announcement read:</p>
<p>&#8220;Note that he has disclosed that he is independently wealthy so he can get by without FT work until he is on the mend. He has signed the Exit Acknowledgement Form already without issue. He also says he would consider reapplying to Avid in the future if we have opportunities available at that time.&#8221;</p>
<p>Perhaps Mr. Bloom hurt his neck from craning it around blind spots in his Lamborghini. Maybe it was from a bad scuba outing. Whatever the pain in Bloom&#8217;s neck was, it didn&#8217;t stop him from launching himself fully into LeakedSource[.]com, which was registered roughly one month after the Impact Team leaked data on 37 million Ashley Madison accounts.</p>
<p>Mr. Malek did not respond to multiple requests for comment. A now-deleted <strong>LinkedIn</strong> profile for Malek from December 2018 listed him as a &#8220;technical recruiter&#8221; from Toronto who also attended Mr. Bloom&#8217;s alma mater &#8212; York University. That resume did not mention Mr. Malek&#8217;s brief stint as a PHP developer at Ashley Madison.</p>
<p>&#8220;Developer, entrepreneur, and now technical recruiter of the most uncommon variety!&#8221; Mr. Malek&#8217;s LinkedIn profile enthused. &#8220;Are you a developer, or other technical specialist, interested in working with a recruiter who can properly understand your concerns and aspirations, technical, environmental and financial? Don&#8217;t settle for a &#8216;hack&#8217;; this is your career, let&#8217;s do it right! Connect with me on LinkedIn. Note: If you are not a resident of Canada/Toronto, I cannot help you.&#8221;</p>
<h2>INTERVIEW WITH BLOOM</h2>
<p>Mr. Bloom told KrebsOnSecurity he had no role in harming or hacking Ashley Madison. Bloom validated his identity by responding at one of the email addresses mentioned above, and agreed to field questions so long as KrebsOnSecurity agreed <a href="media/e97eb0c3.emailthreadwithjordanbloom.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/emailthreadwithjordanbloom.pdf" target="_blank" rel="noopener">to publish our email conversation in full</a> (PDF).</p>
<p>Bloom said Mr. Malek did recommend him for the Ashley Madison job, but that Mr. Malek also received a $5,000 referral bonus for doing so. Given Mr. Malek&#8217;s stated role as a technical recruiter, it seems likely he also recommended several other employees to Ashley Madison.</p>
<p>Bloom was asked whether anyone at the RCMP, Ashley Madison or any authority anywhere ever questioned him in connection with the July 2015 hack of Ashley Madison. He replied that he was called once by someone claiming to be from the Toronto Police Service asking if he knew anything about the Ashley Madison hack.</p>
<p>&#8220;The AM situation was not something they pursued according to the RCMP disclosure,&#8221; Bloom wrote. &#8220;Learning about the RCMP&#8217;s most advanced cyber investigative techniques and capabilities was very interesting though. I was eventually told information by a third party which included knowledge that law enforcement effectively knew who the hacker was, but didn&#8217;t have enough evidence to proceed with a case. That is the extent of my involvement with any authorities.&#8221;</p>
<p>As to his company&#8217;s guilty plea for operating LeakedSource, Bloom maintains that the judge at his preliminary inquiry found that even if everything the Canadian government alleged was true it would not constitute a violation of any law in Canada with respect the charges the RCMP leveled against him, which included unauthorized use of a computer and &#8220;mischief to data.&#8221;</p>
<p>&#8220;In Canada at the lower court level we are allowed to possess stolen information and manipulate our copies of them as we please,&#8221; Bloom said. &#8220;The judge however decided that a trial was required to determine whether any activities of mine were reckless, as the other qualifier of intentionally criminal didn&#8217;t apply. I will note here that nothing I was accused of doing would have been illegal if done in the United States of America according to their District Attorney. +1 for free speech in America vs freedom of expression in Canada.&#8221;</p>
<p>&#8220;Shortly after their having most of their case thrown out, the Government proposed an offer during a closed door meeting where they would drop all charges against me, provide full and complete personal immunity, and in exchange the Corporation which has since been dissolved would plead guilty,&#8221; Bloom continued. &#8220;The Corporation would also pay a modest fine.&#8221;</p>
<p>Bloom said he left Ashley Madison because he was bored, but he acknowledged starting LeakedSource partly in response to the Ashley Madison hack.</p>
<p>&#8220;I intended to leverage my gaming connections to get into security work including for other private servers such as Minecraft communities and others,&#8221; Bloom said. &#8220;After months of asking management for more interesting tasks, I became bored. Some days I had virtually nothing to do except spin in my chair so I would browse the source code for security holes to fix because I found it enjoyable.&#8221;</p>
<p>&#8220;I believe the decision to start LS [LeakedSource] was partly inspired by the AM hack itself, and the large number of people from a former friend group messaging me asking if XYZ person was in the leak after I revealed to them that I downloaded a copy and had the ability to browse it,&#8221; Bloom continued. &#8220;LS was never my idea &#8211; I was just a builder, and the only Canadian. In other countries it was never thought to be illegal on closer examination of their laws.&#8221;</p>
<p>Bloom said he still considers himself independently wealthy, and that still has the lime green Lambo. But he said he&#8217;s currently unemployed and can&#8217;t seem to land a job in what he views as his most promising career path: Information security.</p>
<p>&#8220;As I&#8217;m sure you&#8217;re aware, having negative media attention associated with alleged (key word) criminal activity can have a detrimental effect on employment, banking and relationships,&#8221; Bloom wrote. &#8220;I have no current interest in being a business owner, nor do I have any useful business ideas to be honest. I was and am interested in interesting Information Security/programming work but it&#8217;s too large of a risk for any business to hire someone who was formerly accused of a crime.&#8221;</p>
<p>If you liked this story, please consider reading the first two pieces in this series:</p>
<p><a href="https://krebsonsecurity.com/2023/07/seo-expert-hired-and-fired-by-ashley-madison-turned-on-company-promising-revenge/" target="_blank" rel="noopener">SEO Expert Hired and Fired by Ashley Madison Turned on Company, Promising Revenge</a></p>
<p><a href="https://krebsonsecurity.com/2023/07/top-suspect-in-2015-ashley-madison-hack-committed-suicide-in-2014/" target="_blank" rel="noopener">Top Suspect in 2015 Ashley Madison Hack Committed Suicide in 2014</a></p>


feed_id: https://krebsonsecurity.com/?p=64332
title: Few Fortune 100 Firms List Security Pros in Their Executive Ranks
uri: Few-Fortune-100-Firms-List-Security-Pros-in-Their-Executive-Ranks
url:
https://krebsonsecurity.com/2023/07/few-fortune-100-firms-list-security-pros-in-their-executive-ranks/

content:
<p>Many things have changed since 2018, such as the names of the companies in the Fortune 100 list. But one aspect of that vaunted list that hasn&#8217;t shifted much since is that very few of these companies list any security professionals within their top executive ranks.</p>
<p><img decoding="async" class="aligncenter wp-image-46058" src="media/dc67ffe1.board.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/12/board.jpg" alt="" width="750" height="375" /></p>
<p>The next time you receive a breach notification letter that invariably says a company you trusted places a top priority on customer security and privacy, consider this: Only four of the Fortune 100 companies currently list a security professional in the executive leadership pages of their websites. This is actually down from five of the Fortune 100 in 2018, the last time KrebsOnSecurity performed this analysis.</p>
<p>A review of the executives pages published by the 2022 list of Fortune 100 companies found only four &#8212; <strong>BestBuy</strong>, <strong>Cigna</strong>, <strong>Coca-Cola</strong>,  and <strong>Walmart</strong> &#8212; that listed a <strong>Chief Security Officer</strong> (CSO) or <strong>Chief Information Security Officer</strong> (CISO) in their highest corporate ranks.</p>
<p>One-third of last year&#8217;s Fortune 100 companies included a <strong>Chief Technology Officer</strong> (CTO) in their executive stables; 40 listed <strong>Chief Information Officer</strong> (CIO) roles, but just 21 included a <strong>Chief Risk Officer</strong> (CRO).</p>
<p>As <a href="https://krebsonsecurity.com/2018/12/a-chief-security-concern-for-executive-teams/" target="_blank" rel="noopener">I noted in 2018</a>, this is not to say that 96 percent of the Fortune 100 companies don’t have a CISO or CSO in their employ: A review of LinkedIn suggests that most of them in fact <em>do</em> have people in those roles, and experts say some of the largest multinational companies will have multiple people in these positions.</p>
<p>But it is interesting to note which executive positions the top companies deem worth publishing in their executive leadership pages. For example, 88 percent listed a <strong>Director of Human Resources</strong> (or &#8220;Chief People Officer&#8221;), and 37 out of 100 included a <strong>Chief Marketing Officer</strong>.</p>
<p>Not that these roles are somehow more or less important than that of a CISO/CSO within the organization. Nor is the average pay hugely different among all three roles. Yet, considering how much marketing (think consumer/customer data) and human resources (think employee personal/financial data) are impacted by your average data breach, it’s somewhat remarkable that more companies <em>don’t</em> list their chief security personnel among their top ranks.</p>
<p>One likely explanation as to why a great many companies still don&#8217;t include their security leaders within their highest echelons is that these employees do not report directly to the company’s CEO, board of directors, or Chief Risk Officer.</p>
<p>The CSO or CISO position traditionally has reported to an executive in a technical role, such as the CTO or CIO. But workforce experts say placing the CISO/CSO on unequal footing with the organization&#8217;s top leaders makes it more likely that cybersecurity and risk concerns will take a backseat to initiatives designed to increase productivity and generally grow the business.</p>
<p>&#8220;Separation of duties is a fundamental concept of security, whether we&#8217;re talking about cyber threats, employee fraud, or physical theft,&#8221; said <strong>Tari Schreider</strong>, an analyst with <strong>Datos Insights</strong>. &#8220;But that critical separation is violated every day with the CISO or CSO reporting to the heads of technology.&#8221;</p>
<p><strong>IANS</strong>, an organization geared toward CISOs/CSOs and their teams, <a href="https://www.iansresearch.com/resources/all-blogs/post/security-blog/2021/04/29/what-is-the-ideal-ciso-reporting-structure" target="_blank" rel="noopener">surveyed</a> more than 500 organizations last year and found roughly 65 percent of CISOs still report to a technical leader, such as the CTO or CIO: IANS found 46 percent of CISOs reported to a CIO, with 15 percent reporting directly to a CTO.</p>
<div id="attachment_64337" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64337" decoding="async" loading="lazy" class=" wp-image-64337" src="media/efb2b70f.ians-c-graphic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/ians-c-graphic.png" alt="" width="749" height="413" /><p id="caption-attachment-64337" class="wp-caption-text">A survey last year by IANS found 65 percent of CISOs report to a tech function within organizations, such as the CTO or CIO. Image: IANS Research.</p></div>
<p>Schreider said one big reason many CISOs and CSOs aren&#8217;t listed in corporate executive biographies at major companies is that these positions often do not enjoy the same legal and insurance protections afforded to other officers within the company, Schreider said.</p>
<p>Typically, larger companies will purchase a &#8220;Directors and Officers&#8221; liability policy that covers legal expenses should one of the organization&#8217;s top executives find themselves dragged into court over some business failing on the part of their employer. But organizations that do not offer this coverage to their security leaders are unlikely to list those positions in their highest ranks, Schreider said.</p>
<p>&#8220;It&#8217;s frankly shocking,&#8221; Schreider said, upon hearing that only four of the Fortune 100 listed any security personnel in their top executive hierarchies. &#8220;If the company isn&#8217;t going to give them legal cover, then why give them the responsibility for security? Especially when CISOs and CSOs shouldn&#8217;t own the risk, yet the majority of them carry the mantle of responsibility and they tend to be scapegoats&#8221; when the organization eventually gets hacked, he said.<span id="more-64332"></span></p>
<p>Schreider said while Datos Insights focuses mostly on the financial and insurance industries, a recent Datos survey echoes the IANS findings from last year. Datos surveyed 25 of the largest financial institutions by asset size (two of which are no longer in existence), and found just 22 percent of CSOs/CISOs reported to the CEO. A majority &#8212; 65 percent &#8212; had their CSOs/CISOs reporting to either a CTO or CIO.</p>
<p>&#8220;I&#8217;ve looked at these types of statistics for years and they&#8217;ve never really changed that much,&#8221; Schreider said. &#8220;The CISO or CSO is in the purview of the technical stack from a management perspective. Right, wrong or indifferent, that&#8217;s what&#8217;s happening.&#8221;</p>
<p>Earlier this year, IT consulting firm <strong>Accenture</strong> <a href="https://www.accenture.com/content/dam/accenture/final/accenture-com/document/Accenture-State-Cybersecurity.pdf#zoom=40" target="_blank" rel="noopener">released results</a> from surveying more than 3,000 respondents from 15 industries across 14 countries about their <a href="https://krebsonsecurity.com/2015/04/whats-your-security-maturity-level/" target="_blank" rel="noopener">security maturity</a> levels. Accenture found that only about one-third of the organizations they surveyed had enough security maturity under their belts to have integrated security into virtually every aspect of their businesses &#8212; and this includes having CISOs or CSOs report to someone in charge of overseeing risk for the business as a whole.</p>
<p>Not surprisingly, Accenture also found that only a third of respondents considered cybersecurity risk “to a great extent” when evaluating overall enterprise risk.</p>
<p>&#8220;This highlights there is still some way to go to make cybersecurity a proactive, strategic necessity within the business,&#8221; the report concluded.</p>
<div id="attachment_29580" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-29580" decoding="async" loading="lazy" class=" wp-image-29580" src="media/5b3d8118.SecurityMaturity.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png" alt="" width="750" height="520" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity.png 1071w, https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-285x198.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/11/SecurityMaturity-600x416.png 600w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-29580" class="wp-caption-text">One way of depicting the different stages of security maturity.</p></div>
<p>A spreadsheet tracking the prevalence of security leaders on the executive pages of the 2022 Fortune 100 firms is available <a href="https://docs.google.com/spreadsheets/d/1zo5d1in2Q-Pnj2H0TQNnwcbR_we6PFTrFVxXkS8Zk6c/edit?usp=sharing" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=60813
title: Who and What is Behind the Malware Proxy Service SocksEscort?
uri: Who-and-What-is-Behind-the-Malware-Proxy-Service-SocksEscort
url: https://krebsonsecurity.com/2023/07/who-and-what-is-behind-the-malware-proxy-service-socksescort/
content:
<p>Researchers this month uncovered a two-year-old Linux-based remote access trojan dubbed <strong>AVrecon</strong> that enslaves Internet routers into botnet that bilks online advertisers and performs password-spraying attacks. Now new findings reveal that AVrecon is the malware engine behind a 12-year-old service called <strong>SocksEscort</strong>, which rents hacked residential and small business devices to cybercriminals looking to hide their true location online.</p>
<div id="attachment_64376" style="width: 673px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64376" decoding="async" class=" wp-image-64376" src="media/0b341051.avrecon.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/avrecon.png" alt="" width="663" height="509" /><p id="caption-attachment-64376" class="wp-caption-text">Image: Lumen&#8217;s Black Lotus Labs.</p></div>
<p>In a report released July 12, researchers at Lumen&#8217;s <strong>Black Lotus Labs</strong> called the AVrecon botnet &#8220;one of the largest botnets targeting small-office/home-office (SOHO) routers seen in recent history,&#8221; and a crime machine that has largely evaded public attention since first being spotted in mid-2021.</p>
<p>&#8220;The malware has been used to create residential proxy services to shroud malicious activity such as <a href="https://www.crowdstrike.com/cybersecurity-101/password-spraying/" target="_blank" rel="noopener">password spraying</a>, web-traffic proxying and ad fraud,&#8221; the Lumen researchers <a href="https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/" target="_blank" rel="noopener">wrote</a>.</p>
<p>Malware-based anonymity networks are a major source of unwanted and malicious web traffic directed at online retailers, Internet service providers (ISPs), social networks, email providers and financial institutions. And a great many of these &#8220;proxy&#8221; networks are marketed primarily to cybercriminals seeking to anonymize their traffic by routing it through an infected PC, router or mobile device.</p>
<p>Proxy services can be used in a legitimate manner for several business purposes — such as price comparisons or sales intelligence — but they are massively abused for hiding cybercrime activity because they make it difficult to trace malicious traffic to its original source. Proxy services also let users appear to be getting online from nearly anywhere in the world, which is useful if you&#8217;re a cybercriminal who is trying to impersonate someone from a specific place.</p>
<p><a href="https://www.spur.us/" target="_blank" rel="noopener">Spur.us</a>, a startup that tracks proxy services, told KrebsOnSecurity that the Internet addresses Lumen tagged as the AVrecon botnet&#8217;s &#8220;Command and Control&#8221; (C2) servers all tie back to a long-running proxy service called <strong>SocksEscort</strong>.</p>
<p><strong>SocksEscort[.]com</strong>, is what’s known as a &#8220;SOCKS Proxy&#8221; service. The SOCKS (or SOCKS5) protocol allows Internet users to channel their Web traffic through a proxy server, which then passes the information on to the intended destination. From a website’s perspective, the traffic of the proxy network customer appears to originate from a rented/malware-infected PC tied to a residential ISP customer, not from the proxy service customer.</p>
<div id="attachment_60702" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60702" decoding="async" loading="lazy" class=" wp-image-60702" src="media/6395f428.socksescort-home.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/socksescort-home.png" alt="" width="750" height="677" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/socksescort-home.png 884w, https://krebsonsecurity.com/wp-content/uploads/2022/08/socksescort-home-768x693.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/socksescort-home-782x706.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-60702" class="wp-caption-text">The SocksEscort home page says its services are perfect for people involved in automated online activity that often results in IP addresses getting blocked or banned, such as Craigslist and dating scams, search engine results manipulation, and online surveys.</p></div>
<p>Spur tracks SocksEscort as a malware-based proxy offering, which means the machines doing the proxying of traffic for SocksEscort customers have been infected with malicious software that turns them into a traffic relay. Usually, these users have no idea their systems are compromised.</p>
<p>Spur says the SocksEscort proxy service requires customers to install a Windows based application in order to access a pool of more than 10,000 hacked devices worldwide.</p>
<p>&#8220;We created a fingerprint to identify the call-back infrastructure for SocksEscort proxies,&#8221; Spur co-founder <strong>Riley Kilmer</strong> said. &#8220;Looking at network telemetry, we were able to confirm that we saw victims talking back to it on various ports.&#8221;</p>
<p>According to Kilmer, AVrecon is the malware that gives SocksEscort its proxies.</p>
<p>&#8220;When Lumen released their report and IOCs [indicators of compromise], we queried our system for which proxy service call-back infrastructure overlapped with their IOCs,&#8221; Kilmer continued. &#8220;The second stage C2s they identified were the same as the IPs we labeled for SocksEscort.&#8221;</p>
<p>Lumen&#8217;s research team said the purpose of AVrecon appears to be stealing bandwidth – without impacting end-users – in order to create a residential proxy service to help launder malicious activity and avoid attracting the same level of attention from <a href="https://community.torproject.org/onion-services/setup/" target="_blank" rel="noopener">Tor-hidden services</a> or commercially available VPN services.</p>
<p>&#8220;This class of cybercrime activity threat may evade detection because it is less likely than a crypto-miner to be noticed by the owner, and it is unlikely to warrant the volume of abuse complaints that internet-wide brute-forcing and DDoS-based botnets typically draw,&#8221; Lumen&#8217;s Black Lotus researchers wrote.</p>
<p>Preserving bandwidth for both customers and victims was a primary concern for SocksEscort in July 2022, when 911S5 &#8212; at the time the world&#8217;s largest known malware proxy network &#8212; <a href="https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/" target="_blank" rel="noopener">got hacked and imploded</a> just days after <a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" target="_blank" rel="noopener">being exposed in a story here</a>. Kilmer said after 911&#8217;s demise, SocksEscort closed its registration for several months to prevent an influx of new users from swamping the service.</p>
<p><strong>Danny Adamitis</strong>, principal information security researcher at Lumen and co-author of the report on AVrecon, confirmed Kilmer&#8217;s findings, saying the C2 data matched up with what Spur was seeing for SocksEscort dating back to September 2022.</p>
<p>Adamitis said that on July 13 &#8212; the day after Lumen published research on AVrecon and started blocking any traffic to the malware&#8217;s control servers &#8212; the people responsible for maintaining the botnet reacted quickly to transition infected systems over to a new command and control infrastructure.</p>
<p>&#8220;They were clearly reacting and trying to maintain control over components of the botnet,&#8221; Adamitis said. &#8220;Probably, they wanted to keep that revenue stream going.&#8221;</p>
<p>Frustratingly, Lumen was not able to determine how the SOHO devices were being infected with AVrecon. Some possible avenues of infection include exploiting weak or default administrative credentials on routers, and outdated, insecure firmware that has known, exploitable security vulnerabilities.<br />
<span id="more-60813"></span></p>
<h2>WHO&#8217;S BEHIND SOCKSESCORT?</h2>
<p>KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/08/no-socks-no-shoes-no-malware-proxy-services/" target="_blank" rel="noopener">briefly visited SocksEscort last year</a> and promised a follow-up on the history and possible identity of its proprietors. A review of the earliest posts about this service on Russian cybercrime forums suggests the 12-year-old malware proxy network is tied to a Moldovan company that also offers VPN software on the Apple Store and elsewhere.</p>
<p>SocksEscort began in 2009 as &#8220;<a href="https://web.archive.org/web/20130406151624/http://super-socks.biz/" target="_blank" rel="noopener"><strong>super-socks[.]com</strong></a>,&#8221; a Russian-language service that sold access to thousands of compromised PCs that could be used to proxy traffic. Someone who picked the nicknames &#8220;<strong>SSC</strong>&#8221; and &#8220;<strong>super-socks</strong>&#8221; and email address &#8220;<strong>michvatt@gmail.com</strong>&#8221; registered on multiple cybercrime forums and began promoting the proxy service.</p>
<p>According to <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a>, the apparently related email address &#8220;<strong>michdomain@gmail.com</strong>&#8221; was used to register SocksEscort[.]com, super-socks[.]com, and a few other proxy-related domains, including <strong>ip-score[.]com</strong>, segate[.]org seproxysoft[.]com, and <strong>vipssc[.]us</strong>. Cached versions of both super-socks[.]com and <a href="https://web.archive.org/web/20111028204532/http://www.vipssc.us/" target="_blank" rel="noopener">vipssc[.]us</a> show these sites sold the same proxy service, and both displayed the letters &#8220;<strong>SSC</strong>&#8221; prominently at the top of their homepages.</p>
<div id="attachment_61059" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-61059" decoding="async" loading="lazy" class="wp-image-61059" src="media/cbb20191.ssc-proxy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/08/ssc-proxy.png" alt="" width="750" height="593" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/08/ssc-proxy.png 982w, https://krebsonsecurity.com/wp-content/uploads/2022/08/ssc-proxy-768x607.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/08/ssc-proxy-782x618.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-61059" class="wp-caption-text">Image: Archive.org. Page translation from Russian via Google Translate.</p></div>
<p>According to cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, the very first &#8220;SSC&#8221; identity registered on the cybercrime forums happened in 2009 at the Russian language hacker community <strong>Antichat</strong>, where SSC registered using the email address <strong>adriman@gmail.com</strong>. SSC asked fellow forum members for help in testing the security of a website they claimed was theirs: <a href="https://web.archive.org/web/20090109091552/http://myiptest.com/" target="_blank" rel="noopener">myiptest[.]com</a>, which promised to tell visitors whether their proxy address was included on any security or anti-spam block lists.</p>
<p>DomainTools says myiptest[.]com was registered in 2008 to an <strong>Adrian Crismaru</strong> from Chisinau, Moldova. Myiptest[.]com is no longer responding, but a cached copy of it from <a href="https://web.archive.org/web/20100102003637/http://myiptest.com/" target="_blank" rel="noopener">Archive.org</a> shows that for about four years it included in its HTML source a Google Analytics code of <strong>US-2665744</strong>, which was also present on more than a dozen other websites.</p>
<p>Most of the sites that once bore that Google tracking code are no longer online, but nearly all of them centered around services that were similar to myiptest[.]com, such as <strong>abuseipdb[.]com</strong>, <strong>bestiptest[.]com</strong>, <strong>checkdnslbl[.]com</strong>,<strong> dnsbltools[.]com</strong> and <strong>dnsblmonitor[.]com</strong>.</p>
<p>Each of these services were designed to help visitors quickly determine whether the Internet address they were visiting the site <em>from</em> was listed by any security firms as spammy, malicious or phishous. In other words, these services were designed so that proxy service users could easily tell if their rented Internet address was still safe to use for online fraud.</p>
<p>Another domain with the Google Analytics code US-2665744 was<strong> sscompany[.]net</strong>. <a href="https://web.archive.org/web/20090205172352/http://sscompany.net:80/" target="_blank" rel="noopener">An archived copy of the site</a> says SSC stands for &#8220;<strong>Server Support Company</strong>,&#8221; which advertised outsourced solutions for technical support and server administration. The company was located in Chisinau, Moldova and owned by Adrian Crismaru.</p>
<p>Leaked copies of the hacked Antichat forum indicate the SSC identity tied to adriman@gmail.com registered on the forum using the IP address <strong>71.229.207.214</strong>. That same IP was used to register the nickname &#8220;<strong>Deem3n®,</strong>&#8221; a prolific poster on Antichat between 2005 and 2009 who served as a moderator on the forum.</p>
<p>There was a <strong>Deem3n® </strong>user on the webmaster forum Searchengines.guru whose signature in their posts says they run a popular community catering to programmers in Moldova called <strong>sysadmin[.]md</strong>, and that they were a systems administrator for sscompany[.]net.</p>
<p>That same Google Analytics code is also now present on the homepages of <strong>wiremo[.]co</strong> and a VPN provider called <strong>HideIPVPN[.]com</strong>.</p>
<p><a href="https://web.archive.org/web/20230209032519/https://wiremo.co/" target="_blank" rel="noopener">Wiremo</a> sells software and services to help website owners better manage their customer reviews. Wiremo&#8217;s Contact Us page lists a &#8220;<strong>Server Management LLC</strong>&#8221; in Wilmington, DE as the parent company. Records from the Delaware Secretary of State indicate Crismaru is CEO of this company.</p>
<p>Server Management LLC is <a href="https://apps.apple.com/ru/app/hideipvpn-vpn-smart-dns/id964479810" target="_blank" rel="noopener">currently listed</a> in Apple&#8217;s App Store as the owner of a &#8220;free&#8221; VPN app called <strong>HideIPVPN</strong>. The contact information on <a href="https://www.linkedin.com/in/adriancrismaru/" target="_blank" rel="noopener">Crismaru&#8217;s LinkedIn page</a> says his company websites include myiptest[.]com, sscompany[.]net, and hideipvpn[.]com.</p>
<p>&#8220;The best way to secure the transmissions of your mobile device is VPN,&#8221; reads HideIPVPN&#8217;s description on the Apple Store. &#8220;Now, we provide you with an even easier way to connect to our VPN servers. We will hide your IP address, encrypt all your traffic, secure all your sensitive information (passwords, mail credit card details, etc.) form [sic] hackers on public networks.&#8221;</p>
<p>Mr. Crismaru did not respond to multiple requests for comment. When asked about the company&#8217;s apparent connection to SocksEscort, Wiremo responded, &#8220;We do not control this domain and no one from our team is connected to this domain.&#8221; Wiremo did not respond when presented with the findings in this report.</p>


feed_id: https://krebsonsecurity.com/?p=64413
title: Russia Sends Cybersecurity CEO to Jail for 14 Years
uri: Russia-Sends-Cybersecurity-CEO-to-Jail-for-14-Years
url: https://krebsonsecurity.com/2023/07/russia-sends-cybersecurity-ceo-to-jail-for-14-years/
content:
<p>The Russian government today handed down a treason conviction and 14-year prison sentence on <strong>Iyla Sachkov</strong>, the former founder and CEO of one of Russia&#8217;s largest cybersecurity firms. Sachkov, 37, has been detained for nearly two years under charges that the Kremlin has kept classified and hidden from public view, and he joins a growing roster of former Russian cybercrime fighters who are now serving hard time for farcical treason convictions.</p>
<div id="attachment_64415" style="width: 292px" class="wp-caption alignright"><img aria-describedby="caption-attachment-64415" decoding="async" class=" wp-image-64415" src="media/24d122fc.sachkov.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/07/sachkov.png" alt="" width="282" height="288" /><p id="caption-attachment-64415" class="wp-caption-text">Ilya Sachkov. Image: Group-IB.com.</p></div>
<p>In 2003, Sachkov founded <strong>Group-IB</strong>, a cybersecurity and digital forensics company that quickly earned a reputation for exposing and disrupting large-scale cybercrime operations, including quite a few that were based in Russia and stealing from Russian companies and citizens.</p>
<p>In September 2021, the Kremlin issued treason charges against Sachkov, although it has refused to disclose any details about the allegations. Sachkov pleaded not guilty. After a three-week &#8220;trial&#8221; that was closed to the public, Sachkov was convicted of treason and <a href="https://www.seattletimes.com/business/technology/top-russian-cybersecurity-executive-sentenced-to-14-years-for-treason/" target="_blank" rel="noopener">sentenced to 14 years in prison</a>. Prosecutors had asked for 18 years.</p>
<p>Group-IB relocated its headquarters to Singapore several years ago, although it did not fully exit the Russian market until April 2023. In a statement, Group-IB said that during their founder&#8217;s detainment, he was denied the right to communicate — no calls, no letters — with the outside world for the first few months, and was deprived of any visits from family and friends.</p>
<p>&#8220;Ultimately, Ilya has been denied a chance for an impartial trial,&#8221; reads a blog post on the company&#8217;s site. &#8220;All the materials of the case are kept classified, and all hearings were held in complete secrecy with no public scrutiny. As a result, we might never know the pretext for his conviction.&#8221;</p>
<p>Prior to his arrest in 2021, Sachkov publicly chastised the Kremlin for turning a blind eye to the epidemic of ransomware attacks coming from Russia. In a speech covered by the <em>Financial Times</em> in 2021, Sachkov railed against the likes of Russian hacker <strong>Maksim Yakubets</strong>, the accused head of a hacking group called <a href="https://krebsonsecurity.com/2019/12/inside-evil-corp-a-100m-cybercrime-menace/" target="_blank" rel="noopener">Evil Corp.</a> that U.S. officials say has stolen hundreds of millions of dollars over the past decade.<span id="more-64413"></span></p>
<p>&#8220;Yakubets has been spotted driving around Moscow in a fluorescent camouflage Lamborghini, with a custom licence plate that reads &#8216;THIEF,'&#8221; FT&#8217;s <strong>Max Seddon</strong> <a href="https://www.ft.com/content/ac0f8029-bb18-45e8-bb2c-f79dbe580ab6" target="_blank" rel="noopener">wrote</a>. &#8220;He also &#8216;provides direct assistance to the Russian government’s malicious cyber efforts,&#8217; according to US Treasury sanctions against him.&#8221;</p>
<p>In December 2021, <em>Bloomberg</em> <a href="https://www.bloomberg.com/news/features/2021-12-03/who-is-ilya-sachkov-russian-cyber-ceo-linked-to-2016-election-fancy-bear-leaks" target="_blank" rel="noopener">reported</a> that Sachkov was alleged to have given the United States information about the Russian &#8220;<strong>Fancy Bear</strong>&#8221; operation that sought to influence the 2016 U.S. election. <a href="https://en.wikipedia.org/wiki/Fancy_Bear" target="_blank" rel="noopener">Fancy Bear</a> is one of several names (e.g., APT28) for an advanced Russian cyber espionage group that has been linked to the Russian military intelligence agency <a title="GRU (Russian Federation)" href="https://en.wikipedia.org/wiki/GRU_(Russian_Federation)">GRU</a>.</p>
<p>In 2019, a Moscow court <a href="https://krebsonsecurity.com/2019/02/former-russian-cybersecurity-chief-sentenced-to-22-years-in-prison/" target="_blank" rel="noopener">meted out a 22-year prison sentence</a> for alleged treason charges against <strong>Sergei Mikhailov</strong>, formerly deputy chief of Russia&#8217;s top anti-cybercrime unit. The court also levied a 14-year sentence against <strong>Ruslan Stoyanov</strong>, a senior employee at <strong>Kaspersky Lab</strong>. Both men maintained their innocence throughout the trial, and the supposed reason for the treason charges has never been disclosed.</p>
<p>Following their dramatic arrests in 2016, some media outlets reported that the men were suspected of having tipped off American intelligence officials about those responsible for Russian hacking activities tied to the 2016 U.S. presidential election.</p>
<p>That’s because two others arrested for treason at the same time — Mikhailov subordinates Georgi Fomchenkov and Dmitry Dokuchaev — were reported by Russian media to have helped the FBI investigate Russian servers linked to the 2016 hacking of the Democratic National Committee.</p>


feed_id: https://krebsonsecurity.com/?p=64430
title: How Malicious Android Apps Slip Into Disguise
uri: How-Malicious-Android-Apps-Slip-Into-Disguise
url: https://krebsonsecurity.com/2023/08/how-malicious-android-apps-slip-into-disguise/
content:
<p><img decoding="async" class="aligncenter wp-image-64468" src="media/c357aeff.grandroidude.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/grandroidude.png" alt="" width="750" height="481" /></p>
<p>Researchers say mobile malware purveyors have been abusing a bug in the <strong>Google Android</strong> platform that lets them sneak malicious code into mobile apps and evade security scanning tools. Google says it has updated its app malware detection mechanisms in response to the new research.</p>
<p>At issue is a mobile malware obfuscation method identified by researchers at <a href="https://www.threatfabric.com" target="_blank" rel="noopener">ThreatFabric</a>, a security firm based in Amsterdam. <strong>Aleksandr Eremin</strong>, a senior malware analyst at the company, told KrebsOnSecurity they recently encountered a number of mobile banking trojans abusing a bug present in all Android OS versions that involves corrupting components of an app so that its new evil bits will be ignored as invalid by popular mobile security scanning tools, while the app as a whole gets accepted as valid by Android OS and successfully installed.</p>
<p>&#8220;There is malware that is patching the .apk file [the app installation file], so that the platform is still treating it as valid and runs all the malicious actions it&#8217;s designed to do, while at the same time a lot of tools designed to unpack and decompile these apps fail to process the code,&#8221; Eremin explained.</p>
<p>Eremin said ThreatFabric has seen this malware obfuscation method used a few times in the past, but in April 2023 it started finding many more variants of known mobile malware families leveraging it for stealth. The company has since attributed this increase to a semi-automated malware-as-a-service offering in the cybercrime underground that will obfuscate or &#8220;crypt&#8221; malicious mobile apps for a fee.</p>
<p>Eremin said Google flagged their initial May 9, 2023 report as &#8220;high&#8221; severity. More recently, Google awarded them a $5,000 bug bounty, even though it did not technically classify their finding as a security vulnerability.</p>
<p>&#8220;This was a unique situation in which the reported issue was not classified as a vulnerability and did not impact the Android Open Source Project (AOSP), but did result in an update to our malware detection mechanisms for apps that might try to abuse this issue,&#8221; Google said in a written statement.</p>
<p>Google also acknowledged that some of the tools it makes available to developers &#8212; including <a href="https://developer.android.com/tools/apkanalyzer" target="_blank" rel="noopener">APK Analyzer</a> &#8212; currently fail to parse such malicious applications and treat them as invalid, while still allowing them to be installed on user devices.</p>
<p>&#8220;We are investigating possible fixes for developer tools and plan to update our documentation accordingly,&#8221; Google&#8217;s statement continued.</p>
<div id="attachment_64470" style="width: 711px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64470" decoding="async" loading="lazy" class="size-full wp-image-64470" src="media/927a8b8b.tf-apk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/tf-apk.png" alt="" width="701" height="399" /><p id="caption-attachment-64470" class="wp-caption-text">Image: ThreatFabric.</p></div>
<p><span id="more-64430"></span></p>
<p>According to ThreatFabric, there are a few telltale signs that app analyzers can look for that may indicate a malicious app is abusing the weakness to masquerade as benign. For starters, they found that apps modified in this way have <a href="https://maldr0id.blogspot.com/2014/09/having-fun-with-androidmanifestxml.html" target="_blank" rel="noopener">Android Manifest files</a> that contain newer timestamps than the rest of the files in the software package.</p>
<p>More critically, the Manifest file itself will be changed so that the number of &#8220;strings&#8221; &#8212; plain text in the code, such as comments &#8212; specified as present in the app does match the actual number of strings in the software.</p>
<p>One of the mobile malware families known to be abusing this obfuscation method has been dubbed <strong>Anatsa</strong>, which is a sophisticated Android-based banking trojan that typically is disguised as a harmless application for managing files. Last month, ThreatFabric <a href="https://www.threatfabric.com/blogs/anatsa-hits-uk-and-dach-with-new-campaign" target="_blank" rel="noopener">detailed</a> how the crooks behind Anatsa will purchase older, abandoned file managing apps, or create their own and let the apps build up a considerable user base before updating them with malicious components.</p>
<p>ThreatFabric says Anatsa poses as PDF viewers and other file managing applications because these types of apps already have advanced permissions to remove or modify other files on the host device. The company estimates the people behind Anatsa have delivered more than 30,000 installations of their banking trojan via ongoing Google Play Store malware campaigns.</p>
<p>Google has come under fire in recent months for failing to more proactively police its Play Store for malicious apps, or for once-legitimate applications that later go rogue. <a href="https://arstechnica.com/information-technology/2023/05/app-with-50000-google-play-installs-sent-attackers-mic-recordings-every-15-minutes/" target="_blank" rel="noopener">This May 2023 story</a> from <em>Ars Technica</em> about a formerly benign screen recording app that turned malicious after garnering 50,000 users notes that Google doesn&#8217;t comment when malware is discovered on its platform, beyond thanking the outside researchers who found it and saying the company removes malware as soon as it learns of it.</p>
<p>&#8220;The company has never explained what causes its own researchers and automated scanning process to miss malicious apps discovered by outsiders,&#8221; Ars&#8217; <strong>Dan Goodin</strong> wrote. &#8220;Google has also been reluctant to actively notify Play users once it learns they were infected by apps promoted and made available by its own service.&#8221;</p>
<p>The Ars story mentions one potentially positive change by Google of late: A preventive measure available in Android versions 11 and higher that implements &#8220;app hibernation,&#8221; which puts apps that have been dormant into a hibernation state that removes their previously granted runtime permissions.</p>


feed_id: https://krebsonsecurity.com/?p=64427
title: Teach a Man to Phish and He’s Set for Life
uri: Teach-a-Man-to-Phish-and-He-s-Set-for-Life
url: https://krebsonsecurity.com/2023/08/teach-a-man-to-phish-and-hes-set-for-life/
content:
<p>One frustrating aspect of email phishing is the frequency with which scammers fall back on tried-and-true methods that really have no business working these days. Like attaching a phishing email to a traditional, clean email message, or leveraging link redirects on <strong>LinkedIn</strong>, or abusing an encoding method that makes it easy to disguise booby-trapped <strong>Microsoft Windows</strong> files as relatively harmless documents.</p>
<p>KrebsOnSecurity recently heard from a reader who was puzzled over an email he&#8217;d just received saying he needed to review and complete a supplied W-9 tax form. The missive was made to appear as if it were part of a mailbox delivery report from <strong>Microsoft 365</strong> about messages that had failed to deliver.</p>
<p>The reader, who asked to remain anonymous, said the phishing message contained an attachment that appeared to have a file extension of &#8220;.pdf,&#8221; but something about it seemed off. For example, when he downloaded and tried to rename the file, the right arrow key on the keyboard moved his cursor to the left, and vice versa.</p>
<p>The file included in this phishing scam uses what&#8217;s known as a &#8220;right-to-left override&#8221; or RLO character. RLO is a special character within unicode &#8212; an encoding system that allows computers to exchange information regardless of the language used &#8212; that supports languages written from right to left, such as Arabic and Hebrew.</p>
<p>Look carefully at the screenshot below and you&#8217;ll notice that while Microsoft Windows says the file attached to the phishing message is named &#8220;lme.pdf,&#8221; the full filename is &#8220;pdf.eml Properties&#8221; spelled backwards. In essence, this is a .eml file &#8212; an electronic mail format or email saved in plain text &#8212; masquerading as a .PDF file.</p>
<p><a href="media/bce7c3db.lme-phish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/lme-phish.png" target="_blank" rel="noopener"><img decoding="async" class="aligncenter wp-image-64481" src="media/bce7c3db.lme-phish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/lme-phish.png" alt="" width="751" height="453" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/lme-phish.png 960w, https://krebsonsecurity.com/wp-content/uploads/2023/08/lme-phish-768x463.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/lme-phish-782x472.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a></p>
<p>&#8220;The email came through Microsoft Office 365 with all the detections turned on and was not caught,&#8221; the reader continued. &#8220;When the same email is sent through Mimecast, Mimecast is smart enough to detect the encoding and it renames the attachment to &#8216;___fdp.eml.&#8217; One would think Microsoft would have had plenty of time by now to address this.&#8221;</p>
<p>Indeed, KrebsOnSecurity first covered RLO-based phishing attacks <a href="https://krebsonsecurity.com/2011/09/right-to-left-override-aids-email-attacks/" target="_blank" rel="noopener">back in 2011</a>, and even then it wasn&#8217;t a new trick.</p>
<p>Opening the .eml file generates a rendering of a webpage that mimics an alert from Microsoft about wayward messages awaiting restoration to your inbox. Clicking on the &#8220;Restore Messages&#8221; link there bounces you through an open redirect on <strong>LinkedIn</strong> before forwarding to the phishing webpage.</p>
<p>As <a href="https://krebsonsecurity.com/2022/02/how-phishers-are-slinking-their-links-into-linkedin/" target="_blank" rel="noopener">noted here last year</a>, scammers have long taken advantage of a marketing feature on the business networking site which lets them create a LinkedIn.com link that bounces your browser to other websites, such as phishing pages that mimic top online brands (but chiefly Linkedin’s parent firm Microsoft).<span id="more-64427"></span></p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-64482" src="media/16f42899.rlomessage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/rlomessage.png" alt="" width="751" height="617" /></p>
<p>The landing page after the LinkedIn redirect displays what appears to be an Office 365 login page, which is naturally a phishing website made to look like an official Microsoft Office property.</p>
<p>In summary, this phishing scam uses an old RLO trick to fool Microsoft Windows into thinking the attached file is something else, and when clicked the link uses an open redirect on a Microsoft-owned website (LinkedIn) to send people to a phishing page that spoofs Microsoft and tries to steal customer email credentials.</p>
<p>According to the latest figures from <strong>Check Point Software</strong>, Microsoft was <a href="https://www.checkpoint.com/press-releases/microsoft-dominates-as-the-most-impersonated-brand-for-phishing-scams-in-q2-2023/" target="_blank" rel="noopener">by far the most impersonated brand for phishing scams</a> in the second quarter of 2023, accounting for nearly 30 percent of all brand phishing attempts.</p>
<p>An unsolicited message that arrives with one of these .eml files as an attachment is more than likely to be a phishing lure. The best advice to sidestep phishing scams is to avoid clicking on links that arrive unbidden in emails, text messages and other mediums. Most phishing scams invoke a temporal element that warns of dire consequences should you fail to respond or act quickly.</p>
<p>If you’re unsure whether a message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark to avoid potential <a href="https://krebsonsecurity.com/2018/04/dot-cm-typosquatting-sites-visited-12m-times-so-far-in-2018/" target="_blank" rel="noopener">typosquatting sites</a>.</p>


feed_id: https://krebsonsecurity.com/?p=64504
title: Meet the Brains Behind the Malware-Friendly AI Chat Service ‘WormGPT’
uri: Meet-the-Brains-Behind-the-Malware-Friendly-AI-Chat-Service-WormGPT
url:
https://krebsonsecurity.com/2023/08/meet-the-brains-behind-the-malware-friendly-ai-chat-service-wormgpt/

content:
<p><strong>WormGPT</strong>, a private new chatbot service advertised as a way to use Artificial Intelligence (AI) to write malicious software without all the pesky prohibitions on such activity enforced by the likes of <strong>ChatGPT</strong> and <strong>Google Bard</strong>, has started adding restrictions of its own on how the service can be used. Faced with customers trying to use WormGPT to create ransomware and phishing scams, the 23-year-old Portuguese programmer who created the project now says his service is slowly morphing into &#8220;a more controlled environment.&#8221;</p>
<div id="attachment_64527" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64527" decoding="async" class=" wp-image-64527" src="media/a776e9b9.wormgpt-marketing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-marketing.png" alt="" width="750" height="319" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-marketing.png 1199w, https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-marketing-768x327.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-marketing-782x333.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-64527" class="wp-caption-text">Image: SlashNext.com.</p></div>
<p>The large language models (LLMs) made by ChatGPT parent <strong>OpenAI</strong> or <strong>Google</strong> or <strong>Microsoft</strong> all have various safety measures designed to prevent people from abusing them for nefarious purposes &#8212; such as creating malware or hate speech. In contrast, WormGPT has promoted itself as a new, uncensored LLM that was created specifically for cybercrime activities.</p>
<p>WormGPT was initially sold exclusively on <strong>HackForums</strong>, a sprawling, English-language community that has long featured a bustling marketplace for cybercrime tools and services. WormGPT licenses are sold for prices ranging from 500 to 5,000 Euro.</p>
<p>&#8220;Introducing my newest creation, &#8216;WormGPT,&#8217; wrote &#8220;<strong>Last</strong>,&#8221; the handle chosen by the HackForums user who is selling the service. &#8220;This project aims to provide an alternative to ChatGPT, one that lets you do all sorts of illegal stuff and easily sell it online in the future. Everything blackhat related that you can think of can be done with WormGPT, allowing anyone access to malicious activity without ever leaving the comfort of their home.&#8221;</p>
<div id="attachment_64515" style="width: 760px" class="wp-caption aligncenter"><a href="media/9b4f714b.wormgpt-hf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-hf.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64515" decoding="async" loading="lazy" class="wp-image-64515" src="media/9b4f714b.wormgpt-hf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-hf.png" alt="" width="750" height="263" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-hf.png 1240w, https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-hf-768x269.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/wormgpt-hf-782x274.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-64515" class="wp-caption-text">WormGPT&#8217;s core developer and frontman &#8220;Last&#8221; promoting the service on HackForums. Image: SlashNext.</p></div>
<p>In July, an AI-based security firm called <strong>SlashNext</strong> <a href="https://slashnext.com/blog/wormgpt-the-generative-ai-tool-cybercriminals-are-using-to-launch-business-email-compromise-attacks/" target="_blank" rel="noopener">analyzed WormGPT</a> and asked it to create a &#8220;business email compromise&#8221; (BEC) phishing lure that could be used to trick employees into paying a fake invoice.</p>
<p>&#8220;The results were unsettling,&#8221; SlashNext&#8217;s <strong>Daniel Kelley</strong> wrote. &#8220;WormGPT produced an email that was not only remarkably persuasive but also strategically cunning, showcasing its potential for sophisticated phishing and BEC attacks.&#8221;</p>
<div id="attachment_64516" style="width: 760px" class="wp-caption aligncenter"><a href="media/4257832d.slashgear-bec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/slashgear-bec.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64516" decoding="async" loading="lazy" class="wp-image-64516" src="media/4257832d.slashgear-bec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/slashgear-bec.png" alt="" width="750" height="205" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/slashgear-bec.png 1240w, https://krebsonsecurity.com/wp-content/uploads/2023/08/slashgear-bec-768x210.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/slashgear-bec-782x214.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-64516" class="wp-caption-text">SlashNext asked WormGPT to compose this BEC phishing email. Image: SlashNext.</p></div>
<p>A review of Last&#8217;s posts on HackForums over the years shows this individual has extensive experience creating and using malicious software. In August 2022, Last posted a sales thread for &#8220;<strong>Arctic Stealer</strong>,&#8221; a data stealing trojan and keystroke logger that he sold there for many months.</p>
<p>&#8220;I&#8217;m very experienced with malwares,&#8221; Last wrote in a message to another HackForums user last year.</p>
<p>Last has also sold a modified version of the information stealer <strong>DCRat</strong>, as well as an obfuscation service marketed to malicious coders who sell their creations and wish to insulate them from being modified or copied by customers.</p>
<p>Shortly after joining the forum in early 2021, Last told several different Hackforums users his name was Rafael and that he was from Portugal. HackForums has a feature that allows anyone willing to take the time to dig through a user’s postings to learn when and if that user was previously tied to another account.</p>
<p>That account tracing feature reveals that while Last has used many pseudonyms over the years, he originally used the nickname &#8220;<strong>ruiunashackers</strong>.&#8221; The first search result in Google for that unique nickname brings up a <strong>TikTok</strong> account with the same moniker, and that TikTok account says it is associated with an <strong>Instagram</strong> account for a <strong>Rafael Morais</strong> from Porto, a coastal city in northwest Portugal.</p>
<h2>AN OPEN BOOK</h2>
<p>Reached via Instagram and Telegram, Morais said he was happy to chat about WormGPT.</p>
<p>&#8220;You can ask me anything,&#8221; Morais said. &#8220;I&#8217;m an open book.&#8221;</p>
<p>Morais said he recently graduated from a polytechnic institute in Portugal, where he earned a degree in information technology. He said only about 30 to 35 percent of the work on WormGPT was his, and that other coders are contributing to the project. So far, he says, roughly 200 customers have paid to use the service.</p>
<p>&#8220;I don&#8217;t do this for money,&#8221; Morais explained. &#8220;It was basically a project I thought [was] interesting at the beginning and now I&#8217;m maintaining it just to help [the] community. We have updated a lot since the release, our model is now 5 or 6 times better in terms of learning and answer accuracy.&#8221;</p>
<p>WormGPT isn&#8217;t the only rogue ChatGPT clone advertised as friendly to malware writers and cybercriminals. According to SlashNext, one unsettling trend on the cybercrime forums is evident in discussion threads offering &#8220;jailbreaks&#8221; for interfaces like ChatGPT.</p>
<p>&#8220;These &#8216;jailbreaks&#8217; are specialised prompts that are becoming increasingly common,&#8221; Kelley wrote. &#8220;They refer to carefully crafted inputs designed to manipulate interfaces like ChatGPT into generating output that might involve disclosing sensitive information, producing inappropriate content, or even executing harmful code. The proliferation of such practices underscores the rising challenges in maintaining AI security in the face of determined cybercriminals.&#8221;</p>
<p>Morais said they have been using the <a href="https://en.wikipedia.org/wiki/GPT-J" target="_blank" rel="noopener">GPT-J 6B model</a> since the service was launched, although he declined to discuss the source of the LLMs that power WormGPT. But he said the data set that informs WormGPT is enormous.</p>
<p>&#8220;Anyone that tests wormgpt can see that it has no difference from any other uncensored AI or even chatgpt with jailbreaks,&#8221; Morais explained. &#8220;The game changer is that our dataset [library] is big.&#8221;<span id="more-64504"></span></p>
<p>Morais said he began working on computers at age 13, and soon started exploring security vulnerabilities and the possibility of making a living by finding and reporting them to software vendors.</p>
<p>&#8220;My story began in 2013 with some greyhat activies, never anything blackhat tho, mostly bugbounty,&#8221; he said. &#8220;In 2015, my love for coding started, learning c# and more .net programming languages. In 2017 I&#8217;ve started using many hacking forums because I have had some problems home (in terms of money) so I had to help my parents with money&#8230; started selling a few products (not blackhat yet) and in 2019 I started turning blackhat. Until a few months ago I was still selling blackhat products but now with wormgpt I see a bright future and have decided to start my transition into whitehat again.&#8221;</p>
<p>WormGPT sells licenses via a dedicated channel on Telegram, and the channel recently lamented that media coverage of WormGPT so far has painted the service in an unfairly negative light.</p>
<p>&#8220;We are uncensored, not blackhat!&#8221; the WormGPT channel announced at the end of July. &#8220;From the beginning, the media has portrayed us as a malicious LLM (Language Model), when all we did was use the name &#8216;blackhatgpt&#8217; for our Telegram channel as a meme. We encourage researchers to test our tool and provide feedback to determine if it is as bad as the media is portraying it to the world.&#8221;</p>
<p>It turns out, when you advertise an online service for doing bad things, people tend to show up with the intention of doing bad things with it. WormGPT&#8217;s front man Last seems to have acknowledged this at the service&#8217;s initial launch, which included the disclaimer, &#8220;We are not responsible if you use this tool for doing bad stuff.&#8221;</p>
<p>But lately, Morais said, WormGPT has been forced to add certain guardrails of its own.</p>
<p>&#8220;We have prohibited some subjects on WormGPT itself,&#8221; Morais said. &#8220;Anything related to murders, drug traffic, kidnapping, child porn, ransomwares, financial crime. We are working on blocking BEC too, at the moment it is still possible but most of the times it will be incomplete because we already added some limitations. Our plan is to have WormGPT marked as an uncensored AI, not blackhat. In the last weeks we have been blocking some subjects from being discussed on WormGPT.&#8221;</p>
<p>Still, Last has continued to state on HackForums &#8212; and more recently on the far more serious cybercrime forum <strong>Exploit</strong> &#8212; that WormGPT will quite happily create malware capable of infecting a computer and going &#8220;fully undetectable&#8221; (FUD) by virtually all of the major antivirus makers (AVs).</p>
<p>&#8220;You can easily buy WormGPT and ask it for a Rust malware script and it will 99% sure be FUD against most AVs,&#8221; Last told a forum denizen in late July.</p>
<p>Asked to list some of the legitimate or what he called &#8220;white hat&#8221; uses for WormGPT, Morais said his service offers reliable code, unlimited characters, and accurate, quick answers.</p>
<p>&#8220;We used WormGPT to fix some issues on our website related to possible sql problems and exploits,&#8221; he explained. &#8220;You can use WormGPT to create firewalls, manage iptables, analyze network, code blockers, math, anything.&#8221;</p>
<p>Morais said he wants WormGPT to become a positive influence on the security community, not a destructive one, and that he&#8217;s actively trying to steer the project in that direction. The original HackForums thread pimping WormGPT as a malware writer&#8217;s best friend has since been deleted, and the service is now advertised as &#8220;WormGPT &#8211; Best GPT Alternative Without Limits &#8212; Privacy Focused.&#8221;</p>
<p>&#8220;We have a few researchers using our wormgpt for whitehat stuff, that&#8217;s our main focus now, turning wormgpt into a good thing to [the] community,&#8221; he said.</p>
<p>It&#8217;s unclear yet whether Last&#8217;s customers share that view.</p>


feed_id: https://krebsonsecurity.com/?p=64549
title: Microsoft Patch Tuesday, August 2023 Edition
uri: Microsoft-Patch-Tuesday-August-2023-Edition
url: https://krebsonsecurity.com/2023/08/microsoft-patch-tuesday-august-2023-edition/
content:
<p><strong>Microsoft Corp.</strong> today issued software updates to plug more than 70 security holes in its <strong>Windows</strong> operating systems and related products, including multiple zero-day vulnerabilities currently being exploited in the wild.</p>
<p><img decoding="async" class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>Six of the flaws fixed today earned Microsoft&#8217;s &#8220;critical&#8221; rating, meaning malware or miscreants could use them to install software on a vulnerable Windows system without any help from users.</p>
<p>Last month, Microsoft acknowledged a series of zero-day vulnerabilities in a variety of Microsoft products that were discovered and exploited in-the-wild attacks. They were assigned a single placeholder designation of <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36884" target="_blank" rel="noopener">CVE-2023-36884</a>.</p>
<p><strong>Satnam Narang</strong>, senior staff research engineer at Tenable, said the August patch batch addresses <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36884" target="_blank" rel="noopener">CVE-2023-36884</a>, which involves bypassing the <strong>Windows Search Security</strong> feature.</p>
<p>&#8220;Microsoft also released ADV230003, a defense-in-depth update designed to stop the attack chain associated that leads to the exploitation of this CVE,&#8221; Narang said. &#8220;Given that this has already been successfully exploited in the wild as a zero-day, organizations should prioritize patching this vulnerability and applying the defense-in-depth update as soon as possible.&#8221;</p>
<p>Redmond patched another flaw that is already seeing active attacks &#8212; <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38180" target="_blank" rel="noopener">CVE-2023-38180</a> &#8212; a weakness in <strong>.NET</strong> and <strong>Visual Studio</strong> that leads to a denial-of-service condition on vulnerable servers.</p>
<p>&#8220;Although the attacker would need to be on the same network as the target system, this vulnerability does not require the attacker to have acquired user privileges,&#8221; on the target system, wrote <strong>Nikolas Cemerikic</strong>, cyber security engineer at Immersive Labs.<span id="more-64549"></span></p>
<p>Narang said the software giant also patched six vulnerabilities in <strong>Microsoft Exchange Server</strong>, including <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21709" target="_blank" rel="noopener">CVE-2023-21709</a>, an elevation of privilege flaw that was assigned a CVSSv3 (threat) score of 9.8 out of a possible 10, even though Microsoft rates it as an important flaw, not critical.</p>
<p>&#8220;An unauthenticated attacker could exploit this vulnerability by conducting a brute-force attack against valid user accounts,&#8221; Narang said. &#8220;Despite the high rating, the belief is that brute-force attacks won’t be successful against accounts with strong passwords. However, if weak passwords are in use, this would make brute-force attempts more successful. The remaining five vulnerabilities range from a spoofing flaw and multiple remote code execution bugs, though the most severe of the bunch also require credentials for a valid account.&#8221;</p>
<p>Experts at security firm <strong>Automox</strong> called attention to <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36910" target="_blank" rel="noopener">CVE-2023-36910</a>, a remote code execution bug in the Microsoft Message Queuing service that can be exploited remotely and without privileges to execute code on vulnerable Windows 10, 11 and Server 2008-2022 systems. Microsoft says it considers this vulnerability &#8220;less likely&#8221; to be exploited, and Automox says while the message queuing service is not enabled by default in Windows and is less common today, any device with it enabled is at critical risk.</p>
<p>Separately, <strong>Adobe</strong> has issued <a href="https://helpx.adobe.com/security/products/acrobat/apsb23-30.html" target="_blank" rel="noopener">a critical security update</a> for Acrobat and Reader that resolves at least 30 security vulnerabilities in those products. Adobe said it is not aware of any exploits in the wild targeting these flaws. The company also issued security updates for <strong>Adobe Commerce</strong> and <strong>Adobe Dimension</strong>.</p>
<p>If you experience glitches or problems installing any of these patches this month, please consider leaving a comment about it below; there’s a fair chance other readers have experienced the same and may chime in here with useful tips.</p>
<p>Additional reading:</p>
<p><strong>-SANS Internet Storm Center</strong> <a href="https://isc.sans.edu/diary/Microsoft%20August%202023%20Patch%20Tuesday/30106" target="_blank" rel="noopener">listing</a> of each Microsoft vulnerability patched today, indexed by severity and affected component.</p>
<p>&#8211;<a href="https://www.askwoody.com/" rel="noopener" target="_blank">AskWoody.com</a>, which keeps tabs on any developing problems related to the availability or installation of these updates.</p>


feed_id: https://krebsonsecurity.com/?p=64560
title: Diligere, Equity-Invest Are New Firms of U.K. Con Man
uri: Diligere-Equity-Invest-Are-New-Firms-of-U-K-Con-Man
url: https://krebsonsecurity.com/2023/08/diligere-equity-invest-are-new-firms-of-u-k-con-man/
content:
<p><strong>John Clifton Davies</strong>, a convicted fraudster estimated to have bilked dozens of technology startups out of more than $30 million through phony investment schemes, has a brand new pair of scam companies that are busy dashing startup dreams: A fake investment firm called <strong>Equity-Invest[.]ch</strong>, and <strong>Diligere[.]co.uk</strong>, a scam due diligence company that Equity-Invest insists all investment partners use.</p>
<p>A native of the United Kingdom, Mr. Davies absconded from justice before being convicted on multiple counts of fraud in 2015. Prior to his conviction, Davies served 16 months in jail before being cleared on suspicion of <a href="https://www.bbc.com/news/uk-wales-21850549" target="_blank" rel="noopener">murdering his third wife on their honeymoon in India</a>.</p>
<div id="attachment_53032" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53032" decoding="async" class=" wp-image-53032" src="media/c95e44e6.Bernard-sbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Bernard-sbs.png" alt="" width="750" height="397" /><p id="caption-attachment-53032" class="wp-caption-text">The scam artist John Bernard (left) in a recent Zoom call, and a photo of John Clifton Davies from 2015.</p></div>
<p>John Clifton Davies was <a href="https://www.heart.co.uk/fourcounties/news/local/mk-man-convicted-of-mass-fraud/" target="_blank" rel="noopener">convicted in 2015</a> of swindling businesses throughout the U.K. that were struggling financially and seeking to restructure their debt. For roughly six years, Davies ran a series of firms that pretended to offer insolvency services. Instead, he simply siphoned what little remaining money these companies had, spending the stolen funds on lavish cars, home furnishings, vacations and luxury watches.</p>
<p>In a three-part series published in 2020, KrebsOnSecurity exposed how Davies — wanted by authorities in the U.K. — had fled the country, taken on the surname Bernard, remarried, and moved to his new (and fourth) wife’s hometown in Ukraine.</p>
<p>After eluding justice in the U.K., Davies <a href="https://krebsonsecurity.com/2020/10/promising-infusions-of-cash-fake-investor-john-bernard-walked-away-with-30m/" target="_blank" rel="noopener">reinvented himself</a> as <a href="https://web.archive.org/web/20200917102043/https://the-private-office.ch/" target="_blank" rel="noopener">The Private Office of John Bernard</a>, pretending to be a billionaire Swiss investor who made his fortunes in the dot-com boom 20 years ago and who was seeking private equity investment opportunities.</p>
<p>In case after case, Bernard would <a href="https://krebsonsecurity.com/2022/01/fake-investor-john-bernard-sinks-norwegian-green-shipping-dreams/" target="_blank" rel="noopener">promise to invest millions in hi-tech startups</a>, only to insist that companies <a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener">pay tens of thousands of dollars worth of due diligence fees up front</a>. However, the due diligence company he insisted on using — another Swiss firm called <strong>The</strong> <strong>Inside Knowledge</strong> — also was secretly owned by Bernard, who would invariably pull out of the deal after receiving the due diligence money.</p>
<p>Bernard found a constant stream of new marks by offering extraordinarily generous finders fees to investment brokers who could introduce him to companies seeking an infusion of cash. Inside Knowledge and The Private Office both <a href="https://web.archive.org/web/20201208035644/https://the-private-office.ch/" target="_blank" rel="noopener">closed up shop</a> not long after being exposed here in 2020.</p>
<p>In April 2023, <a href="https://krebsonsecurity.com/2023/04/a-serial-tech-investment-scammer-takes-up-coding/" target="_blank" rel="noopener">KrebsOnSecurity wrote about <strong>Codes2You</strong>,</a> a recent Davies venture which purports to be a &#8220;full cycle software development company&#8221; based in the U.K. The company&#8217;s website no longer lists any of Davies&#8217; known associates, but the site does still reference software and cloud services tied to those associates &#8212; including <strong>MySolve</strong>, a &#8220;multi-feature platform for insolvency practitioners.&#8221;</p>
<p>Earlier this month, KrebsOnSecurity heard from an investment broker who found out his client had paid more than $50,000 in due diligence fees related to a supposed multi-million dollar investment offer from a Swiss concern called <strong>Equity-Invest[.]ch</strong>.</p>
<p>The investment broker, who spoke on condition that neither he nor his client be named, said Equity-Invest began getting cold feet after his client plunked down the due diligence fees.</p>
<p>&#8220;Things started to go sideways when the investor purportedly booked a trip to the US to meet the team but canceled last minute because &#8216;his pregnant wife got in a car accident,'&#8221; the broker explained. &#8220;After that, he was radio silent until the contract expired.&#8221;<span id="more-64560"></span></p>
<p>The broker said he grew suspicious when he learned that the Equity-Invest domain name was less than six months old. The broker&#8217;s suspicions were confirmed after he discovered the due diligence company that Equity-Invest insisted on using &#8212; <strong>Diligere[.]co.uk</strong> &#8212; included an email address on its homepage for another entity called <strong>Ardelis Solutions</strong>.</p>
<p>A corporate entity in the UK called <a href="https://web.archive.org/web/20210730143454/https://ardelissolutions.com/" target="_blank" rel="noopener">Ardelis Solutions</a> was key to showing the connection to Davies&#8217; former scam investment and due diligence firms in the Codes2You investigation published earlier this year.</p>
<p>Although Diligere&#8217;s website claims the due diligence firm has &#8220;13 years of experiance&#8221; [sic], its domain name was only registered in April 2023. What&#8217;s more, virtually all of the vapid corporate-speak published on Diligere&#8217;s homepage is <a href="media/7303fcb6.Due_diligence_guide.pdf" data-original-source="https://web.archive.org/web/20200928222042/https://www.insideknowledge.ch/wp-content/uploads/2020/04/Due_diligence_guide.pdf" target="_blank" rel="noopener">identical to text on the now-defunct InsideKnowledge[.]ch</a> &#8212; the fake due diligence firm secretly owned for many years by The Private Office of John Bernard (John Clifton Davies).</p>
<div id="attachment_64570" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64570" decoding="async" loading="lazy" class=" wp-image-64570" src="media/3cbbe650.theinsideknowledgecopy.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/theinsideknowledgecopy.png" alt="" width="749" height="472" /><p id="caption-attachment-64570" class="wp-caption-text">A snippet of text from the now-defunct website of the fake Swiss investor John Bernard, in real life John Clifton Davies.</p></div>
<p>&#8220;Our steadfast conviction and energy for results is what makes us stand out,&#8221; both sites state. &#8220;We care for our clients&#8217; and their businesses, we share their ambitions and align our goals to complement their objectives. Our clients know we&#8217;re in this together. We work in close partnership with our clients to deliver palpable results regardless of geography, complexity or controversy.&#8221;</p>
<p><div id="attachment_64571" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64571" decoding="async" loading="lazy" class=" wp-image-64571" src="media/15ad25fd.diligerecouk.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/diligerecouk.png" alt="" width="750" height="595" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/diligerecouk.png 1116w, https://krebsonsecurity.com/wp-content/uploads/2023/08/diligerecouk-768x609.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/diligerecouk-782x620.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-64571" class="wp-caption-text">The copy on Diligere&#8217;s homepage is identical to that once on Insideknowledge[.]com, a phony due diligence company run by John Clifton Davies.</p></div>Requests for comment sent to the contact address listed on Diligere &#8212; info@ardelissolutions[.]com &#8212; went unreturned. Equity-Invest did not respond to requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=64562
title: Karma Catches Up to Global Phishing Service 16Shop
uri: Karma-Catches-Up-to-Global-Phishing-Service-16Shop
url: https://krebsonsecurity.com/2023/08/karma-catches-up-to-global-phishing-service-16shop/
content:
<p>You&#8217;ve probably never heard of &#8220;<strong>16Shop</strong>,&#8221; but there&#8217;s a good chance someone using it has tried to phish you.</p>
<div id="attachment_64609" style="width: 822px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64609" decoding="async" class="size-full wp-image-64609" src="media/4f44fc3c.16shopphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopphish.png" alt="" width="812" height="343" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopphish.png 812w, https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopphish-768x324.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopphish-782x330.png 782w" sizes="(max-width: 812px) 100vw, 812px" /><p id="caption-attachment-64609" class="wp-caption-text">A 16Shop phishing page spoofing Apple and targeting Japanese users. Image: Akamai.com.</p></div>
<p>The international police organization <strong>INTERPOL</strong> <a href="https://www.interpol.int/en/News-and-Events/News/2023/Notorious-phishing-platform-shut-down-arrests-in-international-police-operation" target="_blank" rel="noopener">said</a> last week it had shuttered the notorious 16Shop, a popular phishing-as-a-service platform launched in 2017 that made it simple for even complete novices to conduct complex and convincing phishing scams. INTERPOL said authorities in Indonesia arrested the 21-year-old proprietor and one of his alleged facilitators, and that a third suspect was apprehended in Japan.</p>
<p>The INTERPOL statement says the platform sold hacking tools to compromise more than 70,000 users in 43 countries. Given how long 16Shop has been around and how many paying customers it enjoyed over the years, that number is almost certainly highly conservative.</p>
<p>Also, the sale of &#8220;hacking tools&#8221; doesn&#8217;t quite capture what 16Shop was all about: It was a fully automated phishing platform that gave its thousands of customers a series of brand-specific phishing kits to use, and provided the domain names needed to host the phishing pages and receive any stolen credentials.</p>
<p>Security experts investigating 16Shop found the service used an application programming interface (API) to manage its users, an innovation that allowed its proprietors to shut off access to customers who failed to pay a monthly fee, or for those attempting to copy or pirate the phishing kit.</p>
<p>16Shop also <a href="https://www.group-ib.com/media-center/press-releases/interpol-16shop/" target="_blank" rel="noopener">localized phishing pages</a> in multiple languages, and the service would display relevant phishing content depending on the victim&#8217;s geolocation.</p>
<div id="attachment_64610" style="width: 803px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64610" decoding="async" loading="lazy" class="size-full wp-image-64610" src="media/09d42bd8.16shopintl.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopintl.png" alt="" width="793" height="428" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopintl.png 793w, https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopintl-768x415.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopintl-782x422.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/08/16shopintl-370x200.png 370w" sizes="(max-width: 793px) 100vw, 793px" /><p id="caption-attachment-64610" class="wp-caption-text">Various 16Shop lures for Apple users in different languages. Image: Akamai.</p></div>
<p>For example, in 2019 <strong>McAfee</strong> found that for targets in Japan, the 16Shop kit would also collect Web ID and Card Password, while US victims will be asked for their Social Security Number.</p>
<p>&#8220;Depending on location, 16Shop will also collect ID numbers (including Civil ID, National ID, and Citizen ID), passport numbers, social insurance numbers, sort codes, and credit limits,&#8221; McAfee <a href="https://www.mcafee.com/blogs/other-blogs/mcafee-labs/16shop-now-targets-amazon/" target="_blank" rel="noopener">wrote</a>.</p>
<p>In addition, 16Shop employed various tricks to help its users&#8217; phishing pages stay off the radar of security firms, including a local &#8220;blacklist&#8221; of Internet addresses tied to security companies, and a feature that allowed users to block entire Internet address ranges from accessing phishing pages.</p>
<p>The INTERPOL announcement does not name any of the suspects arrested in connection with the 16Shop investigation. However, a number of security firms &#8212; including <a href="https://www.akamai.com/blog/security/16shop-commercial-phishing-kit-has-a-hidden-backdoor" target="_blank" rel="noopener">Akamai</a>, McAfee and <a href="https://www.zerofox.com/blog/16shop-cash-app-phishing-kit/" target="_blank" rel="noopener">ZeroFox</a>, previously connected the service to a young Indonesian man named <strong>Riswanda Noor Saputra</strong>, who sold 16Shop under the hacker handle &#8220;<strong>Devilscream</strong>.&#8221;</p>
<p>According to the Indonesian security blog <strong>Cyberthreat.id</strong>, Saputra <a href="https://cyberthreat.id/read/13600/Polisi-FBI-dan-Interpol-Tangkap-Riswanda-Hacker-Indonesia-yang-Bikin-Alat-Peretas-16Shop" target="_blank" rel="noopener">admitted being the administrator of 16Shop</a>, but told the publication he handed the project off to others by early 2020.</p>
<div id="attachment_64612" style="width: 752px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64612" decoding="async" loading="lazy" class=" wp-image-64612" src="media/cc5f2dda.16shoppanel.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/16shoppanel.png" alt="" width="742" height="667" /><p id="caption-attachment-64612" class="wp-caption-text">16Shop documentation instructing operators on how to deploy the kit. Image: ZeroFox.</p></div>
<p>Nevertheless, Cyberthreat reported that Devilscream was arrested by Indonesian police in late 2021 as part of a collaboration between INTERPOL and the <strong>U.S. Federal Bureau of Investigation</strong> (FBI). Still, researchers who tracked 16Shop <a href="http://www.deependresearch.org/2018/09/indonesian-spam-communities.html" target="_blank" rel="noopener">since its inception</a> say Devilscream was <a href="https://www.fortinet.com/blog/threat-research/japanlocker-an-excavation-to-its-indonesian-roots" target="_blank" rel="noopener">not the original proprietor of the phishing platform</a>, and he may not be the last.</p>
<h2>RIZKY BUSINESS</h2>
<p>It is not uncommon for cybercriminals <a href="https://therecord.media/cybercrime-forum-users-infected-with-info-stealing-malware" target="_blank" rel="noopener">to accidentally infect their own machines with password-stealing malware</a>, and that is exactly what seems to have happened with one of the more recent administrators of 16Shop.</p>
<p><a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a data breach and threat actor research platform, now allows users to cross-reference popular cybercrime websites and denizens of these forums with <a href="https://krebsonsecurity.com/2023/04/fbi-seizes-bot-shop-genesis-market-amid-arrests-targeting-operators-suppliers/" target="_blank" rel="noopener">inadvertent malware infections by information-stealing trojans</a>. A search in Constella on 16Shop&#8217;s domain name shows that in mid-2022, a key administrator of the phishing service infected their Microsoft Windows desktop computer with the <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer" target="_blank" rel="noopener">Redline information stealer trojan</a> &#8212; apparently by downloading a cracked (and secretly backdoored) copy of Adobe Photoshop.</p>
<p>Redline infections steal gobs of data from the victim machine, including a list of recent downloads, stored passwords and authentication cookies, as well as browser bookmarks and auto-fill data. Those records indicate the 16Shop admin used the nicknames &#8220;<strong>Rudi</strong>&#8221; and &#8220;<strong>Rizki/Rizky</strong>,&#8221; and maintained <a href="https://www.facebook.com/itsmeikyxsec404" target="_blank" rel="noopener">several</a> Facebook profiles under these monikers.</p>
<p>It appears this user&#8217;s full name (or at least part of it) is <strong>Rizky Mauluna Sidik</strong>, and they are from Bandung in West Java, Indonesia. One of this user&#8217;s Facebook pages says Rizky is the chief executive officer and founder of an entity called <strong>BandungXploiter</strong>, whose <a href="https://www.facebook.com/profile.php?id=100066614212082" target="_blank" rel="noopener">Facebook page</a> indicates it is a group focused mainly on hacking and defacing websites.</p>
<p>A <a href="https://www.linkedin.com/in/rizky-69a545230/?originalSubdomain=id" target="_blank" rel="noopener">LinkedIn profile for Rizky</a> says he is a backend Web developer in Bandung who earned a bachelor&#8217;s degree in information technology in 2020. Mr. Rizky did not respond to requests for comment.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-64611" src="media/cb464231.bandungxploiter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/bandungxploiter.png" alt="" width="749" height="302" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/bandungxploiter.png 1062w, https://krebsonsecurity.com/wp-content/uploads/2023/08/bandungxploiter-768x310.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/bandungxploiter-782x315.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>


feed_id: https://krebsonsecurity.com/?p=64594
title: Tourists Give Themselves Away by Looking Up. So Do Most Network Intruders.
uri: Tourists-Give-Themselves-Away-by-Looking-Up-So-Do-Most-Network-Intrud
url:
https://krebsonsecurity.com/2023/08/tourists-give-themselves-away-by-looking-up-so-do-most-network-intruders/

content:
<p>In large metropolitan areas, tourists are often easy to spot because they&#8217;re far more inclined than locals to gaze upward at the surrounding skyscrapers. Security experts say this same tourist dynamic is a dead giveaway in virtually all computer intrusions that lead to devastating attacks like data theft and ransomware, and that more organizations should set simple virtual tripwires that sound the alarm when authorized users and devices are spotted exhibiting this behavior.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-55426" src="media/d8a8e833.moneylife-e1692725333962.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/05/moneylife-e1692725333962.png" alt="" width="676" height="988" /></p>
<p>In a blog post published last month, <strong>Cisco Talos</strong> said it was seeing a worrisome &#8220;increase in the rate of high-sophistication attacks on network infrastructure.&#8221; Cisco&#8217;s warning comes amid a flurry of successful data ransom and state-sponsored cyber espionage attacks targeting some of the most well-defended networks on the planet.</p>
<p>But despite their increasing complexity, a great many initial intrusions that lead to data theft could be nipped in the bud if more organizations started looking for the telltale signs of newly-arrived cybercriminals behaving like network tourists, Cisco says.</p>
<p>&#8220;One of the most important things to talk about here is that in each of the cases we’ve seen, the threat actors are taking the type of &#8216;first steps&#8217; that someone who wants to understand (and control) your environment would take,&#8221; Cisco&#8217;s <strong>Hazel Burton</strong> <a href="https://blogs.cisco.com/security/network-resilience-defending-against-sophisticated-attacks-targeting-network-infrastructure?utm_source=country-soc" target="_blank" rel="noopener">wrote</a>. &#8220;Examples we have observed include threat actors performing a &#8216;show config,&#8217; &#8216;show interface,&#8217; &#8216;show route,&#8217; &#8216;show arp table&#8217; and a &#8216;show CDP neighbor.&#8217; All these actions give the attackers a picture of a router’s perspective of the network, and an understanding of what foothold they have.&#8221;</p>
<p>Cisco&#8217;s alert concerned <a href="https://blog.talosintelligence.com/state-sponsored-campaigns-target-global-network-infrastructure/" target="_blank" rel="noopener">espionage attacks from China and Russia</a> that abused vulnerabilities in aging, end-of-life network routers. But at a very important level, it doesn&#8217;t matter how or why the attackers got that initial foothold on your network.</p>
<p>It might be <a href="https://www.mandiant.com/resources/blog/barracuda-esg-exploited-globally" target="_blank" rel="noopener">zero-day vulnerabilities in your network firewall</a> or <a href="https://arstechnica.com/security/2023/07/moveit-app-mass-exploited-last-month-patches-new-critical-vulnerability/" target="_blank" rel="noopener">file-transfer appliance</a>. Your more immediate and primary concern has to be: How quickly can you detect and detach that initial foothold?</p>
<p>The same tourist behavior that Cisco described attackers exhibiting vis-a-vis older routers is also incredibly common early on in ransomware and data ransom attacks &#8212; which often unfurl in secret over days or weeks as attackers methodically identify and compromise a victim&#8217;s key network assets.</p>
<p>These virtual hostage situations usually begin with the intruders purchasing access to the target&#8217;s network from <a href="https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/" target="_blank" rel="noopener">dark web brokers</a> who resell access to stolen credentials and compromised computers. As a result, when those stolen resources first get used by would-be data thieves, almost invariably the attackers will run a series of basic commands asking the local system to confirm exactly who and where they are on the victim&#8217;s network.</p>
<p>This fundamental reality about modern cyberattacks &#8212; that cybercriminals almost always orient themselves by &#8220;looking up&#8221; who and where they are upon entering a foreign network for the first time &#8212; forms the business model of an innovative security company called <strong>Thinkst</strong>, which gives away easy-to-use tripwires or &#8220;canaries&#8221; that can fire off an alert whenever all sorts of suspicious activity is witnessed.</p>
<p>&#8220;Many people have pointed out that there are a handful of commands that are overwhelmingly run by attackers on compromised hosts (and seldom ever by regular users/usage),&#8221; the Thinkst website explains. &#8220;Reliably alerting when a user on your code-sign server runs whoami.exe can mean the difference between catching a compromise in week-1 (before the attackers dig in) and learning about the attack on CNN.&#8221;</p>
<p>These canaries &#8212; or &#8220;canary tokens&#8221; &#8212; are meant to be embedded inside regular files, acting much like a web beacon or web bug that tracks when someone opens an email.</p>
<div id="attachment_64656" style="width: 890px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64656" decoding="async" loading="lazy" class="wp-image-64656 size-full" src="media/955f8033.canarytokens.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/canarytokens.png" alt="" width="880" height="603" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/canarytokens.png 880w, https://krebsonsecurity.com/wp-content/uploads/2023/08/canarytokens-768x526.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/canarytokens-782x536.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/08/canarytokens-100x70.png 100w" sizes="(max-width: 880px) 100vw, 880px" /><p id="caption-attachment-64656" class="wp-caption-text">The Canary Tokens website from Thinkst Canary lists nearly two-dozen free customizable canaries.</p></div>
<p>&#8220;Imagine doing that, but for file reads, database queries, process executions or patterns in log files,&#8221; the <a href="https://docs.canarytokens.org/guide/getting-started.html#how-do-attackers-trip-over-a-token" target="_blank" rel="noopener">Canary Tokens documentation</a> explains. &#8220;Canarytokens does all this and more, letting you implant traps in your production systems rather than setting up separate honeypots.&#8221;</p>
<p>Thinkst operates alongside a burgeoning industry offering so-called &#8220;deception&#8221; or &#8220;honeypot&#8221; services &#8212; those designed to confuse, disrupt and entangle network intruders. But in an interview with KrebsOnSecurity, Thinkst founder and CEO <strong>Haroon Meer</strong> said most deception techniques involve some degree of hubris.</p>
<p>&#8220;Meaning, you&#8217;ll have deception teams in your network playing spy versus spy with people trying to break in, and it becomes this whole counterintelligence thing,&#8221; Meer said. &#8220;Nobody really has time for that. Instead, we are saying literally the opposite: That you&#8217;ve probably got all these [security improvement] projects that are going to take forever. But while you&#8217;re doing all that, just drop these 10 canaries, because everything else is going to take a long time to do.&#8221;</p>
<p>The idea here is to lay traps in sensitive areas of your network or web applications where few authorized users should ever trod. Importantly, the canary tokens themselves are useless to an attacker. For example, that AWS canary token sure looks like the digital keys to your cloud, but the token itself offers no access. It&#8217;s just a lure for the bad guys, and you get an alert when and if it is ever touched.</p>
<p>One nice thing about canary tokens is that Thinkst gives them away for free. Head over to <a href="https://canarytokens.org/generate" target="_blank" rel="noopener">canarytokens.org</a>, and choose from a drop-down menu of available tokens, including:</p>
<p>-a web bug / URL token, designed to alert when a particular URL is visited;<br />
-a DNS token, which alerts when a hostname is requested;<br />
-an AWS token, which alerts when a specific Amazon Web Services key is used;<br />
-a &#8220;custom exe&#8221; token, to alert when a specific Windows executable file or DLL is run;<br />
-a &#8220;sensitive command&#8221; token, to alert when a suspicious Windows command is run.<br />
-a Microsoft Excel/Word token, which alerts when a specific Excel or Word file is accessed.<span id="more-64594"></span></p>
<p>Much like a &#8220;wet paint&#8221; sign often encourages people to touch a freshly painted surface anyway, attackers often can&#8217;t help themselves when they enter a foreign network and stumble upon what appear to be key digital assets, Meer says.</p>
<p>&#8220;If an attacker lands on your server and finds a key to your cloud environment, it&#8217;s really hard for them not to try it once,&#8221; Meer said. &#8220;Also, when these sorts of actors do land in a network, they have to orient themselves, and while doing that they are going to trip canaries.&#8221;</p>
<p>Meer says canary tokens are as likely to trip up attackers as they are &#8220;red teams,&#8221; security experts hired or employed by companies seeking to continuously probe their own computer systems and networks for security weaknesses.</p>
<p>&#8220;The concept and use of canary tokens has made me very hesitant to use credentials gained during an engagement, versus finding alternative means to an end goal,&#8221; <a href="https://twitter.com/infosec_au/status/949014188579610624" target="_blank" rel="noopener">wrote</a> <strong>Shubham Shah</strong>, a penetration tester and co-founder of the security firm <strong>Assetnote</strong>. &#8220;If the aim is to increase the time taken for attackers, canary tokens work well.&#8221;</p>
<p>Thinkst makes money by selling Canary Tools, which is a paid version of Thinkst that is powered by a small hardware device designed to be installed on the local network as a canary token server.</p>
<p>&#8220;If you&#8217;ve got a sophisticated defense team, you can start putting these things in really interesting places,&#8221; Meer said. &#8220;Everyone says their stuff is simple, but we obsess over it. It&#8217;s really got to be so simple that people can&#8217;t mess it up. And if it works, it&#8217;s the best bang for your security buck you&#8217;re going to get.&#8221;</p>
<p>Further reading:</p>
<p><a href="https://www.darkreading.com/emerging-tech/credential-canaries-create-minefield-for-attackers" target="_blank" rel="noopener">Dark Reading: Credential Canaries Create Minefield for Attackers</a><br />
<a href="https://research.nccgroup.com/2020/09/14/extending-a-thinkst-canary-to-become-an-interactive-honeypot/" target="_blank" rel="noopener">NCC Group: Extending a Thinkst Canary to Become an Interactive Honeypot</a><br />
<a href="https://www.infoq.com/presentations/canary-tools-services-deployment/" target="_blank" rel="noopener">Cruise Automation&#8217;s experience deploying canary tokens</a></p>


feed_id: https://krebsonsecurity.com/?p=64675
title: Kroll Employee SIM-Swapped for Crypto Investor Data
uri: Kroll-Employee-SIM-Swapped-for-Crypto-Investor-Data
url: https://krebsonsecurity.com/2023/08/kroll-employee-sim-swapped-for-crypto-investor-data/
content:
<p>Security consulting giant <strong>Kroll</strong> disclosed today that a SIM-swapping attack against one of its employees led to the theft of user information for multiple cryptocurrency platforms that are relying on Kroll services in their ongoing bankruptcy proceedings. And there are indications that fraudsters may already be exploiting the stolen data in phishing attacks.</p>
<p>Cryptocurrency lender <strong>BlockFi</strong> and the now-collapsed crypto trading platform <strong>FTX</strong> each disclosed data breaches this week thanks to a recent SIM-swapping attack targeting an employee of <strong>Kroll</strong> &#8212; the company handling both firms&#8217; bankruptcy restructuring.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-64682" src="media/7cfcbda4.kroll.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/kroll.png" alt="" width="665" height="192" /></p>
<p>In a statement released today, New York City-based Kroll said it was informed that on Aug. 19, 2023, someone targeted a <strong>T-Mobile</strong> phone number belonging to a Kroll employee &#8220;in a highly sophisticated &#8216;SIM swapping&#8217; attack.&#8221;</p>
<p>&#8220;Specifically, T-Mobile, without any authority from or contact with Kroll or its employees, transferred that employee&#8217;s phone number to the threat actor&#8217;s phone at their request,&#8221; the <a href="https://www.kroll.com/en/about-us/news/security-incident" target="_blank" rel="noopener">statement</a> continues. &#8220;As a result, it appears the threat actor gained access to certain files containing personal information of bankruptcy claimants in the matters of BlockFi, FTX and <strong>Genesis</strong>.&#8221;</p>
<p>T-Mobile has not yet responded to requests for comment.</p>
<p>Countless websites and online services use SMS text messages for both password resets and multi-factor authentication. This means that stealing someone’s phone number often can let cybercriminals hijack the target’s entire digital life in short order — including access to any financial, email and social media accounts tied to that phone number.</p>
<p>SIM-swapping groups will often call employees on their mobile devices, pretend to be someone from the company’s IT department, and then try to get the employee to visit a phishing website that mimics the company’s login page.</p>
<p>Multiple SIM-swapping gangs have had great success using this method to target T-Mobile employees for the purposes of reselling a cybercrime service that can be hired to divert any T-Mobile user’s text messages and phone calls to another device.</p>
<p>In February 2023, KrebsOnSecurity chronicled SIM-swapping attacks claimed by these groups against T-Mobile employees <a href="https://krebsonsecurity.com/2023/02/hackers-claim-they-breached-t-mobile-more-than-100-times-in-2022/" target="_blank" rel="noopener">in more than 100 separate incidents in the second half of 2022</a>. The average cost to SIM swap any T-Mobile phone number was approximately $1,500.</p>
<p>The unfortunate result of the SIM-swap against the Kroll employee is that people who had financial ties to BlockFi, FTX, or Genesis now face increased risk of becoming targets of SIM-swapping and phishing attacks themselves.</p>
<p>And there is some indication this is already happening. Multiple readers who said they got breach notices from Kroll today also shared phishing emails they received this morning that spoofed FTX and claimed, &#8220;You have been identified as an eligible client to begin withdrawing digital assets from your FTX account.&#8221;</p>
<div id="attachment_64681" style="width: 912px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64681" decoding="async" loading="lazy" class="size-full wp-image-64681" src="media/5b89e0f4.ftx-phish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/ftx-phish.png" alt="" width="902" height="649" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/ftx-phish.png 902w, https://krebsonsecurity.com/wp-content/uploads/2023/08/ftx-phish-768x553.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/ftx-phish-782x563.png 782w" sizes="(max-width: 902px) 100vw, 902px" /><p id="caption-attachment-64681" class="wp-caption-text">A phishing message targeting FTX users that went out en masse today.</p></div>
<p><span id="more-64675"></span>A major portion of Kroll&#8217;s business comes from helping organizations <a href="https://www.kroll.com/en/services/cyber-risk" target="_blank" rel="noopener">manage cyber risk</a>. Kroll is often called in to investigate data breaches, and it also sells identity protection services to companies that recently experienced a breach and are grasping at ways to demonstrate that they doing <em>something</em> to protect their customers from further harm.</p>
<p>Kroll did not respond to questions. But it&#8217;s a good bet that BlockFi, FTX and Genesis customers will soon enjoy yet another offering of free credit monitoring as a result of the T-Mobile SIM swap.</p>
<p>Kroll&#8217;s website says it employs &#8220;elite cyber risk leaders uniquely positioned to deliver end-to-end cyber security services worldwide.&#8221; Apparently, these elite cyber risk leaders did not consider the increased attack surface presented by their employees using T-Mobile for wireless service.</p>
<p>The SIM-swapping attack against Kroll is a timely reminder that <em>you should do whatever you can to minimize your reliance on mobile phone companies for your security</em>. For example, many online services require you to provide a phone number upon registering an account, but that number can often be removed from your profile afterwards.</p>
<p>Why do I suggest this? <em>Many online services allow users to reset their passwords just by clicking a link sent via SMS</em>, and this unfortunately widespread practice has turned mobile phone numbers into de facto identity documents. Which means losing control over your phone number thanks to an unauthorized SIM swap or mobile number port-out, divorce, job termination or financial crisis can be devastating.</p>
<p>If you haven&#8217;t done so lately, take a moment to inventory your most important online accounts, and see how many of them can still have their password reset by receiving an SMS at the phone number on file. This may require stepping through the website&#8217;s account recovery or lost password flow.</p>
<p>If the account that stores your mobile phone number does not allow you to delete your number, check to see whether there is an option to disallow SMS or phone calls for authentication and account recovery. If more secure options are available, such as a security key or a one-time code from a mobile authentication app, please take advantage of those instead. The website <a href="https://www.2fa.directory" target="_blank" rel="noopener">2fa.directory</a> is a good starting point for this analysis.</p>
<p>Now, you might think that the mobile providers would share some culpability when a customer suffers a financial loss because a mobile store employee got tricked into transferring that customer&#8217;s phone number to criminals. But earlier this year, a California judge <a href="https://blockworks.co/news/att-crypto-sim-swap-lawsuit" target="_blank" rel="noopener">dismissed a lawsuit against AT&amp;T</a> that stemmed from <a href="https://krebsonsecurity.com/2021/12/ny-man-pleads-guilty-in-20-million-sim-swap-theft/" target="_blank" rel="noopener">a 2017 SIM-swapping attack</a> which netted the thieves more than $24 million in cryptocurrency.</p>


feed_id: https://krebsonsecurity.com/?p=64706
title: U.S. Hacks QakBot, Quietly Removes Botnet Infections
uri: U-S-Hacks-QakBot-Quietly-Removes-Botnet-Infections
url: https://krebsonsecurity.com/2023/08/u-s-hacks-qakbot-quietly-removes-botnet-infections/
content:
<p>The U.S. government today announced a coordinated crackdown against <strong>QakBot</strong>, a complex malware family used by multiple cybercrime groups to lay the groundwork for ransomware infections. The international law enforcement operation involved seizing control over the botnet&#8217;s online infrastructure, and quietly removing the Qakbot malware from tens of thousands of infected Microsoft Windows computers.</p>
<div id="attachment_64731" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64731" decoding="async" class=" wp-image-64731" src="media/5cfd4d62.dutch-qbot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/dutch-qbot.png" alt="" width="748" height="416" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/dutch-qbot.png 950w, https://krebsonsecurity.com/wp-content/uploads/2023/08/dutch-qbot-768x427.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/08/dutch-qbot-782x435.png 782w" sizes="(max-width: 748px) 100vw, 748px" /><p id="caption-attachment-64731" class="wp-caption-text">Dutch authorities inside a data center with servers tied to the botnet. Image: Dutch National Police.</p></div>
<p>In an international operation announced today dubbed &#8220;<strong>Duck Hunt</strong>,&#8221; the <strong>U.S. Department of Justice</strong> (DOJ) and <strong>Federal Bureau of Investigation</strong> (FBI) said they obtained court orders to remove Qakbot from infected devices, and to seize servers used to control the botnet.</p>
<p>&#8220;This is the most significant technological and financial operation ever led by the Department of Justice against a botnet,&#8221; said <strong>Martin Estrada</strong>, the U.S. attorney for the Southern District of California, at a press conference this morning in Los Angeles.</p>
<p>Estrada said Qakbot has been implicated in 40 different ransomware attacks over the past 18 months, intrusions that collectively cost victims more than $58 million in losses.</p>
<p>Emerging in 2007 as a banking trojan, QakBot (a.k.a. <strong>Qbot</strong> and <strong>Pinkslipbot</strong>) has morphed into an advanced malware strain now used by multiple cybercriminal groups to prepare newly compromised networks for ransomware infestations. QakBot is most commonly delivered via email phishing lures disguised as something legitimate and time-sensitive, such as invoices or work orders.</p>
<p><strong>Don Alway</strong>, assistant director in charge of the FBI&#8217;s Los Angeles field office, said federal investigators gained access to an online panel that allowed cybercrooks to monitor and control the actions of the botnet. From there, investigators obtained court-ordered approval to instruct all infected systems to uninstall Qakbot and to disconnect themselves from the botnet, Alway said.</p>
<p>The DOJ says their access to the botnet&#8217;s control panel revealed that Qakbot had been used to infect more than 700,000 machines in the past year alone, including 200,000 systems in the United States.</p>
<p>Working with law enforcement partners in France, Germany, Latvia, the Netherlands, Romania and the United Kingdom, the DOJ said it was able to seize more than 50 Internet servers tied to the malware network, and nearly $9 million in ill-gotten cryptocurrency from QakBot&#8217;s cybercriminal overlords. The DOJ declined to say whether any suspects were questioned or arrested in connection with Qakbot, citing an ongoing investigation.</p>
<p>According to <a href="https://www.reliaquest.com/blog/3-malware-loaders-you-cant-shouldnt-iognore/" target="_blank" rel="noopener">recent figures</a> from the managed security firm <strong>Reliaquest</strong>, QakBot is by far the most prevalent malware &#8220;loader&#8221; &#8212; malicious software used to secure access to a hacked network and help drop additional malware payloads. Reliaquest says QakBot infections accounted for nearly one-third of all loaders observed in the wild during the first six months of this year.</p>
<div id="attachment_64715" style="width: 750px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64715" decoding="async" loading="lazy" class="size-full wp-image-64715" src="media/274045dd.qakbot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/08/qakbot.png" alt="" width="740" height="402" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/08/qakbot.png 740w, https://krebsonsecurity.com/wp-content/uploads/2023/08/qakbot-370x200.png 370w" sizes="(max-width: 740px) 100vw, 740px" /><p id="caption-attachment-64715" class="wp-caption-text">Qakbot/Qbot was once again the top malware loader observed in the wild in the first six months of 2023. Source: Reliaquest.com.</p></div>
<p><span id="more-64706"></span></p>
<p>Researchers at<strong> AT&amp;T Alien Labs</strong> <a href="https://cybersecurity.att.com/blogs/labs-research/the-rise-of-qakbot" target="_blank" rel="noopener">say</a> the crooks responsible for maintaining the QakBot botnet have rented their creation to various cybercrime groups over the years. More recently, however, QakBot has been closely associated with ransomware attacks from <strong>Black Basta</strong>, a <a href="https://www.blackberry.com/us/en/solutions/endpoint-security/ransomware-protection/black-basta" target="_blank" rel="noopener">prolific</a> Russian-language criminal group that was thought to have spun off from <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">the Conti ransomware gang in early 2022</a>.</p>
<p>Today&#8217;s operation is not the first time the U.S. government has used court orders to remotely disinfect systems compromised with malware. In April 2022, the DOJ quietly removed malware from computers around the world <a href="https://www.nytimes.com/2022/04/06/us/politics/us-russia-malware-cyberattacks.html" target="_blank" rel="noopener">infected by the &#8220;Snake&#8221; malware</a>, an even older malware family that has been tied to the GRU, an intelligence arm of the Russian military.</p>
<p>Documents published by the DOJ in support of today&#8217;s takedown state that beginning on Aug. 25, 2023, law enforcement gained access to the Qakbot botnet, redirected botnet traffic to and through servers controlled by law enforcement, and instructed Qakbot-infected computers to download a Qakbot Uninstall file that uninstalled Qakbot malware from the infected computer.</p>
<p>&#8220;The Qakbot Uninstall file did not remediate other malware that was already installed on infected computers,&#8221; the government explained. &#8220;Instead, it was designed to prevent additional Qakbot malware from being installed on the infected computer by untethering the victim computer from the Qakbot botnet.&#8221;</p>
<p>The DOJ said it also recovered more than 6.5 million stolen passwords and other credentials, and that it has shared this information with two websites that let users check to see if their credentials were exposed: <a href="https://haveibeenpwned.com/" target="_blank" rel="noopener">Have I Been Pwned</a>, and a <a href="https://politie.nl/checkyourhack" target="_blank" rel="noopener">&#8220;Check Your Hack&#8221; website</a> erected by the <strong>Dutch National Police</strong>.</p>
<p>Further reading:</p>
<p>&#8211;<a href="media/3b9564b9.23mj4244_application_redacted.pdf" data-original-source="https://www.justice.gov/d9/2023-08/23mj4244_application_redacted.pdf" target="_blank" rel="noopener">The DOJ&#8217;s application for a search warrant application tied to Qakbot uninstall file (PDF)</a><br />
&#8211;<a href="media/b603f69f.23mj4248_application_redacted.pdf" data-original-source="https://www.justice.gov/d9/2023-08/23mj4248_application_redacted.pdf" target="_blank" rel="noopener">The search warrant application connected to QakBot server infrastructure in the United States (PDF)</a><br />
&#8211;<a href="media/413dfbcd.23mj4251_application_redacted.pdf" data-original-source="https://www.justice.gov/d9/2023-08/23mj4251_application_redacted.pdf" target="_blank" rel="noopener">The government&#8217;s application for a warrant to seize virtual currency from the QakBot operators (PDF)</a></p>


feed_id: https://krebsonsecurity.com/?p=64703
title: Why is .US Being Used to Phish So Many of Us?
uri: Why-is-US-Being-Used-to-Phish-So-Many-of-Us
url: https://krebsonsecurity.com/2023/09/why-is-us-being-used-to-phish-so-many-of-us/
content:
<p><img decoding="async" class="aligncenter  wp-image-64751" src="media/a4b22354.dotUS-b.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/dotUS-b.png" alt="" width="597" height="529" /></p>
<p>Domain names ending in &#8220;.<strong>US</strong>&#8221; &#8212; the top-level domain for the United States &#8212; are among the most prevalent in phishing scams, new research shows. This is noteworthy because .US is overseen by the U.S. government, which is frequently the target of phishing domains ending in .US. Also, .US domains are only supposed to be available to U.S. citizens and to those who can demonstrate that they have a physical presence in the United States.</p>
<p>.US is the &#8220;country code top-level domain&#8221; or ccTLD of the United States. Most countries have their own ccTLDs: .MX for Mexico, for example, or .CA for Canada. But few other major countries in the world have anywhere near as many phishing domains each year as .US.</p>
<p>That&#8217;s according to <a href="https://www.interisle.net" target="_blank" rel="noopener">The Interisle Consulting Group</a>, which gathers phishing data from multiple industry sources and publishes an annual report on the latest trends. Interisle&#8217;s newest study examined six million phishing reports between May 1, 2022 and April 30, 2023, and <em>found 30,000 .US phishing domains</em>.</p>
<p>.US is overseen by the <strong>National Telecommunications and Information Administration</strong> (NTIA), an executive branch agency of the <strong>U.S. Department of Commerce</strong>. However, NTIA currently <a href="media/b2031d05.us_contract_mod_3.pdf" data-original-source="https://www.ntia.gov/files/ntia/publications/us_contract_mod_3.pdf" target="_blank" rel="noopener">contracts out</a> the management of the .US domain to <strong>GoDaddy</strong>, by far the world&#8217;s largest domain registrar.</p>
<p>Under NTIA regulations, the administrator of the .US registry must <a href="media/1acd1ac5.ustld2007_34_apph_nexus.pdf" data-original-source="https://www.ntia.doc.gov/files/ntia/publications/ustld2007_34_apph_nexus.pdf" target="_blank" rel="noopener">take certain steps</a> to verify that their customers actually reside in the United States, or own organizations based in the U.S. But Interisle found that whatever GoDaddy was doing to manage that vetting process wasn&#8217;t working.</p>
<p>&#8220;The .US &#8216;nexus&#8217; requirement theoretically limits registrations to parties with a national connection, but .US had very high numbers of phishing domains,&#8221; Interisle wrote. &#8220;This indicates a possible problem with the administration or application of the nexus requirements.&#8221;</p>
<p><strong>Dean Marks</strong> is executive director and legal counsel for a group called the <strong>Coalition for Online Accountability</strong>, which has been critical of the NTIA&#8217;s stewardship of .US. Marks says virtually all European Union member state ccTLDs that enforce nexus restrictions also have massively lower levels of abuse due to their policies and oversight.</p>
<p>&#8220;Even very large ccTLDs, like .de for Germany &#8212; which has a far larger market share of domain name registrations than .US &#8212; have very low levels of abuse, including phishing and malware,&#8221; Marks told KrebsOnSecurity. <span class="pullquote pqright">&#8220;In my view, this situation with .US should not be acceptable to the U.S. government overall, nor to the US public.&#8221;</span></p>
<p>Marks said there are very few phishing domains ever registered in other ccTLDs that also restrict registrations to their citizens, such as .HU (Hungary), .NZ (New Zealand), and .FI (Finland), where a connection to the country, a proof of identity, or evidence of incorporation are required.</p>
<p>&#8220;Or .LK (Sri Lanka), where the acceptable use policy includes a &#8216;lock and suspend&#8217; if domains are reported for suspicious activity,&#8221; Marks said. &#8220;These ccTLDs make a strong case for validating domain registrants in the interest of public safety.&#8221;</p>
<p>Sadly, .US has been a cesspool of phishing activity for many years. As far back as 2018, Interisle found .US domains were the worst in the world for spam, botnet (attack infrastructure for DDOS etc.) and illicit or harmful content. Back then, .US was being operated by <a href="https://www.ntia.gov/press-release/2019/neustar-continue-operate-us-country-code-top-level-domain" target="_blank" rel="noopener">a different contractor</a>.</p>
<p>In response to questions from KrebsOnSecurity, GoDaddy said all .US registrants must certify that they meet the NTIA&#8217;s nexus requirements. But this appears to be little more than an affirmative response that is already pre-selected for all new registrants. </p>
<p>Attempting to register a .US domain through GoDaddy, for example, leads to a U.S. Registration Information page that auto-populates the nexus attestation field with the response, &#8220;I am a citizen of the United States.&#8221; Other options include, &#8220;I am a permanent resident of the US,&#8221; and &#8220;My primary domicile is in the US.&#8221; It currently costs just $4.99 to obtain a .US domain through GoDaddy.</p>
<p>GoDaddy said it also conducts a scan of selected registration request information, and conducts &#8220;spot checks&#8221; on registrant information.</p>
<p>&#8220;We conduct regular reviews, per policy, of registration data within the Registry database to determine Nexus compliance with ongoing communications to registrars and registrants,&#8221; the company said in a written statement. </p>
<p>GoDaddy says it &#8220;is committed to supporting a safer online environment and proactively addressing this issue by assessing it against our own anti-abuse mitigation system.&#8221;</p>
<p>&#8220;We stand against DNS abuse in any form and maintain multiple systems and protocols to protect all the TLDs we operate,&#8221; the statement continued. &#8220;We will continue to work with registrars, cybersecurity firms and other stakeholders to make progress with this complex challenge.&#8221;<span id="more-64703"></span></p>
<p>Interisle found significant numbers of .US domains were registered to attack some of the United States’ most prominent companies, including <strong>Bank of America</strong>, <strong>Amazon, </strong><strong>Apple</strong>, <strong>AT&amp;T</strong>, <strong>Citi</strong>, <strong>Comcast</strong>, <strong>Microsoft</strong>, <strong>Meta</strong>, and <strong>Target</strong>.</p>
<p>&#8220;Ironically, at least 109 of the .US domains in our data were used to attack the United States government, specifically the United States Postal Service and its customers,&#8221; Interisle wrote. &#8220;.US domains were also used to attack foreign government operations: six .US domains were used to attack Australian government services, six attacked Great’s Britain’s Royal Mail, one attacked Canada Post, and one attacked the Denmark Tax Authority.&#8221;</p>
<p>The NTIA <a href="https://www.federalregister.gov/documents/2023/05/01/2023-09180/introduction-of-accountable-measures-regarding-access-to-personal-information-of-us-registrants" target="_blank" rel="noopener">recently published a proposal</a> that would allow GoDaddy to redact registrant data from WHOIS registration records. The current charter for .US specifies that all .US registration records be public.</p>
<p>Interisle argues that without more stringent efforts to verify a United States nexus for new .US domain registrants, the NTIA&#8217;s proposal will make it even more difficult to identify phishers and verify registrants’ identities and nexus qualifications.</p>
<p>The NTIA has not yet responded to requests for comment.</p>
<p>Interisle sources its phishing data from several places, including the <a href="https://apwg.org/" target="_blank" rel="noopener">Anti-Phishing Working Group</a> (APWG), <a href="https://openphish.com/" target="_blank" rel="noopener">OpenPhish</a>, <a href="https://www.phishtank.com" target="_blank" rel="noopener">PhishTank</a>, and <a href="https://www.spamhaus.org" target="_blank" rel="noopener">Spamhaus</a>. For more phishing facts, see Interisle&#8217;s <a href="media/351f9235.PhishingLandscape2023.pdf" data-original-source="https://interisle.net/PhishingLandscape2023.pdf" target="_blank" rel="noopener">2023 Phishing Landscape report</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=64785
title: Experts Fear Crooks are Cracking Keys Stolen in LastPass Breach
uri: Experts-Fear-Crooks-are-Cracking-Keys-Stolen-in-LastPass-Breach
url:
https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/

content:
<p>In November 2022, the password manager service <strong>LastPass</strong> disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users. Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that crooks likely have succeeded at cracking open some of the stolen LastPass vaults.</p>
<p><strong>Taylor Monahan</strong> is founder and CEO of <strong>MetaMask</strong>, a popular software cryptocurrency wallet used to interact with the Ethereum blockchain. Since late December 2022, Monahan and other researchers have identified a highly reliable set of clues that they say connect recent thefts targeting more than 150 people, Collectively, these individuals have been robbed of more than $35 million worth of crypto.</p>
<p>Monahan said virtually all of the victims she has assisted were longtime cryptocurrency investors, and security-minded individuals. Importantly, none appeared to have suffered the sorts of attacks that typically preface a high-dollar crypto heist, such as the compromise of one&#8217;s email and/or mobile phone accounts.</p>
<p>&#8220;The victim profile remains the most striking thing,&#8221; Monahan wrote. &#8220;They truly all are reasonably secure. They are also deeply integrated into this ecosystem, [including] employees of reputable crypto orgs, VCs [venture capitalists], people who built DeFi protocols, deploy contracts, run full nodes.&#8221;</p>
<p>Monahan has been <a href="https://twitter.com/tayvano_/status/1648187031468781568" target="_blank" rel="noopener">documenting the crypto thefts via Twitter/X</a> since March 2023, frequently expressing frustration in the search for a common cause among the victims. Then on Aug. 28, Monahan said she&#8217;d concluded that the common thread among nearly every victim was that they&#8217;d previously used LastPass to store their &#8220;seed phrase,&#8221; the private key needed to unlock access to their cryptocurrency investments.</p>
<div id="attachment_64831" style="width: 592px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64831" decoding="async" class="size-full wp-image-64831" src="media/005aafd7.tayaug28.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/tayaug28.png" alt="" width="582" height="844" /><p id="caption-attachment-64831" class="wp-caption-text">MetaMask owner Taylor Monahan on Twitter. Image: twitter.com/tayvano</p></div>
<p>Armed with your secret seed phrase, anyone can instantly access all of the cryptocurrency holdings tied to that cryptographic key, and move the funds to anywhere they like.</p>
<p>Which is why the best practice for many cybersecurity enthusiasts has long been to store their seed phrases either in some type of encrypted container &#8212; such as a password manager &#8212; or else inside an offline, special-purpose hardware encryption device, such as a Trezor or Ledger wallet.</p>
<p>&#8220;The seed phrase is literally the money,&#8221; said <strong>Nick Bax</strong>, director of analytics at <a href="https://www.unciphered.com" target="_blank" rel="noopener">Unciphered</a>, a cryptocurrency wallet recovery company. &#8220;If you have my seed phrase, you can copy and paste that into your wallet, and then you can see all my accounts. And you can transfer my funds.&#8221;</p>
<p>Bax said he closely reviewed the massive trove of cryptocurrency theft data that Taylor Monahan and others have collected and linked together.</p>
<p>&#8220;It&#8217;s one of the broadest and most complex cryptocurrency investigations I&#8217;ve ever seen,&#8221; Bax said. &#8220;I ran my own analysis on top of their data and reached the same conclusion that Taylor reported. The threat actor moved stolen funds from multiple victims to the same blockchain addresses, making it possible to strongly link those victims.&#8221;</p>
<p>Bax, Monahan and others interviewed for this story say they&#8217;ve identified a unique signature that links the theft of more than $35 million in crypto from more than 150 confirmed victims, with roughly two to five high-dollar heists happening each month since December 2022.</p>
<p>KrebsOnSecurity has reviewed this signature but is not publishing it at the request of Monahan and other researchers, who say doing so could cause the attackers to alter their operations in ways that make their criminal activity more difficult to track.</p>
<p>But the researchers have published findings about the dramatic similarities in the ways that victim funds were stolen and laundered through specific cryptocurrency exchanges. They also learned the attackers frequently grouped together victims by sending their cryptocurrencies to the same destination crypto wallet.</p>
<div id="attachment_64829" style="width: 260px" class="wp-caption alignright"><img aria-describedby="caption-attachment-64829" decoding="async" loading="lazy" class=" wp-image-64829" src="media/87b8efc8.taygraph.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/taygraph.png" alt="" width="250" height="653" /><p id="caption-attachment-64829" class="wp-caption-text">A graphic published by @tayvano on Twitter depicting the movement of stolen cryptocurrencies from victims who used LastPass to store their crypto seed phrases.</p></div>
<p>By identifying points of overlap in these destination addresses, the researchers were then able to track down and interview new victims. For example, the researchers said their methodology identified a recent multi-million dollar crypto heist victim as an employee at <strong>Chainalysis</strong>, a blockchain analysis firm that works closely with law enforcement agencies to help track down cybercriminals and money launderers.</p>
<p>Chainalysis confirmed that the employee had suffered a high-dollar cryptocurrency heist late last month, but otherwise declined to comment for this story.</p>
<p>Bax said the only obvious commonality between the victims who agreed to be interviewed was that they had stored the seed phrases for their cryptocurrency wallets in LastPass.</p>
<p>&#8220;On top of the overlapping indicators of compromise, there are more circumstantial behavioral patterns and tradecraft which are also consistent between different thefts and support the conclusion,&#8221; Bax told KrebsOnSecuirty. &#8220;I&#8217;m confident enough that this is a real problem that I&#8217;ve been urging my friends and family who use LastPass to change all of their passwords and migrate any crypto that may have been exposed, despite knowing full well how tedious that is.&#8221;</p>
<p>LastPass declined to answer questions about the research highlighted in this story, citing an ongoing law enforcement investigation and pending litigation against the company in response to its 2022 data breach.</p>
<p>&#8220;Last year’s incident remains the subject of an ongoing investigation by law enforcement and is also the subject of pending litigation,&#8221; LastPass said in a written statement provided to KrebsOnSecurity. &#8220;Since last year&#8217;s attack on LastPass, we have remained in contact with law enforcement and continue to do so.&#8221;</p>
<p>Their statement continues:</p>
<p>&#8220;We have shared various technical information, Indicators of Compromise (IOCs), and threat actor tactics, techniques, and procedures (TTPs) with our law enforcement contacts as well as our internal and external threat intelligence and forensic partners in an effort to try and help identify the parties responsible. In the meantime, we encourage any security researchers to share any useful information they believe they may have with our Threat Intelligence team by contacting securitydisclosure@lastpass.com.&#8221;<span id="more-64785"></span></p>
<h2>THE LASTPASS BREACH(ES)</h2>
<p>On August 25, 2022, <strong>LastPass CEO Karim Toubba</strong> wrote to users that the company had detected unusual activity in its software development environment, and that the intruders stole some source code and proprietary LastPass technical information. On Sept. 15, 2022, LastPass said an investigation into the August breach determined the attacker did not access any customer data or password vaults.</p>
<p>But on Nov. 30, 2022, LastPass notified customers about another, far more serious security incident that the company said leveraged data stolen in the August breach. LastPass disclosed that criminal hackers had compromised encrypted copies of some password vaults, as well as other personal information.</p>
<p>In February 2023, LastPass disclosed that the intrusion involved a highly complex, targeted attack against a DevOps engineer who was one of only four LastPass employees with access to the corporate vault.</p>
<p>&#8220;This was accomplished by targeting the DevOps engineer’s home computer and exploiting a vulnerable third-party media software package, which enabled remote code execution capability and allowed the threat actor to implant keylogger malware,&#8221; LastPass officials wrote. &#8220;The threat actor was able to capture the employee’s master password as it was entered, after the employee authenticated with MFA, and gain access to the DevOps engineer’s LastPass corporate vault.&#8221;</p>
<p><strong>Dan Goodin </strong>at Ars Technica <a href="https://arstechnica.com/information-technology/2023/02/lastpass-hackers-infected-employees-home-computer-and-stole-corporate-vault/" target="_blank" rel="noopener">reported</a> and then <a href="https://infosec.exchange/@dangoodin/109950447675626971" target="_blank" rel="noopener">confirmed</a> that the attackers exploited a known vulnerability in a <strong>Plex</strong> media server that the employee was running on his home network, and succeeded in installing malicious software that stole passwords and other authentication credentials. The vulnerability exploited by the intruders was patched back in 2020, but the employee never updated his Plex software.</p>
<p>As it happens, Plex announced its own data breach one day before LastPass disclosed its initial August intrusion. On August 24, 2022, Plex&#8217;s security team urged users to reset their passwords, saying an intruder had accessed customer emails, usernames and encrypted passwords.</p>
<h2>OFFLINE ATTACKS</h2>
<p>A basic functionality of LastPass is that it will pick and remember lengthy, complex passwords for each of your websites or online services. To automatically populate the appropriate credentials at any website going forward, you simply authenticate to LastPass using your master password.</p>
<p>LastPass has always emphasized that if you lose this master password, that&#8217;s too bad because they don&#8217;t store it and their encryption is so strong that even they can&#8217;t help you recover it.</p>
<p>But experts say all bets are off when cybercrooks can get their hands on the encrypted vault data itself &#8212; as opposed to having to interact with LastPass via its website. These so-called &#8220;offline&#8221; attacks allow the bad guys to conduct unlimited and unfettered &#8220;brute force&#8221; password cracking attempts against the encrypted data using powerful computers that can each try millions of password guesses per second.</p>
<p>&#8220;It does leave things vulnerable to brute force when the vaults are stolen en masse, especially if info about the vault HOLDER is available,&#8221; said <strong>Nicholas Weaver</strong>, a researcher at University of California, Berkeley’s <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a> (ICSI) and lecturer at UC Davis. &#8220;So you just crunch and crunch and crunch with GPUs, with a priority list of vaults you target.&#8221;</p>
<p>How hard would it be for well-resourced criminals to crack the master passwords securing LastPass user vaults? Perhaps the best answer to this question comes from <strong>Wladimir Palant</strong>, a security researcher and the original developer behind the <strong>Adblock Plus</strong> browser plugin.</p>
<p>In <a href="https://palant.info/2022/12/28/lastpass-breach-the-significance-of-these-password-iterations/" target="_blank" rel="noopener">a December 2022 blog post</a>, Palant explained that the crackability of the LastPass master passwords depends largely on two things: The complexity of the master password, and the default settings for LastPass users, which appear to have varied quite a bit based on when those users began patronizing the service.</p>
<p>LastPass says that since 2018 it has required a twelve-character minimum for master passwords, which the company said &#8220;greatly minimizes the ability for successful brute force password guessing.&#8221;</p>
<p>But Palant said while LastPass indeed improved its master password defaults in 2018, it did not force all existing customers who had master passwords of lesser lengths to pick new credentials that would satisfy the 12-character minimum.</p>
<p>&#8220;If you are a LastPass customer, chances are that you are completely unaware of this requirement,&#8221; Palant wrote. &#8220;That’s because LastPass didn’t ask existing customers to change their master password. I had my test account since 2018, and even today I can log in with my eight-character password without any warnings or prompts to change it.&#8221;</p>
<p>Palant believes LastPass also failed to upgrade many older, original customers to more secure encryption protections that were offered to newer customers over the years. One important setting in LastPass is the number of &#8220;iterations,&#8221; or how many times your master password is run through the company&#8217;s encryption routines. The more iterations, the longer it takes an offline attacker to crack your master password.</p>
<p>Palant noted last year that for many older LastPass users, the initial default setting for iterations was anywhere from &#8220;1&#8221; to &#8220;500.&#8221; By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000.</p>
<p>Palant said the 2018 change was in response to a security bug report he filed about some users having dangerously low iterations in their LastPass settings.</p>
<p>&#8220;Worse yet, for reasons that are beyond me, LastPass didn’t complete this migration,&#8221; Palant wrote. &#8220;My test account is still at 5,000 iterations, as are the accounts of many other users who checked their LastPass settings. LastPass would know how many users are affected, but they aren’t telling that. In fact, it’s painfully obvious that LastPass never bothered updating users’ security settings. Not when they changed the default from 1 to 500 iterations. Not when they changed it from 500 to 5,000. Only my persistence made them consider it for their latest change. And they still failed implementing it consistently.&#8221;</p>
<p>A chart on Palant&#8217;s blog post offers an idea of how increasing password iterations dramatically increases the costs and time needed by the attackers to crack someone&#8217;s master password. Palant said it would take a single GPU about a year to crack a password of average complexity with 500 iterations, and about 10 years to crack the same password run through 5,000 iterations.</p>
<div id="attachment_64836" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64836" decoding="async" loading="lazy" class=" wp-image-64836" src="media/951124ac.gpuguesstime.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/gpuguesstime.png" alt="" width="754" height="219" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/gpuguesstime.png 850w, https://krebsonsecurity.com/wp-content/uploads/2023/09/gpuguesstime-768x223.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/gpuguesstime-782x227.png 782w" sizes="(max-width: 754px) 100vw, 754px" /><p id="caption-attachment-64836" class="wp-caption-text">Image: palant.info</p></div>
<p>However, these numbers radically come down when a determined adversary also has other large-scale computational assets at their disposal, such as a bitcoin mining operation that can coordinate the password-cracking activity across multiple powerful systems simultaneously.</p>
<p>Weaver said a password or passphrase with average complexity &#8212; such as &#8220;Correct Horse Battery Staple&#8221; is only secure against online attacks, and that its roughly 40 bits of randomness or &#8220;<a href="https://www.omnicalculator.com/other/password-entropy" target="_blank" rel="noopener">entropy</a>&#8221; means a graphics card can blow through it in no time.</p>
<p>&#8220;An Nvidia 3090 can do roughly 4 million [password guesses] per second with 1000 iterations, but that would go down to 8 thousand per second with 500,000 iterations, which is why iteration count matters so much,&#8221; Weaver said. &#8220;So a combination of &#8216;not THAT strong of a password&#8217; and &#8216;old vault&#8217; and &#8216;low iteration count&#8217; would make it theoretically crackable but real work, but the work is worth it given the targets.&#8221;</p>
<p>Reached by KrebsOnSecurity, Palant said he never received a response from LastPass about why the company apparently failed to migrate some number of customers to more secure account settings.</p>
<p>&#8220;I know exactly as much as everyone else,&#8221; Palant wrote in reply. &#8220;LastPass published <a href="https://palant.info/2023/02/28/lastpass-breach-update-the-few-additional-bits-of-information/." target="_blank" rel="noopener">some additional information in March</a>. This finally answered the questions about the timeline of their breach – meaning which users are affected. It also made obvious that business customers are very much at risk here, Federated Login Services being highly compromised in this breach (LastPass downplaying as usual of course).&#8221;</p>
<p>Palant said upon logging into his LastPass account a few days ago, he found his master password was still set at 5,000 iterations.</p>
<h2>INTERVIEW WITH A VICTIM</h2>
<p>KrebsOnSecurity interviewed one of the victims tracked down by Monahan, a software engineer and startup founder who recently was robbed of approximately $3.4 million worth of different cryptocurrencies. The victim agreed to tell his story in exchange for anonymity because he is still trying to claw back his losses. We&#8217;ll refer to him here as &#8220;Connor&#8221; (not his real name).</p>
<p>Connor said he began using LastPass roughly a decade ago, and that he also stored the seed phrase for his primary cryptocurrency wallet inside of LastPass. Connor chose to protect his LastPass password vault with an eight character master password that included numbers and symbols (~50 bits of entropy).</p>
<p>&#8220;I thought at the time that the bigger risk was losing a piece of paper with my seed phrase on it,&#8221; Connor said. &#8220;I had it in a bank security deposit box before that, but then I started thinking, &#8216;Hey, the bank might close or burn down and I could lose my seed phrase.'&#8221;</p>
<p>Those seed phrases sat in his LastPass vault for years. Then, early on the morning of Sunday, Aug. 27, 2023, Connor was awoken by a service he&#8217;d set up to monitor his cryptocurrency addresses for any unusual activity: Someone was draining funds from his accounts, and fast.</p>
<p>Like other victims interviewed for this story, Connor didn&#8217;t suffer the usual indignities that typically presage a cryptocurrency robbery, such as account takeovers of his email inbox or mobile phone number.</p>
<p>Connor said he doesn&#8217;t know the number of iterations his master password was given originally, or what it was set at when the LastPass user vault data was stolen last year. But he said he recently logged into his LastPass account and the system forced him to upgrade to the new 600,000 iterations setting.</p>
<p>&#8220;Because I set up my LastPass account so early, I&#8217;m pretty sure I had whatever weak settings or iterations it originally had,&#8221; he said.</p>
<p>Connor said he&#8217;s kicking himself because he recently started the process of migrating his cryptocurrency to a new wallet protected by a new seed phrase. But he never finished that migration process. And then he got hacked.</p>
<p>&#8220;I&#8217;d set up a brand new wallet with new keys,&#8221; he said. &#8220;I had that ready to go two months ago, but have been procrastinating moving things to the new wallet.&#8221;</p>
<p>Connor has been exceedingly lucky in regaining access to some of his stolen millions in cryptocurrency. The Internet is swimming with con artists masquerading as legitimate cryptocurrency recovery experts. To make matters worse, because time is so critical in these crypto heists, many victims turn to the first quasi-believable expert who offers help.</p>
<p>Instead, several friends steered Connor to <a href="https://noteforms.com/forms/flashbots-whitehat-intake-form?notionforms=1&amp;utm_source=notionforms" target="_blank" rel="noopener">Flashbots.net</a>, a cryptocurrency recovery firm that employs several custom techniques to help clients claw back stolen funds &#8212; particularly those on the Ethereum blockchain.</p>
<p>According to Connor, Flashbots helped rescue approximately $1.5 million worth of the $3.4 million in cryptocurrency value that was suddenly swept out of his account roughly a week ago. Lucky for him, Connor had some of his assets tied up in a type of digital loan that allowed him to borrow against his various cryptocurrency assets.</p>
<p>Without giving away too many details about how they clawed back the funds, here&#8217;s a high level summary: When the crooks who stole Connor&#8217;s seed phrase sought to extract value from these loans, they were borrowing the maximum amount of credit that he hadn&#8217;t already used. But Connor said that left open an avenue for some of that value to be recaptured, basically by repaying the loan in many small, rapid chunks.</p>
<h2>WHAT SHOULD LASTPASS USERS DO?</h2>
<p>According to MetaMask&#8217;s Monahan, users who stored any important passwords with LastPass &#8212; particularly those related to cryptocurrency accounts &#8212; should change those credentials immediately, and migrate any crypto holdings to new offline hardware wallets.</p>
<p>&#8220;Really the ONLY thing you need to read is this,&#8221; Monahan pleaded to her 70,000 followers on Twitter/X: &#8220;PLEASE DON&#8217;T KEEP ALL YOUR ASSETS IN A SINGLE KEY OR SECRET PHRASE FOR YEARS. THE END. Split up your assets. Get a hw [hardware] wallet. Migrate. Now.&#8221;</p>
<p>If you also had passwords tied to banking or retirement accounts, or even just important email accounts &#8212; now would be a good time to change those credentials as well.</p>
<p>I&#8217;ve never been comfortable recommending password managers, because I&#8217;ve never seriously used them myself. Something about putting all your eggs in one basket. Heck, I&#8217;m so old-fashioned that most of my important passwords are written down and tucked away in safe places.</p>
<p>But I recognize this antiquated approach to password management is not for everyone. Connor says he now uses 1Password, a competing password manager that recently earned the best overall marks from <a href="https://www.wired.com/story/best-password-managers/" target="_blank" rel="noopener">Wired</a> and <a href="https://www.nytimes.com/wirecutter/reviews/1password-review/" target="_blank" rel="noopener">The New York Times</a>.</p>
<p>1Password says that three things are needed to decrypt your information: The encrypted data itself, your account password, and your Secret Key. Only you know your account password, and your Secret Key is generated locally during setup.</p>
<p>&#8220;The two are combined on-device to encrypt your vault data and are never sent to 1Password,&#8221; explains a 1Password blog post &#8216;<a href="https://blog.1password.com/what-if-1password-gets-hacked/" target="_blank" rel="noopener">What If 1Password Gets Hacked?</a>&#8216; &#8220;Only the encrypted vault data lives on our servers, so neither 1Password nor an attacker who somehow manages to guess or steal your account password would be able to access your vaults – or what’s inside them.</p>
<p>Weaver said that Secret Key adds an extra level of randomness to all user master passwords that LastPass didn&#8217;t have.</p>
<p>&#8220;With LastPass, the idea is the user&#8217;s password vault is encrypted with a cryptographic hash (H) of the user&#8217;s passphrase,&#8221; Weaver said. &#8220;The problem is a hash of the user&#8217;s passphrase is remarkably weak on older LastPass vaults with master passwords that do not have many iterations. 1Password uses H(random-key||password) to generate the password, and it is why you have the QR code business when adding a new device.&#8221;</p>
<p>Weaver said LastPass deserves blame for not having upgraded iteration counts for all users a long time ago, and called the latest forced upgrades &#8220;a stunning indictment of the negligence on the part of LastPass.&#8221;</p>
<p>&#8220;That they never even notified all those with iteration counts of less than 100,000 &#8212; who are really vulnerable to brute force even with 8-character random passwords or &#8216;correct horse battery staple&#8217; type passphrases &#8212; is outright negligence,&#8221; Weaver said. &#8220;I would personally advocate that nobody ever uses LastPass again: Not because they were hacked. Not because they had an architecture (unlike 1Password) that makes such hacking a problem. But because of their consistent refusal to address how they screwed up and take proactive efforts to protect their customers.&#8221;</p>
<p>Bax and Monahan both acknowledged that their research alone can probably never conclusively tie dozens of high-dollar crypto heists over the past year to the LastPass breach. But Bax says at this point he doesn&#8217;t see any other possible explanation.</p>
<p>&#8220;Some might say it&#8217;s dangerous to assert a strong connection here, but I&#8217;d say it&#8217;s dangerous to assert there isn&#8217;t one,&#8221; he said. &#8220;I was arguing with my fiance about this last night. She&#8217;s waiting for LastPass to tell her to change everything. Meanwhile, I&#8217;m telling her to do it now.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=64874
title: Adobe, Apple, Google & Microsoft Patch 0-Day Bugs
uri: Adobe-Apple-Google-Microsoft-Patch-0-Day-Bugs
url: https://krebsonsecurity.com/2023/09/adobe-apple-google-microsoft-patch-0-day-bugs/
content:
<p><strong>Microsoft</strong> today issued software updates to fix at least five dozen security holes in <strong>Windows</strong> and supported software, including patches for two zero-day vulnerabilities that are already being exploited. Also, <strong>Adobe</strong>, <strong>Google Chrome</strong> and <strong>Apple iOS</strong> users may have their own zero-day patching to do.</p>
<p><img decoding="async" class="aligncenter  wp-image-52701" src="media/1b8d5661.zeroday.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/zeroday.png" alt="" width="751" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/08/zeroday.png 636w, https://krebsonsecurity.com/wp-content/uploads/2020/08/zeroday-580x383.png 580w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>On Sept. 7, researchers at <strong>Citizen Lab</strong> <a href="https://citizenlab.ca/2023/09/blastpass-nso-group-iphone-zero-click-zero-day-exploit-captured-in-the-wild/" target="_blank" rel="noopener">warned</a> they were seeing active exploitation of a &#8220;zero-click,&#8221; <a href="https://en.wikipedia.org/wiki/Zero-day_(computing)" target="_blank" rel="noopener">zero-day</a> flaw to install spyware on iOS devices without any interaction from the victim.</p>
<p>&#8220;The exploit chain was capable of compromising iPhones running the latest version of iOS (16.6) without any interaction from the victim,&#8221; the researchers wrote.</p>
<p>According to Citizen Lab, the exploit uses malicious images sent via <strong>iMessage</strong>, an embedded component of Apple&#8217;s iOS that has been the source of previous zero-click flaws in iPhones and iPads.</p>
<p>Apple says the iOS flaw (<strong>CVE-2023-41064</strong>) does not seem to work against devices that have its ultra-paranoid &#8220;<strong>Lockdown Mode</strong>&#8221; enabled. This feature restricts non-essential iOS features to reduce the device&#8217;s overall attack surface, and it was designed for users concerned that they may be subject to targeted attacks. Citizen Lab says the bug it discovered was being exploited to install spyware made by the Israeli cyber surveillance company <a href="https://citizenlab.ca/2023/04/nso-groups-pegasus-spyware-returns-in-2022/" target="_blank" rel="noopener">NSO Group</a>.</p>
<p>This vulnerability is fixed in <a href="https://support.apple.com/en-us/HT213905" target="_blank" rel="noopener">iOS 16.6.1 and iPadOS 16.6.1</a>. To turn on Lockdown Mode in iOS 16, go to Settings, then Privacy and Security, then Lockdown Mode.</p>
<p>Not to be left out of the zero-day fun, Google <a href="https://chromereleases.googleblog.com/2023/09/stable-channel-update-for-desktop_11.html" target="_blank" rel="noopener">acknowledged</a> on Sept. 11 that an exploit for a <a href="https://www.geeksforgeeks.org/heap-overflow-stack-overflow/" target="_blank" rel="noopener">heap overflow</a> bug in Chrome is being exploited in the wild. Google says it is releasing updates to fix the flaw, and that restarting Chrome is the way to apply any pending updates. Interestingly, Google says this bug was reported by Apple and Citizen Lab.<span id="more-64874"></span></p>
<p>On the Microsoft front, a zero-day in <strong>Microsoft Word</strong> is among the more concerning bugs fixed today. Tracked as <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36761" target="_blank" rel="noopener">CVE-2023-36761</a>, it is flagged as an &#8220;information disclosure&#8221; vulnerability. But that description hardly grasps at the sensitivity of the information potentially exposed here.</p>
<p><strong>Tom Bowyer</strong>, manager of product security at <strong>Automox</strong>, said exploiting this vulnerability could lead to the disclosure of <a href="https://www.ired.team/offensive-security/initial-access/netntlmv2-hash-stealing-using-outlook" target="_blank" rel="noopener">Net-NTLMv2 hashes</a>, which are used for authentication in Windows environments.</p>
<p>&#8220;If a malicious actor gains access to these hashes, they can potentially impersonate the user, gaining unauthorized access to sensitive data and systems,&#8221; Bowyer said, noting that CVE-2023-36761 can be exploited just by viewing a malicious document in the Windows preview pane. &#8220;They could also conduct pass-the-hash attacks, where the attacker uses the hashed version of a password to authenticate themselves without needing to decrypt it.&#8221;</p>
<p>The other Windows zero-day fixed this month is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36802" target="_blank" rel="noopener">CVE-2023-36802</a>. This is an &#8220;elevation of privilege&#8221; flaw in the &#8220;Microsoft Streaming Service Proxy,&#8221; which is built into Windows 10, 11 and Windows Server versions. Microsoft says an attacker who successfully exploits the bug can gain SYSTEM level privileges on a Windows computer.</p>
<p>Five of the flaws Microsoft fixed this month earned its &#8220;critical&#8221; rating, which the software giant reserves for vulnerabilities that can be exploited by malware or malcontents with little or no interaction by Windows users.</p>
<p>According to the <a href="https://isc.sans.edu/diary/Microsoft%20September%202023%20Patch%20Tuesday/30214" target="_blank" rel="noopener">SANS Internet Storm Center</a>, the most serious critical bug in September&#8217;s Patch Tuesday is <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-38148" target="_blank" rel="noopener">CVE-2023-38148</a>, which is a weakness in the <strong>Internet Connection Sharing</strong> service on Windows. Microsoft says an unauthenticated attacker could leverage the flaw to install malware just sending a specially crafted data packet to a vulnerable Windows system.</p>
<p>Finally, Adobe has released critical security updates for its <strong>Adobe Reader</strong> and <strong>Acrobat</strong> software that also fixes a zero-day vulnerability (<strong>CVE-2023-26369</strong>). More details are at <a href="https://helpx.adobe.com/security/products/acrobat/apsb23-34.html" target="_blank" rel="noopener">Adobe&#8217;s advisory</a>.</p>
<p>For a more granular breakdown of the Windows updates pushed out today, check out <a href="https://patchtuesdaydashboard.com/" target="_blank" rel="noopener">Microsoft Patch Tuesday by Morphus Labs</a>. In the meantime, consider backing up your data before updating Windows, and keep an eye on <a href="https://www.askwoody.com/2023/september-patches-apple-headlines-and-browsers/" target="_blank" rel="noopener">AskWoody.com</a> for reports of any widespread problems with any of the updates released as part of September&#8217;s Patch Tuesday.</p>


feed_id: https://krebsonsecurity.com/?p=64910
title: FBI Hacker Dropped Stolen Airbus Data on 9/11
uri: FBI-Hacker-Dropped-Stolen-Airbus-Data-on-9-11
url: https://krebsonsecurity.com/2023/09/fbi-hacker-dropped-stolen-airbus-data-on-9-11/
content:
<p>In December 2022, KrebsOnSecurity broke the news that a cybercriminal using the handle &#8220;<strong>USDoD</strong>&#8221; had <a href="https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/" target="_blank" rel="noopener">infiltrated</a> the <strong>FBI</strong>&#8216;s vetted information sharing network <strong>InfraGard</strong>, and was selling the contact information for all 80,000 members. The FBI responded by reverifying InfraGard members and by seizing the cybercrime forum where the data was being sold. But on Sept. 11, 2023, USDoD resurfaced after a lengthy absence to leak sensitive employee data stolen from the aerospace giant <strong>Airbus</strong>, while promising to visit the same treatment on top U.S. defense contractors.</p>
<div id="attachment_64922" style="width: 813px" class="wp-caption aligncenter"><a href="media/8acf2fce.airbusdod.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/airbusdod.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64922" decoding="async" class="wp-image-64922 size-full" src="media/8acf2fce.airbusdod.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/airbusdod.png" alt="" width="803" height="128" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/airbusdod.png 803w, https://krebsonsecurity.com/wp-content/uploads/2023/09/airbusdod-768x122.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/airbusdod-782x125.png 782w" sizes="(max-width: 803px) 100vw, 803px" /></a><p id="caption-attachment-64922" class="wp-caption-text">USDoD&#8217;s avatar used to be the seal of the U.S. Department of Defense. Now it&#8217;s a charming kitten.</p></div>
<p>In a post on the English language cybercrime forum <strong>BreachForums</strong>, USDoD leaked information on roughly 3,200 Airbus vendors, including names, addresses, phone numbers, and email addresses. USDoD claimed they grabbed the data by using passwords stolen from a Turkish airline employee who had third-party access to Airbus&#8217; systems.</p>
<p>USDoD didn&#8217;t say why they decided to leak the data on the 22nd anniversary of the 9/11 attacks, but there was definitely an aircraft theme to the message that accompanied the leak, which concluded with the words, &#8220;Lockheed martin, Raytheon and the entire defense contractos [sic], I&#8217;m coming for you [expletive].&#8221;</p>
<p>Airbus has apparently confirmed the cybercriminal&#8217;s account to the threat intelligence firm <strong>Hudson Rock</strong>, which determined that the Airbus credentials were stolen after a Turkish airline employee infected their computer with a prevalent and powerful info-stealing trojan called <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer" target="_blank" rel="noopener"><strong>RedLine</strong></a>.</p>
<p>Info-stealers like RedLine typically are deployed via opportunistic email malware campaigns, and by secretly bundling the trojans with cracked versions of popular software titles made available online. Credentials stolen by info-stealers often end up for sale on cybercrime shops that peddle purloined passwords and authentication cookies (these logs also often show up in the malware scanning service <a href="http://www.virustotal.com" target="_blank" rel="noopener">VirusTotal</a>).</p>
<p>Hudson Rock <a href="https://www.hudsonrock.com/blog/an-avoidable-breach-fbi-hacker-leaks-sensitive-airbus-data" target="_blank" rel="noopener">said</a> it recovered the log files created by a RedLine infection on the Turkish airline employee&#8217;s system, and found the employee likely infected their machine after downloading pirated and secretly backdoored software for Microsoft Windows.<span id="more-64910"></span></p>
<p>Hudson Rock says info-stealer infections from RedLine and a host of similar trojans have surged in recent years, and that they remain &#8220;a primary initial attack vector used by threat actors to infiltrate organizations and execute cyberattacks, including ransomware, data breaches, account overtakes, and corporate espionage.&#8221;</p>
<p>The prevalence of RedLine and other info-stealers means that a great many consequential security breaches begin with cybercriminals abusing stolen employee credentials. In this scenario, the attacker temporarily assumes the identity and online privileges assigned to a hacked employee, and the onus is on the employer to tell the difference.</p>
<p>In addition to snarfing any passwords stored on or transmitted through an infected system, info-stealers also siphon authentication cookies or tokens that allow one to remain signed-in to online services for long periods of time without having to resupply one&#8217;s password and multi-factor authentication code. By stealing these tokens, attackers can often reuse them in their own web browser, and bypass any authentication normally required for that account.</p>
<p><strong>Microsoft Corp. </strong>this week acknowledged that a China-backed hacking group was able to steal one of the keys to its email kingdom that granted near-unfettered access to U.S. government inboxes. Microsoft&#8217;s detailed <a href="https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/" target="_blank" rel="noopener">post-mortem cum mea culpa</a> explained that a secret signing key was stolen from an employee in an unlucky series of unfortunate events, and thanks to <a href="https://techcrunch.com/2023/09/08/microsoft-hacker-china-government-storm-0558/" target="_blank" rel="noopener">TechCrunch</a> we now know that the culprit once again was &#8220;token-stealing malware&#8221; on the employee&#8217;s system.</p>
<p>In April 2023, the FBI <a href="https://krebsonsecurity.com/2023/04/fbi-seizes-bot-shop-genesis-market-amid-arrests-targeting-operators-suppliers/" target="_blank" rel="noopener">seized Genesis Market</a>, a bustling, fully automated cybercrime store that was continuously restocked with freshly hacked passwords and authentication tokens stolen by a network of contractors who deployed RedLine and other info-stealer malware.</p>
<p>In March 2023, the FBI <a href="https://krebsonsecurity.com/2023/03/feds-charge-ny-man-as-breachforums-boss-pompompurin/" target="_blank" rel="noopener">arrested and charged the alleged administrator of BreachForums (aka Breached)</a>, the same cybercrime community where USDoD leaked the Airbus data. In June 2023, the <a href="https://therecord.media/breachforums-seized-by-fbi-months-after-arrest-of-alleged-administrator-dark-web-marketplace" target="_blank" rel="noopener">FBI seized the BreachForums domain name</a>, but the forum has since migrated to a new domain.</p>
<div id="attachment_62128" style="width: 760px" class="wp-caption aligncenter"><a href="media/56b3b33e.breachedige.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-62128" decoding="async" loading="lazy" class="wp-image-62128" src="media/56b3b33e.breachedige.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png" alt="" width="750" height="284" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige.png 1301w, https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige-768x290.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/12/breachedige-782x296.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-62128" class="wp-caption-text">USDoD&#8217;s InfraGard sales thread on Breached.</p></div>
<p>Unsolicited email continues to be a huge vector for info-stealing malware, but lately the crooks behind these schemes have been gaming the search engines so that their malicious sites impersonating popular software vendors actually appear before the legitimate vendor&#8217;s website. So take special care when downloading software to ensure that you are in fact getting the program from the original, legitimate source whenever possible.</p>
<p>Also, unless you <em>really</em> know what you&#8217;re doing, please don&#8217;t download and install pirated software. Sure, the cracked program might do exactly what you expect it to do, but the chances are good that it is also laced with something nasty. And when all of your passwords are stolen and your important accounts have been hijacked or sold, you will wish you had simply paid for the real thing.</p>


feed_id: https://krebsonsecurity.com/?p=64946
title: Who’s Behind the 8Base Ransomware Website?
uri: Who-s-Behind-the-8Base-Ransomware-Website
url: https://krebsonsecurity.com/2023/09/whos-behind-the-8base-ransomware-website/
content:
<p>The victim shaming website operated by the cybercriminals behind <strong>8Base</strong> &#8212; currently one of the more active ransomware groups &#8212; was until earlier today leaking quite a bit of information that the crime group probably did not intend to be made public. The leaked data suggests that at least some of website&#8217;s code was written by a 36-year-old programmer residing in the capital city of Moldova.</p>
<div id="attachment_64952" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64952" decoding="async" class=" wp-image-64952" src="media/f894511b.8Basehome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/8Basehome.png" alt="" width="748" height="477" /><p id="caption-attachment-64952" class="wp-caption-text">The 8Base ransomware group&#8217;s victim shaming website on the darknet.</p></div>
<p>8Base maintains a darknet website that is only reachable via <a href="https://www.torproject.org/" target="_blank" rel="noopener">Tor</a>, a freely available global anonymity network. The site lists hundreds of victim organizations and companies &#8212; all allegedly hacking victims that refused to pay a ransom to keep their stolen data from being published.</p>
<p>The 8Base darknet site also has a built-in chat feature, presumably so that 8Base victims can communicate and negotiate with their extortionists. This chat feature, which runs on the <a href="https://laravel.com/docs/5.0/structure" target="_blank" rel="noopener">Laravel</a> web application framework, works fine as long as you are *sending* information to the site (i.e., by making a &#8220;POST&#8221; request).</p>
<p>However, if one were to try to fetch data from the same chat service (i.e., by making a &#8220;GET&#8221; request), the website until quite recently generated an extremely verbose error message:</p>
<div id="attachment_64953" style="width: 815px" class="wp-caption aligncenter"><a href="media/82535e85.8BASEerror.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/8BASEerror.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64953" decoding="async" loading="lazy" class="wp-image-64953 size-full" src="media/82535e85.8BASEerror.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/8BASEerror.png" alt="" width="805" height="800" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/8BASEerror.png 805w, https://krebsonsecurity.com/wp-content/uploads/2023/09/8BASEerror-768x763.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/8BASEerror-782x777.png 782w" sizes="(max-width: 805px) 100vw, 805px" /></a><p id="caption-attachment-64953" class="wp-caption-text">The verbose error message when one tries to pull data from 8Base&#8217;s darknet site. Notice the link at the bottom of this image, which is generated when one hovers over the &#8220;View commit&#8221; message under the &#8220;Git&#8221; heading.</p></div>
<p>That error page revealed the true Internet address of the Tor hidden service that houses the 8Base website: 95.216.51[.]74, which according to DomainTools.com is a server in Finland that is tied to the Germany-based hosting giant Hetzner.</p>
<p>But that&#8217;s not the interesting part: Scrolling down the lengthy error message, we can see a link to a private Gitlab server called Jcube-group: <strong>gitlab[.]com/jcube-group/clients/apex/8base-v2</strong>. Digging further into this Gitlab account, we can find some curious data points available in the JCube Group&#8217;s public code repository.</p>
<p>For example, <a href="https://gitlab.com/jcubegroup/jcube-core-v2/-/blob/main/src/Constants/Status.php?ref_type=heads" target="_blank" rel="noopener">this &#8220;status.php&#8221; page</a>, which was committed to JCube Group&#8217;s Gitlab repository roughly one month ago, includes code that makes several mentions of the term &#8220;KYC&#8221; (e.g. KYC_UNVERIFIED, KYC_VERIFIED, and KYC_PENDING).</p>
<p>This is curious because a FAQ on the 8Base darknet site includes a section on &#8220;special offers for journalists and reporters,&#8221; which says the crime group is open to interviews but that journalists will need to prove their identity before any interview can take place. The 8base FAQ refers to this vetting process as &#8220;KYC,&#8221; which typically stands for &#8220;Know Your Customer.&#8221;</p>
<p>&#8220;We highly respect the work of journalists and consider information to be our priority,&#8221; the 8Base FAQ reads. &#8220;We have a special program for journalists which includes sharing information a few hours or even days before it is officially published on our news website and Telegram channel: you would need to go through a KYC procedure to apply. Journalists and reporters can contact us via our PR Telegram channel with any questions.&#8221;<span id="more-64946"></span></p>
<div id="attachment_64967" style="width: 760px" class="wp-caption aligncenter"><a href="media/c191ef68.8base-knowyourcustomer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/8base-knowyourcustomer.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-64967" decoding="async" loading="lazy" class="wp-image-64967" src="media/c191ef68.8base-knowyourcustomer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/8base-knowyourcustomer.png" alt="" width="750" height="466" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/8base-knowyourcustomer.png 1147w, https://krebsonsecurity.com/wp-content/uploads/2023/09/8base-knowyourcustomer-768x477.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/8base-knowyourcustomer-782x486.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-64967" class="wp-caption-text">The 8Base FAQ (left) and the KYC code in Kolev’s Gitlab account (right)</p></div>
<p>The 8Base darknet site also has a publicly accessible &#8220;admin&#8221; login page, which features an image of a commercial passenger plane parked at what appears to be an airport. Next to the airplane photo is a message that reads, &#8220;Welcome to 8Base. Admin Login to 8Base dashboard.&#8221;</p>
<div id="attachment_64951" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64951" decoding="async" loading="lazy" class=" wp-image-64951" src="media/4cbbb35c.8baseadmin.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/8baseadmin.png" alt="" width="749" height="593" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/8baseadmin.png 987w, https://krebsonsecurity.com/wp-content/uploads/2023/09/8baseadmin-768x608.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/8baseadmin-782x619.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-64951" class="wp-caption-text">The login page on the 8Base ransomware group&#8217;s darknet website.</p></div>
<p>Right-clicking on the 8Base admin page and selecting &#8220;View Source&#8221; produces the page&#8217;s HTML code. That code is virtually identical to a <a href="https://gitlab.com/jcubegroup/jcube-core-v2/-/blob/main/src/Views/admin/auth/login.blade.php" target="_blank" rel="noopener">&#8220;login.blade.php&#8221; page</a> that was authored and committed to JCube Group&#8217;s Gitlab repository roughly three weeks ago.</p>
<p>It appears the person responsible for the JCube Group&#8217;s code is a 36-year-old developer from Chisinau, Moldova named <strong>Andrei Kolev</strong>. Mr. Kolev&#8217;s <a href="https://www.linkedin.com/in/andrei-kolev-966807113/" target="_blank" rel="noopener">LinkedIn page</a> says he&#8217;s a full-stack developer at JCube Group, and that he&#8217;s currently looking for work. The homepage for Jcubegroup[.]com lists an address and phone number that Moldovan business records <a href="https://md.kompass.com/c/jcube-web-srl/md047291/" target="_blank" rel="noopener">confirm</a> is tied to Mr. Kolev.</p>
<p>The posts on the Twitter account for Mr. Kolev (@andrewkolev) are all written in Russian, and reference several now-defunct online businesses, including pluginspro[.]ru.</p>
<p>Reached for comment via LinkedIn, Mr. Kolev said he had no idea why the 8Base darknet site was pulling code from the &#8220;clients&#8221; directory of his private JCube Group Gitlab repository, or how the 8Base name was even included.</p>
<p>&#8220;I [don&#8217;t have] a clue, I don&#8217;t have that project in my repo,&#8221; Kolev explained. &#8220;They [aren&#8217;t] my clients. Actually we currently have just our own projects.&#8221;</p>
<p>Mr. Kolev shared a screenshot of his current projects, but very quickly after that deleted it. However, KrebsOnSecurity captured a copy of the image before it was removed:</p>
<div id="attachment_64955" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64955" decoding="async" loading="lazy" class=" wp-image-64955" src="media/b82c3d2e.kolevprojects.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/kolevprojects.png" alt="" width="751" height="322" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/kolevprojects.png 1313w, https://krebsonsecurity.com/wp-content/uploads/2023/09/kolevprojects-768x329.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/kolevprojects-782x335.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-64955" class="wp-caption-text">A screenshot of Mr. Kolev&#8217;s current projects that he quickly deleted.</p></div>
<p>Within minutes of explaining why I was reaching out to Mr. Kolev and walking him through the process of finding this connection, the 8Base website was changed, and the error message that linked to the JCube Group private Gitlab repository no longer appeared. Instead, trying the same &#8220;GET&#8221; method described above caused the 8Base website to return a &#8220;405 Method Not Allowed&#8221; error page:</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-64959" src="media/a31e1d71.8baseoops.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/8baseoops.png" alt="" width="733" height="316" /></p>
<p>Mr. Kolev claimed he didn&#8217;t know anything about the now-removed error page on 8Base&#8217;s site that referenced his private Gitlab repo, and said he deleted the screenshot from our LinkedIn chat because it contained private information.</p>
<p>Ransomware groups are known to remotely hire developers for specific projects without disclosing exactly who they are or how the new hire&#8217;s code is intended to be used, and it is possible that one of Mr. Kolev&#8217;s clients is merely a front for 8Base. But despite 8Base&#8217;s statement that they are happy to correspond with journalists, KrebsOnSecurity is still waiting for a reply from the group via their Telegram channel.</p>
<p>The tip about the leaky 8Base website was provided by a reader who asked to remain anonymous. That reader, a legitimate security professional and researcher who goes by the handle <a href="https://twitter.com/htmalgae" target="_blank" rel="noopener">@htmalgae</a> on Twitter, said it is likely that whoever developed the 8Base website inadvertently left it in &#8220;development mode,&#8221; which is what caused the site to be so verbose with its error messages.</p>
<p>&#8220;If 8Base was running the app in production mode instead of development mode, this Tor de-anonymization would have never been possible,&#8221; @htmalgae said.</p>
<p>A recent blog post from <strong>VMware/Carbon Black </strong>called the 8Base ransomware group &#8220;a heavy hitter&#8221; that has remained relatively unknown despite the massive spike in activity in Summer of 2023.</p>
<p>&#8220;8Base is a Ransomware group that has been active since March 2022 with a significant spike in activity in June of 2023,&#8221; Carbon Black researchers <a href="https://blogs.vmware.com/security/2023/06/8base-ransomware-a-heavy-hitting-player.html" target="_blank" rel="noopener">wrote</a>. &#8220;Describing themselves as &#8216;simple pen testers,&#8217; their leak site provided victim details through Frequently Asked Questions and Rules sections as well as multiple ways to contact them. &#8221;</p>
<p>According to VMware, what&#8217;s particularly interesting about 8Base’s communication style is the use of verbiage that is strikingly familiar to another known cybercriminal group: RansomHouse.</p>
<p>&#8220;The group utilizes encryption paired with &#8216;name-and-shame&#8217; techniques to compel their victims to pay their ransoms,&#8221; VMware researchers wrote. &#8220;8Base has an opportunistic pattern of compromise with recent victims spanning across varied industries. Despite the high amount of compromises, the information regarding identities, methodology, and underlying motivation behind these incidents still remains a mystery.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=64995
title: LastPass: ‘Horse Gone Barn Bolted’ is Strong Password
uri: LastPass-Horse-Gone-Barn-Bolted-is-Strong-Password
url: https://krebsonsecurity.com/2023/09/lastpass-horse-gone-barn-bolted-is-strong-password/
content:
<p>The password manager service <strong>LastPass</strong> is now forcing some of its users to pick longer master passwords. LastPass says the changes are needed to ensure all customers are protected by their latest security improvements. But critics say the move is little more than a public relations stunt that will do nothing to help countless early adopters whose password vaults were exposed in a 2022 breach at LastPass.</p>
<div id="attachment_64998" style="width: 524px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64998" decoding="async" class="wp-image-64998 size-full" src="media/a0c752cc.lp12.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/lp12.png" alt="" width="514" height="625" /><p id="caption-attachment-64998" class="wp-caption-text">LastPass sent this notification to users earlier this week.</p></div>
<p>LastPass told customers this week they would be forced to update their master password if it was less than 12 characters. LastPass officially instituted this change back in 2018, but some undisclosed number of the company&#8217;s earlier customers were never required to increase the length of their master passwords.</p>
<p>This is significant because in November 2022, LastPass disclosed a breach in which hackers stole password vaults containing both encrypted and plaintext data for more than 25 million users.</p>
<p>Since then, a steady trickle of six-figure cryptocurrency heists targeting security-conscious people throughout the tech industry has led some security experts to conclude that <a href="https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-cracking-keys-stolen-in-lastpass-breach/" target="_blank" rel="noopener">crooks likely have succeeded at cracking open some of the stolen LastPass vaults</a>.</p>
<p>KrebsOnSecurity last month interviewed a victim who recently saw more than three million dollars worth of cryptocurrency siphoned from his account. That user signed up with LastPass nearly a decade ago, stored their cryptocurrency seed phrase there, and yet never changed his master password &#8212; which was just eight characters. Nor was he ever forced to improve his master password.</p>
<p>That story cited research from Adblock Plus creator <strong>Wladimir Palant</strong>, who said LastPass failed to upgrade many older, original customers to more secure encryption protections that were offered to newer customers over the years.</p>
<p>For example, another important default setting in LastPass is the number of &#8220;iterations,&#8221; or how many times your master password is run through the company’s encryption routines. The more iterations, the longer it takes an offline attacker to crack your master password.</p>
<p>Palant said that for many older LastPass users, the initial default setting for iterations was anywhere from “1” to “500.” By 2013, new LastPass customers were given 5,000 iterations by default. In February 2018, LastPass changed the default to 100,100 iterations. And very recently, it upped that again to 600,000. Still, Palant and others impacted by the 2022 breach at LastPass say their account security settings were never forcibly upgraded.</p>
<p>Palant called this latest action by LastPass a PR stunt.</p>
<p>&#8220;They sent this message to everyone, whether they have a weak master password or not – this way they can again blame the users for not respecting their policies,&#8221; Palant said. &#8220;But I just logged in with my weak password, and I am not forced to change it. Sending emails is cheap, but they once again didn’t implement any technical measures to enforce this policy change.&#8221;</p>
<p>Either way, Palant said, the changes won&#8217;t help people affected by the 2022 breach.</p>
<p><span class="pullquote pqright">&#8220;These people need to change all their passwords, something that LastPass still won’t recommend,&#8221; Palant said. &#8220;But it will somewhat help with the breaches to come.&#8221;</span></p>
<p><strong>LastPass CEO Karim Toubba</strong> said changing master password length (or even the master password itself) is not designed to address already stolen vaults that are offline.</p>
<p>&#8220;This is meant to better protect customers’ online vaults and encourage them to bring their accounts up to the 2018 LastPass standard default setting of a 12-character minimum (but could opt out from),&#8221; Toubba said in an emailed statement. &#8220;We know that some customers may have chosen convenience over security and utilized less complex master passwords despite encouragement to use our (or others) password generator to do otherwise.&#8221;<span id="more-64995"></span></p>
<p>A basic functionality of LastPass is that it will pick and remember lengthy, complex passwords for each of your websites or online services. To automatically populate the appropriate credentials at any website going forward, you simply authenticate to LastPass using your master password.</p>
<p>LastPass has always emphasized that if you lose this master password, that’s too bad because they don’t store it and their encryption is so strong that even they can’t help you recover it.</p>
<p>But experts say all bets are off when cybercrooks can get their hands on the encrypted vault data itself — as opposed to having to interact with LastPass via its website. These so-called “offline” attacks allow the bad guys to conduct unlimited and unfettered “brute force” password cracking attempts against the encrypted data using powerful computers that can each try millions of password guesses per second.</p>
<p>A chart on <a href="https://palant.info/2022/12/28/lastpass-breach-the-significance-of-these-password-iterations/" target="_blank" rel="noopener">Palant’s blog post</a> offers an idea of how increasing password iterations dramatically increases the costs and time needed by the attackers to crack someone’s master password. Palant said it would take a single high-powered graphics card about a year to crack a password of average complexity with 500 iterations, and about 10 years to crack the same password run through 5,000 iterations.</p>
<div id="attachment_64836" style="width: 860px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-64836" decoding="async" loading="lazy" class="size-full wp-image-64836" src="media/951124ac.gpuguesstime.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/gpuguesstime.png" alt="" width="850" height="247" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/gpuguesstime.png 850w, https://krebsonsecurity.com/wp-content/uploads/2023/09/gpuguesstime-768x223.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/gpuguesstime-782x227.png 782w" sizes="(max-width: 850px) 100vw, 850px" /><p id="caption-attachment-64836" class="wp-caption-text">Image: palant.info</p></div>
<p>However, these numbers radically come down when a determined adversary also has other large-scale computational assets at their disposal, such as a bitcoin mining operation that can coordinate the password-cracking activity across multiple powerful systems simultaneously.</p>
<p>Meaning, LastPass users whose vaults were never upgraded to higher iterations and whose master passwords were weak (less than 12 characters) likely have been a primary target of distributed password-cracking attacks ever since the LastPass user vaults were stolen late last year.</p>
<p>Asked why some LastPass users were left behind on older security minimums, Toubba said a &#8220;small percentage&#8221; of customers had corrupted items in their password vaults that prevented those accounts from properly upgrading to the new requirements and settings.</p>
<p>&#8220;We have been able to determine that a small percentage of customers have items in their vaults that are corrupt and when we previously utilized automated scripts designed to re-encrypt vaults when the master password or iteration count is changed, they did not complete,&#8221; Toubba said. &#8220;These errors were not originally apparent as part of these efforts and, as we have discovered them, we have been working to be able to remedy this and finish the re-encryption.&#8221;</p>
<p><strong>Nicholas Weaver</strong>, a researcher at University of California, Berkeley’s <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a> (ICSI) and lecturer at UC Davis, said LastPass made a huge mistake years ago by not force-upgrading the iteration count for existing users.</p>
<p>&#8220;And now this is blaming the users &#8212; &#8216;you should have used a longer passphrase&#8217; &#8212; not them for having weak defaults that were never upgraded for existing users,&#8221; Weaver said. &#8220;LastPass in my book is one step above snake-oil. I used to be, &#8216;Pick whichever password manager you want,&#8217; but now I am very much, &#8216;Pick any password manager but LastPass.'&#8221;</p>
<p>Asked why LastPass isn&#8217;t recommending that users change all of the passwords secured by the encrypted master password that was stolen when the company got hacked last year, Toubba said it&#8217;s because &#8220;the data demonstrates that the majority of our customers follow our recommendations (or greater), and the probability of successfully brute forcing vault encryption is greatly reduced accordingly.&#8221;</p>
<p>&#8220;We’ve been telling customers since December of 2022 that they should be following recommended guidelines,&#8221; Toubba continued. &#8220;And if they haven’t followed the guidelines we recommended that they change their downstream passwords.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=65047
title: ‘Snatch’ Ransom Group Exposes Visitor IP Addresses
uri: Snatch-Ransom-Group-Exposes-Visitor-IP-Addresses
url: https://krebsonsecurity.com/2023/09/snatch-ransom-group-exposes-visitor-ip-addresses/
content:
<p>The victim shaming site operated by the <strong>Snatch</strong> ransomware group is leaking data about its true online location and internal operations, as well as the Internet addresses of its visitors, KrebsOnSecurity has found. The leaked data suggest that Snatch is one of several ransomware groups using paid ads on Google.com to trick people into installing malware disguised as popular free software, such as <strong>Microsoft Teams</strong>, <strong>Adobe Reader</strong>, <strong>Mozilla Thunderbird</strong>, and <strong>Discord</strong>.</p>
<p>First spotted <a href="https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-263a" target="_blank" rel="noopener">in 2018</a>, the Snatch ransomware group has published data stolen from hundreds of organizations that refused to pay a ransom demand. Snatch publishes its stolen data at a website on the open Internet, and that content is mirrored on the Snatch team&#8217;s darknet site, which is only reachable using the global anonymity network <a href="https://torproject.org/" target="_blank" rel="noopener">Tor</a>.</p>
<div id="attachment_65105" style="width: 760px" class="wp-caption aligncenter"><a href="media/650e7238.snatchhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchhome.png"><img aria-describedby="caption-attachment-65105" decoding="async" class="wp-image-65105" src="media/650e7238.snatchhome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchhome.png" alt="" width="750" height="382" /></a><p id="caption-attachment-65105" class="wp-caption-text">The victim shaming website for the Snatch ransomware gang.</p></div>
<p>KrebsOnSecurity has learned that Snatch&#8217;s darknet site exposes its &#8220;server status&#8221; page, which includes information about the true Internet addresses of users accessing the website.</p>
<p>Refreshing this page every few seconds shows that the Snatch darknet site generates a decent amount of traffic, often attracting thousands of visitors each day. But by far the most frequent repeat visitors are coming from Internet addresses in Russia that either currently host Snatch&#8217;s clear web domain names or recently did.</p>
<div id="attachment_65061" style="width: 768px" class="wp-caption aligncenter"><a href="media/0b192e39.snatchstatus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchstatus.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-65061" decoding="async" loading="lazy" class="wp-image-65061" src="media/0b192e39.snatchstatus.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchstatus.png" alt="" width="758" height="472" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchstatus.png 2380w, https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchstatus-768x478.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchstatus-1536x956.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchstatus-2048x1275.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2023/09/snatchstatus-782x487.png 782w" sizes="(max-width: 758px) 100vw, 758px" /></a><p id="caption-attachment-65061" class="wp-caption-text">The Snatch ransomware gang&#8217;s victim shaming site on the darknet is leaking data about its visitors. This &#8220;server status&#8221; page says that Snatch&#8217;s website is on Central European Summer Time (CEST) and is powered by OpenSSL/1.1.1f, which is no longer supported by security updates.</p></div>
<p>Probably the most active Internet address accessing Snatch&#8217;s darknet site is <strong>193.108.114[.]41</strong>, which is a server in Yekaterinburg, Russia that hosts several Snatch domains, including <strong>snatchteam[.]top</strong>, <strong>sntech2ch[.]top</strong>, <strong>dwhyj2[.]top</strong> and <strong>sn76930193ch[.]top</strong>. It could well be that this Internet address is showing up frequently because Snatch&#8217;s clear-web site features a toggle button at the top that lets visitors switch over to accessing the site via Tor.</p>
<p>Another Internet address that showed up frequently in the Snatch server status page was <strong>194.168.175[.]226</strong>, currently assigned to <strong>Matrix Telekom</strong> in Russia. According to <strong>DomainTools.com</strong>, this address also hosts or else recently hosted the usual coterie of Snatch domains, as well as quite a few domains phishing known brands such as <strong>Amazon</strong> and <strong>Cashapp</strong>.</p>
<p>The Moscow Internet address <strong>80.66.64[.]15</strong> accessed the Snatch darknet site all day long, and that address also housed the appropriate Snatch clear-web domains. More interestingly, that address is home to multiple recent domains that appear confusingly similar to known software companies, including <strong>libreoff1ce[.]com</strong> and <strong>www-discord[.]com</strong>.</p>
<p>This is interesting because the phishing domains associated with the Snatch ransomware gang were all registered to the same Russian name &#8212; <strong>Mihail Kolesnikov</strong>, a name that is somewhat synonymous with recent phishing domains tied to malicious Google ads.</p>
<p>Kolesnikov could be a nod to <a href="https://en.wikipedia.org/wiki/Mikhail_Kolesnikov_(politician)" target="_blank" rel="noopener">a Russian general</a> made famous during Boris Yeltsin&#8217;s reign. Either way, it&#8217;s clearly a pseudonym, but there are some other commonalities among these domains that may provide insight into how Snatch and other ransomware groups are sourcing their victims.</p>
<p>DomainTools says there are more than 1,300 current and former domain names registered to Mihail Kolesnikov between 2013 and July 2023. About half of the domains appear to be older websites advertising female escort services in major cities around the United States (e.g. the <a href="https://web.archive.org/web/20140206140056/http://pittsburghcitygirls.com/" target="_blank" rel="noopener">now-defunct</a> pittsburghcitygirls[.]com).</p>
<p>The other half of the Kolesnikov websites are far more recent phishing domains mostly ending in &#8220;.top&#8221; and &#8220;.app&#8221; that appear designed to mimic the domains of major software companies, including <strong>www-citrix[.]top</strong>, <strong>www-microsofteams[.]top</strong>, <strong>www-fortinet[.]top</strong>, <strong>ibreoffice[.]top</strong>, <strong>www-docker[.]top</strong>, <strong>www-basecamp[.]top</strong>, <strong>ccleaner-cdn[.]top</strong>, <strong>adobeusa[.]top</strong>, and <strong>www.real-vnc[.]top</strong>.</p>
<p>In August 2023, researchers with <strong>Trustwave Spiderlabs</strong> <a href="https://www.trustwave.com/en-us/resources/blogs/spiderlabs-blog/new-rilide-stealer-version-targets-banking-data-and-works-around-google-chrome-manifest-v3/" target="_blank" rel="noopener">said</a> they encountered domains registered to Mihail Kolesnikov being used to disseminate the <a href="https://www.bleepingcomputer.com/news/security/hackers-use-rilide-browser-extension-to-bypass-2fa-steal-crypto/" target="_blank" rel="noopener"><strong>Rilide</strong> information stealer trojan</a>.</p>
<p>But it appears multiple crime groups may be using these domains to phish people and disseminate all kinds of information-stealing malware. In February 2023, <strong>Spamhaus</strong> <a href="https://www.spamhaus.com/resource-center/a-surge-of-malvertising-across-google-ads-is-distributing-dangerous-malware/">warned</a> of a huge surge in malicious ads that were hijacking search results in <strong>Google.com</strong>, and being used to distribute at least five different families of information stealing trojans, including <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.aurora_stealer" target="_blank" rel="noopener">AuroraStealer</a>, <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.icedid" target="_blank" rel="noopener">IcedID/Bokbot</a>, <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.metastealer" target="_blank" rel="noopener">Meta Stealer</a>, <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer" target="_blank" rel="noopener">RedLine Stealer</a> and <a href="https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar" target="_blank" rel="noopener">Vidar</a>.<span id="more-65047"></span></p>
<p>For example, Spamhaus said victims of these malicious ads would search for <strong>Microsoft Teams</strong> in Google.com, and the search engine would often return a paid ad spoofing Microsoft or Microsoft Teams as the first result &#8212; above all other results. The malicious ad would include a logo for Microsoft and at first glance appear to be a safe and trusted place to download the Microsoft Teams client.</p>
<p>However, anyone who clicked on the result was whisked away instead to <a href="https://twitter.com/abuse_ch/status/1620850766247518208?s=20&amp;t=xcMJEsSK5ETZQ0-Bk3h9VA" target="_blank" rel="noopener"><strong>mlcrosofteams-us[.]top</strong></a> &#8212; yet another malicious domain registered to Mr. Kolesnikov. And while visitors to this website may believe they are only downloading the Microsoft Teams client, the installer file includes a copy of the IcedID malware, which is really good at stealing passwords and authentication tokens from the victim&#8217;s web browser.</p>
<div id="attachment_65063" style="width: 766px" class="wp-caption aligncenter"><a href="media/0886ba90.sh-icedid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/sh-icedid.png"><img aria-describedby="caption-attachment-65063" decoding="async" loading="lazy" class="wp-image-65063" src="media/0886ba90.sh-icedid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/sh-icedid.png" alt="" width="756" height="189" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/sh-icedid.png 1457w, https://krebsonsecurity.com/wp-content/uploads/2023/09/sh-icedid-768x192.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/09/sh-icedid-782x195.png 782w" sizes="(max-width: 756px) 100vw, 756px" /></a><p id="caption-attachment-65063" class="wp-caption-text">Image: Spamhaus</p></div>
<p>The founder of the Swiss anti-abuse website <a href="https://www.abuse.ch" target="_blank" rel="noopener">abuse.ch</a> told Spamhaus it is likely that some cybercriminals have started to sell &#8220;malvertising as a service&#8221; on the dark web, and that there is a great deal of demand for this service.</p>
<p>In other words, someone appears to have built a very profitable business churning out and promoting new software-themed phishing domains and selling that as a service to other cybercriminals. Or perhaps they are simply selling any stolen data (and any corporate access) to active and hungry ransomware group affiliates.</p>
<p>The tip about the exposed &#8220;server status&#8221; page on the Snatch darkweb site came from <a href="https://www.twitter.com/htmalgae" target="_blank" rel="noopener">@htmalgae</a>, the same security researcher who alerted KrebsOnSecurity earlier this month that the darknet victim shaming site run by the <strong>8Base</strong> ransomware gang <a href="https://krebsonsecurity.com/2023/09/whos-behind-the-8base-ransomware-website/" target="_blank" rel="noopener">was inadvertently left in development mode</a>.</p>
<p>That oversight revealed not only the true Internet address of the hidden 8Base site (in Russia, naturally), but also the identity of a programmer in Moldova who apparently helped to develop the 8Base code.</p>
<p>@htmalgae said the idea of a ransomware group&#8217;s victim shaming site leaking data that they did not intend to expose is deliciously ironic.</p>
<p>&#8220;This is a criminal group that shames others for not protecting user data,&#8221; @htmalgae said. &#8220;And here they are leaking their user data.&#8221;</p>
<p>All of the malware mentioned in this story is designed to run on Microsoft Windows devices. But Malwarebytes <a href="https://www.malwarebytes.com/blog/threat-intelligence/2023/09/atomic-macos-stealer-delivered-via-malvertising" target="_blank" rel="noopener">recently covered</a> the emergence of a Mac-based information stealer trojan called <strong>AtomicStealer</strong> that was being advertised through malicious Google ads and domains that were confusingly similar to software brands.</p>
<p>Please be extra careful when you are searching online for popular software titles. Cracked, pirated copies of major software titles are a frequent source of infostealer infections, as are these rogue ads masquerading as search results. Make sure to double-check you are actually at the domain you believe you&#8217;re visiting *before* you download and install anything.</p>
<p>Stay tuned for Part II of this post, which includes a closer look at the Snatch ransomware group and their founder.</p>
<p>Further reading:</p>
<p><a href="https://raw.githubusercontent.com/htmalgae/research/main/snatch-origin-access-log-ips.txt" target="_blank" rel="noopener">@HTMalgae&#8217;s list of the top Internet addresses seen accessing Snatch&#8217;s darknet site</a></p>
<p><a href="https://arstechnica.com/information-technology/2023/02/until-further-notice-think-twice-before-using-google-to-download-software/" target="_blank" rel="noopener">Ars Technica: Until Further Notice Think Twice Before Using Google to Download Software</a></p>
<p><a href="https://www.bleepingcomputer.com/news/security/hackers-abuse-google-ads-to-spread-malware-in-legit-software/" target="_blank" rel="noopener">Bleeping Computer: Hackers Abuse Google Ads to Spread Malware in Legit Software</a></p>


feed_id: https://krebsonsecurity.com/?p=65054
title: A Closer Look at the Snatch Data Ransom Group
uri: A-Closer-Look-at-the-Snatch-Data-Ransom-Group
url: https://krebsonsecurity.com/2023/09/a-closer-look-at-the-snatch-data-ransom-group/
content:
<p>Earlier this week, KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/09/snatch-ransom-group-exposes-visitor-ip-addresses/" target="_blank" rel="noopener">revealed</a> that the darknet website for the <strong>Snatch</strong> ransomware group was leaking data about its users and the crime gang&#8217;s internal operations. Today, we&#8217;ll take a closer look at the history of Snatch, its alleged founder, and their claims that everyone has confused them with a different, older ransomware group by the same name.</p>
<p><img decoding="async" class="aligncenter wp-image-65173" src="media/86cd26f8.cisa-fbi-snatch.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/09/cisa-fbi-snatch.png" alt="" width="750" height="557" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/09/cisa-fbi-snatch.png 780w, https://krebsonsecurity.com/wp-content/uploads/2023/09/cisa-fbi-snatch-768x570.png 768w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>According to a September 20, 2023 joint advisory from the <strong>FBI</strong> and the <strong>U.S. Cybersecurity and Infrastructure Security Administratio</strong>n (CISA), Snatch was originally named <strong>Team Truniger</strong>, based on the nickname of the group&#8217;s founder and organizer &#8212; Truniger.</p>
<p>The FBI/CISA report says Truniger previously operated as an affiliate of <a href="https://krebsonsecurity.com/?s=gandcrab" target="_blank" rel="noopener">GandCrab</a>, an early ransomware-as-a-service offering that closed up shop after several years and <a href="https://krebsonsecurity.com/2019/07/is-revil-the-new-gandcrab-ransomware/" target="_blank" rel="noopener">claims to have extorted more than $2 billion from victims</a>. GandCrab dissolved in July 2019, and is thought to have become &#8220;<a href="https://krebsonsecurity.com/?s=revil" target="_blank" rel="noopener">REvil</a>,&#8221; one of the most ruthless and rapacious Russian ransomware groups of all time.</p>
<p>The government says Snatch used a customized ransomware variant notable for rebooting <strong>Microsoft Windows</strong> devices into Safe Mode &#8212; enabling the ransomware to circumvent detection by antivirus or endpoint protection &#8212; and then encrypting files when few services are running.</p>
<p>&#8220;Snatch threat actors have been observed purchasing previously stolen data from other ransomware variants in an attempt to further exploit victims into paying a ransom to avoid having their data released on Snatch’s extortion blog,&#8221; the FBI/CISA alert reads. It continues:</p>
<blockquote><p>&#8220;Prior to deploying the ransomware, Snatch threat actors were observed spending up to three months on a victim’s system. Within this timeframe, Snatch threat actors exploited the victim’s network moving laterally across the victim’s network with RDP for the largest possible deployment of ransomware and searching for files and folders for data exfiltration followed by file encryption.&#8221;</p></blockquote>
<p>New York City-based cyber intelligence firm <strong>Flashpoint </strong>said the Snatch ransomware group was created in 2018, based on Truniger&#8217;s recruitment both on Russian language cybercrime forums and public Russian programming boards. Flashpoint said Truniger recruited &#8220;pen testers&#8221; for a new, then-unnamed cybercrime group, by posting their private Jabber instant messenger contact details on multiple Russian language coding forums, as well as on Facebook.</p>
<p>&#8220;The command requires Windows system administrators,&#8221; Truniger&#8217;s ads explained. &#8220;Experience in backup, increase privileges, mikicatz, network. Details after contacting on jabber: truniger@xmpp[.]jp.&#8221;</p>
<p>In at least some of those recruitment ads &#8212; like one in 2018 on the forum <strong>sysadmins[.]ru</strong> &#8211;the username promoting Truniger&#8217;s contact information was <strong>Semen7907</strong>. In April 2020, Truniger was banned from two of the top Russian cybercrime forums, where members from both forums confirmed that Semen7907 was one of Truniger&#8217;s known aliases.</p>
<p>[SIDE NOTE: Truniger was banned because he purchased credentials to a company from <a href="https://krebsonsecurity.com/?s=network+access+broker" target="_blank" rel="noopener">a network access broker</a> on the dark web, and although he promised to share a certain percentage of whatever ransom amount Truniger&#8217;s group extracted from the victim, Truniger paid the access broker just a few hundred dollars off of a six-figure ransom].<span id="more-65054"></span></p>
<p>According to <strong>Constella Intelligence</strong>, a data breach and threat actor research platform, a user named Semen7907 registered in 2017 on the Russian-language programming forum <strong>pawno[.]ru</strong> using the email address <strong>tretyakov-files@yandex.ru</strong>.</p>
<p>That same email address was assigned to the user &#8220;Semen-7907&#8221; on the now defunct gaming website <strong>tunngle.net</strong>, which suffered a data breach in 2020. Semen-7907 registered at Tunngle from the Internet address <strong>31.192.175[.]63</strong>, which is in <a href="https://en.wikipedia.org/wiki/Yekaterinburg" target="_blank" rel="noopener">Yekaterinburg, RU</a>.</p>
<p>Constella reports that tretyakov-files@yandex.ru was also used to register an account at the online game stalker[.]so with the nickname <strong>Trojan7907</strong>.</p>
<p>There is a <strong>Skype</strong> user by the handle semen7907, and which has the name <strong>Semyon Tretyakov</strong> from Yekaterinburg, RU. Constella also found a breached record from the Russian mobile telephony site <strong>tele2[.]ru, </strong>which shows that a user from Yekaterinburg registered in 2019 with the name <strong>Semyon Sergeyvich Tretyakov</strong> and email address <strong>tretyakov-files@ya.ru</strong>.</p>
<p>The above accounts, as well as the email address <strong>semen_7907@mail.ru</strong>, were all registered or accessed from the same Yekaterinburg Internet address mentioned previously: 31.192.175.63. The Russian mobile phone number associated with that tele2[.]ru account is connected to the Telegram account &#8220;<strong>Perchatka</strong>,&#8221; (&#8220;glove&#8221; in Russian).</p>
<h2>BAD BEATS</h2>
<p>Reached via Telegram, Perchatka (a.k.a. Mr. Tretyakov) said he was not a cybercriminal, and that he currently has a full-time job working in IT at a major company (he declined to specify which).</p>
<p>Presented with the information gathered for this report (and more that is not published here), Mr. Tretyakov acknowledged that Semen7907 was his account on sysadmins[.]ru, the very same account Truniger used to recruit hackers for the Snatch Ransomware group back in 2018.</p>
<p>However, he claims that he never made those posts, and that someone else must have assumed control over his sysadmins[.]ru account and posted as him. Mr. Tretyakov said that KrebsOnSecurity&#8217;s outreach this week was the first time he became aware that his sysadmins[.]ru account was used without his permission.</p>
<p>Mr. Tretyakov suggested someone may have framed him, pointing to <a href="https://web-archive-org.translate.goog/web/20230929145624/https://cisoclub.ru/hakery-soobshhili-o-vzlome-i-utechke-dannyh-s-sajta-sysadmins-ru/?_x_tr_sl=ru&amp;_x_tr_tl=en&amp;_x_tr_hl=en&amp;_x_tr_pto=wapp" target="_blank" rel="noopener">an August 2023 story</a> at a Russian news outlet about the reported hack and leak of the user database from sysadmins[.]ru, allegedly at the hands of a pro-Ukrainian hacker group called CyberSec.</p>
<p>&#8220;Recently, because of the war in Ukraine, a huge number of databases have been leaked and finding information about a person is not difficult,&#8221; Tretyakov said. &#8220;I&#8217;ve been using this login since about 2013 on all the forums where I register, and I don&#8217;t always set a strong password. If I had done something illegal, I would have hidden much better :D.&#8221;</p>
<p>[For the record, KrebsOnSecurity does not generally find this to be the case, as the ongoing <a href="https://krebsonsecurity.com/category/breadcrumbs/" target="_blank" rel="noopener">Breadcrumbs series</a> will attest.]</p>
<p>A Semyon Sergeyvich Tretyakov is listed as the composer of a Russian-language rap song called &#8220;<a href="https://www.youtube.com/watch?v=ihfDI-WbPrU" target="_blank" rel="noopener">Parallels</a>,&#8221; which seems to be about the pursuit of a high-risk lifestyle online. A snippet of the song goes:</p>
<blockquote><p>&#8220;Someone is on the screen, someone is on the blacklist<br />
I turn on the timer and calculate the risks<br />
I don’t want to stay broke And in the pursuit of money<br />
I can’t take these zeros Life is like a zebra &#8211;<br />
everyone wants to be first Either the stripes are white,<br />
or we’re moving through the wilds I won’t waste time.&#8221;</p></blockquote>
<p>Mr. Tretyakov said he was not the author of that particular rhyme, but that he has been known to record his own rhythms.</p>
<p>&#8220;Sometimes I make bad beats,&#8221; he said. &#8220;Soundcloud.&#8221;</p>
<h2>NEVER MIND THE DOMAIN NAME</h2>
<p>The <a href="media/907e427f.nt-cybersecurity-advisory-stopransomware-snatch-ransomware_0.pdf" data-original-source="https://www.cisa.gov/sites/default/files/2023-09/joint-cybersecurity-advisory-stopransomware-snatch-ransomware_0.pdf" target="_blank" rel="noopener">FBI/CISA alert on Snatch Ransomware</a> (PDF) includes an interesting caveat: It says Snatch actually deploys ransomware on victim systems, but it also acknowledges that the current occupants of Snatch&#8217;s dark and clear web domains call themselves Snatch Team, and maintain that they are not the same people as Snatch Ransomware from 2018.</p>
<p>Here&#8217;s the interesting bit from the FBI/CISA report:</p>
<blockquote><p>&#8220;Since November 2021, an extortion site operating under the name Snatch served as a clearinghouse for data exfiltrated or stolen from victim companies on Clearnet and TOR hosted by a bulletproof hosting service. In August 2023, individuals claiming to be associated with the blog gave a media interview claiming the blog was not associated with Snatch ransomware and “none of our targets has been attacked by Ransomware Snatch…”, despite multiple confirmed Snatch victims’ data appearing on the blog alongside victims associated with other ransomware groups, notably Nokoyawa and Conti.&#8221;</p></blockquote>
<p>Avid readers will recall a story here earlier this week about Snatch Team&#8217;s <a href="https://krebsonsecurity.com/2023/09/snatch-ransom-group-exposes-visitor-ip-addresses/" target="_blank" rel="noopener">leaky darknet website</a> based in Yekaterinburg, RU that exposed their internal operations and Internet addresses of their visitors. The leaked data suggest that Snatch is one of several ransomware groups using paid ads on Google.com to trick people into installing malware disguised as popular free software, such as <strong>Microsoft Teams</strong>, <strong>Adobe Reader</strong>, <strong>Mozilla Thunderbird</strong>, and <strong>Discord</strong>.</p>
<p>Snatch Team claims to deal only in stolen data &#8212; not in deploying ransomware malware to hold systems hostage.</p>
<p>Representatives of the Snatch Team recently answered questions from <strong>Databreaches.net</strong> about the claimed discrepancy in the FBI/CISA report.</p>
<p>&#8220;First of all, we repeat once again that we have nothing to do with Snatch Ransomware, we are Security Notification Attachment, and we have never violated the terms of the concluded transactions, because our honesty and openness is the guarantee of our income,&#8221; the Snatch Team wrote to Databreaches.net in response to questions.</p>
<p>But so far the Snatch Team has not been able to explain <em>why it is using the very same domain names that the Snatch ransomware group used?</em></p>
<p>Their claim is even more unbelievable because the Snatch Team members told Databreaches.net they didn&#8217;t even know that a ransomware group with that name already existed when they initially formed just two years ago.</p>
<p>This is difficult to swallow because even if they were a separate group, they&#8217;d still need to somehow coordinate the transfer of the Ransomware group&#8217;s domains on the clear and dark webs. If they were hoping for a fresh start or separation, why not just pick a new name and new web destination?</p>
<p>&#8220;Snatchteam[.]cc is essentially a data market,&#8221; they continued. &#8220;The only thing to underline is that we are against selling leaked information, sticking to the idea of free access. Absolutely any team can come to us and offer information for publication. Even more, we have heard rumors that a number of ransomware teams scare their clients that they will post leaked information on our resource. We do not have our own ransomware, but we are open to cooperation on placement and monetization of dates (sic).&#8221;</p>
<p>Maybe Snatch Team does not wish to be associated with Snatch Ransomware because they currently believe stealing data and then extorting victim companies for money is somehow less evil than infecting all of the victim&#8217;s servers and backups with ransomware.</p>
<p>It is also likely that Snatch Team is well aware of how poorly some of their founders covered their tracks online, and are hoping for a do-over on that front.</p>


feed_id: https://krebsonsecurity.com/?p=64991
title: Don’t Let Zombie Zoom Links Drag You Down
uri: Don-t-Let-Zombie-Zoom-Links-Drag-You-Down
url: https://krebsonsecurity.com/2023/10/dont-let-zombie-zoom-links-drag-you-down/
content:
<p>Many organizations &#8212; including quite a few Fortune 500 firms &#8212; have exposed web links that allow anyone to initiate a <strong>Zoom</strong> video conference meeting as a valid employee. These company-specific Zoom links, which include a permanent user ID number and an embedded passcode, can work indefinitely and expose an organization&#8217;s employees, customers or partners to phishing and other social engineering attacks.</p>
<div id="attachment_65218" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65218" decoding="async" class=" wp-image-65218" src="media/00f6858d.workzombie.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/workzombie.png" alt="" width="750" height="477" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/10/workzombie.png 783w, https://krebsonsecurity.com/wp-content/uploads/2023/10/workzombie-768x488.png 768w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-65218" class="wp-caption-text">Image: @Pressmaster on Shutterstock.</p></div>
<p>At issue is the <strong>Zoom Personal Meeting ID</strong> (PMI), which is a permanent identification number linked to your Zoom account and serves as your personal meeting room available around the clock. The PMI portion forms part of each new meeting URL created by that account, such as:</p>
<blockquote><p>zoom.us/j/5551112222</p></blockquote>
<p>Zoom has an option to include an encrypted passcode within a meeting invite link, which simplifies the process for attendees by eliminating the need to manually enter the passcode. Following the previous example, such a link might look something like this:</p>
<blockquote><p>zoom.us/j/5551112222/pwd=jdjsklskldklsdksdklsdkll</p></blockquote>
<p>Using your PMI to set up new meetings is convenient, but of course convenience often comes at the expense of security. Because the PMI remains the same for all meetings, anyone with your PMI link can join any ongoing meeting unless you have locked the meeting or activated Zoom&#8217;s Waiting Room feature.</p>
<p>Including an encrypted passcode in the Zoom link definitely makes it easier for attendees to join, but it might open your meetings to unwanted intruders if not handled responsibly. Particularly if that Zoom link is somehow indexed by Google or some other search engine, which happens to be the case for thousands of organizations.</p>
<p>Armed with one of these links, an attacker can create meetings and invite others using the identity of the authorized employee. And many companies using Zoom have made it easy to find recently created meeting links that include encrypted passcodes, because they have dedicated subdomains at Zoom.us.</p>
<p>Using the same method, KrebsOnSecurity also found working Zoom meeting links for <strong>The National Football League</strong> (NFL), <strong>LinkedIn</strong>, <strong>Oracle</strong>, <strong>Humana</strong>, <strong>Disney</strong>, <strong>Warner Bros</strong>, and <strong>Uber</strong>. And that was from just a few minutes of searching. And to illustrate the persistence of some of these Zoom links, Archive.org says several of the links were first created as far back as 2020 and 2021.</p>
<p>KrebsOnSecurity received a tip about the Zoom exposures from <a href="https://www.linkedin.com/in/charan-akiri-86385473/" target="_blank" rel="noopener">Charan Akiri</a>, a researcher and security engineer at Reddit. In April 2023, this site featured research by Akiri showing that <a href="https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/" target="_blank" rel="noopener">many public Salesforce websites were leaking private data</a>, including banks and healthcare organizations (Akiri said Salesforce also had these open Zoom meeting links before he notified them).<span id="more-64991"></span></p>
<div id="attachment_65225" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65225" decoding="async" loading="lazy" class=" wp-image-65225" src="media/d2b9b3bd.zooomprefs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/zooomprefs.png" alt="" width="750" height="510" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/10/zooomprefs.png 1036w, https://krebsonsecurity.com/wp-content/uploads/2023/10/zooomprefs-768x522.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/10/zooomprefs-782x531.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-65225" class="wp-caption-text">The Zoom links that exposed working meeting rooms all had enabled the highlighted option.</p></div>
<p>Akiri said the misuse of PMI links, particularly those with passcodes embedded, can give unauthorized individuals access to meetings.</p>
<p>&#8220;These one-click links, which are not subject to expiration or password requirement, can be exploited by attackers for impersonation,&#8221; Akiri said. &#8220;Attackers exploiting these vulnerabilities can impersonate companies, initiating meetings unknowingly to users. They can contact other employees or customers while posing as the company, gaining unauthorized access to confidential information, potentially for financial gain, recruitment, or fraudulent advertising campaigns.&#8221;</p>
<p>Akiri said he built a simple program to crawl the web for working Zoom meeting links from different organizations, and so far it has identified thousands of organizations with these perfectly functional zombie Zoom links.</p>
<p>According to Akiri, here are several tips for using Zoom links more safely:</p>
<p><strong>Don’t Use Personal Meeting ID for Public Meetings:</strong> Your Personal Meeting ID (PMI) is the default meeting that launches when you start an ad hoc meeting. Your PMI doesn’t change unless you change it yourself, which makes it very useful if people need a way to reach you. But for public meetings, you should always schedule new meetings with randomly generated meeting IDs. That way, only invited attendees will know how to join your meeting. You can also turn off your PMI when starting an instant meeting in your profile settings.</p>
<p><strong>Require a Passcode to Join: </strong>You can take meeting security even further by requiring a passcode to join your meetings. This feature can be applied to both your Personal Meeting ID, so only those with the passcode will be able to reach you, and to newly scheduled meetings. To learn all the ways to add a passcode for your meetings, see <a href="https://support.zoom.us/hc/en-us/articles/360033559832-Meeting-and-Webinar-Passwords-" target="_blank" rel="noopener">this support article</a>.</p>
<p><strong>Only Allow Registered or Domain Verified Users: </strong>Zoom can also give you peace of mind by letting you know exactly who will be attending your meeting. When scheduling a meeting, you can <a href="https://support.zoom.us/hc/en-us/articles/360033559832-Meeting-and-Webinar-Passwords-" target="_blank" rel="noopener">require attendees to register</a> with their email, name, and custom questions. You can even customize your registration page with a banner and logo. By default, Zoom also restricts participants to those who are logged into Zoom, and you can even restrict it to Zoom users whose email address uses a certain domain.</p>
<p>Further reading: <a href="https://blog.zoom.us/keep-uninvited-guests-out-of-your-zoom-meeting/" target="_blank" rel="noopener">How to Keep Uninvited Guests Out of Your Zoom Meeting</a></p>
<p><strong>Update 12:33 p.m.:</strong> The list of affected organizations was updated, because several companies listed apparently only exposed links that let anyone connect to existing, always-on meeting rooms &#8212; not initiate and completely control a Zoom meeting. The real danger with the zombie links described above is that anyone can find and use them to create new meetings and invite others.</p>


feed_id: https://krebsonsecurity.com/?p=65255
title: Phishers Spoof USPS, 12 Other Natl’ Postal Services
uri: Phishers-Spoof-USPS-12-Other-Natl-Postal-Services
url: https://krebsonsecurity.com/2023/10/phishers-spoof-usps-12-other-natl-postal-services/
content:
<div id="attachment_65265" style="width: 234px" class="wp-caption alignright"><img aria-describedby="caption-attachment-65265" decoding="async" class="wp-image-65265" src="media/f677d73d.uspsphish-sms.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/uspsphish-sms.png" alt="" width="224" height="334" /><p id="caption-attachment-65265" class="wp-caption-text">The fake USPS phishing page.</p></div>
<p>Recent weeks have seen a sizable uptick in the number of phishing scams targeting <strong>U.S. Postal Service</strong> (USPS) customers. Here&#8217;s a look at an extensive SMS phishing operation that tries to steal personal and financial data by spoofing the USPS, as well as postal services in at least a dozen other countries.</p>
<p>KrebsOnSecurity recently heard from a reader who received an SMS purporting to have been sent by the USPS, saying there was a problem with a package destined for the reader&#8217;s address. Clicking the link in the text message brings one to the domain <strong>usps.informedtrck[.]com</strong>.</p>
<p>The landing page generated by the phishing link includes the USPS logo, and says &#8220;Your package is on hold for an invalid recipient address. Fill in the correct address info by the link.&#8221; Below that message is a &#8220;Click update&#8221; button that takes the visitor to a page that asks for more information.</p>
<p>The remaining buttons on the phishing page all link to the real USPS.com website. After collecting your address information, the fake USPS site goes on to request additional personal and financial data.</p>
<p>This phishing domain was recently registered and its WHOIS ownership records are basically nonexistent. However, we can find some compelling clues about the extent of this operation by loading the phishing page in Developer Tools, a set of debugging features built into Firefox, Chrome and Safari that allow one to closely inspect a webpage&#8217;s code and operations.</p>
<p>Check out the bottom portion of the screenshot below, and you&#8217;ll notice that this phishing site fails to load some external resources, including an image from a link called <strong>fly.linkcdn[.]to</strong>.</p>
<div id="attachment_65257" style="width: 760px" class="wp-caption aligncenter"><a href="media/dca870c7.linkcdn-to.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/linkcdn-to.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-65257" decoding="async" loading="lazy" class="wp-image-65257" src="media/dca870c7.linkcdn-to.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/linkcdn-to.png" alt="" width="750" height="231" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/10/linkcdn-to.png 1474w, https://krebsonsecurity.com/wp-content/uploads/2023/10/linkcdn-to-768x237.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/10/linkcdn-to-782x241.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-65257" class="wp-caption-text">Click the image to enlarge.</p></div>
<p>A search on this domain at the always-useful <a href="https://URLscan.io" target="_blank" rel="noopener">URLscan.io</a> shows that <strong>fly.linkcdn[.]to</strong> is <a href="https://urlscan.io/search/#fly.linkcdn.to" target="_blank" rel="noopener">tied to a slew of USPS-themed phishing domains</a>. Here are just a few of those domains (links defanged to prevent accidental clicking):</p>
<p>usps.receivepost[.]com<br />
usps.informedtrck[.]com<br />
usps.trckspost[.]com<br />
postreceive[.]com<br />
usps.trckpackages[.]com<br />
usps.infortrck[.]com<br />
usps.quicktpos[.]com<br />
usps.postreceive].]com<br />
usps.revepost[.]com<br />
trackingusps.infortrck[.]com<br />
usps.receivepost[.]com<br />
usps.trckmybusi[.]com<br />
postreceive[.]com<br />
tackingpos[.]com<br />
usps.trckstamp[.]com<br />
usa-usps[.]shop<br />
usps.infortrck[.]com<br />
unlistedstampreceive[.]com<br />
usps.stampreceive[.]com<br />
usps.stamppos[.]com<br />
usps.stampspos[.]com<br />
usps.trckmypost[.]com<br />
usps.trckintern[.]com<br />
usps.tackingpos[.]com<br />
usps.posinformed[.]com</p>
<p>As we can see in the screenshot below, the developer tools console for informedtrck[.]com complains that the site is unable to load a <strong>Google Analytics</strong> code &#8212; <strong>UA-80133954-3 </strong>&#8212; which apparently was rejected for pointing to an invalid domain.</p>
<div id="attachment_65260" style="width: 760px" class="wp-caption aligncenter"><a href="media/88f18cea.ua-usps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/ua-usps.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-65260" decoding="async" loading="lazy" class="wp-image-65260" src="media/88f18cea.ua-usps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/ua-usps.png" alt="" width="750" height="321" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/10/ua-usps.png 1890w, https://krebsonsecurity.com/wp-content/uploads/2023/10/ua-usps-768x329.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/10/ua-usps-1536x657.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/10/ua-usps-782x335.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-65260" class="wp-caption-text">Notice the highlighted Google Analytics code exposed by a faulty Javascript element on the phishing website. Click to enlarge. That code actually belongs to the USPS.</p></div>
<p>The valid domain for that Google Analytics code is the official usps.com website. According to <strong>dnslytics.com</strong>, that same analytics code has shown up on at least six other nearly identical USPS phishing pages dating back nearly as many years, including <strong>onlineuspsexpress[.]com</strong>, which <strong>DomainTools.com</strong> says was registered way back in September 2018 to an individual in Nigeria.</p>
<p>A different domain with that same Google Analytics code that was registered in 2021 is <strong>peraltansepeda[.]com</strong>, which <strong>archive.org</strong> <a href="https://web.archive.org/web/20211220213251/http://peralatansepeda.com/" target="_blank" rel="noopener">shows</a> was running a similar set of phishing pages targeting USPS users. DomainTools.com indicates this website name was registered by <a href="https://krebsonsecurity.com/2023/08/karma-catches-up-to-global-phishing-service-16shop/" target="_blank" rel="noopener">phishers based in Indonesia</a>.</p>
<p>DomainTools says the above-mentioned USPS phishing domain <strong>stamppos[.]com</strong> was registered in 2022 via Singapore-based <strong>Alibaba.com</strong>, but the registrant city and state listed for that domain says &#8220;Georgia, AL,&#8221; which is not a real location.</p>
<p>Alas, running a search for domains registered through Alibaba to anyone claiming to reside in Georgia, AL reveals nearly 300 recent postal phishing domains ending in &#8220;.top.&#8221; These domains are either administrative domains obscured by a password-protected login page, or are .top domains phishing customers of the USPS as well as postal services serving other countries.</p>
<p>Those other nations include the <a href="https://urlscan.io/result/6a07d4ee-da58-4073-af57-b35a50443c1b/" target="_blank" rel="noopener">Australia Post,</a> <a href="https://urlscan.io/result/d1e65a1b-83ab-4336-b08e-238228b76816/" target="_blank" rel="noopener">An Post</a> (Ireland), <a href="https://urlscan.io/result/625dbe0a-014d-43b3-a186-8b0a289b72aa/" target="_blank" rel="noopener">Correos.es</a> (Spain), the <a href="https://urlscan.io/result/f8597d60-6c51-4703-abf3-c38738124fff/" target="_blank" rel="noopener">Costa Rican post</a>, the <a href="https://urlscan.io/result/3e467dac-5972-4e2c-ab36-52b783c6b59f/" target="_blank" rel="noopener">Chilean Post</a>, the <a href="https://urlscan.io/result/1677e4c5-f22a-4a5c-a5d3-98f4d3b940bf/" target="_blank" rel="noopener">Mexican Postal Service</a>, <a href="https://urlscan.io/result/1eaba8e4-10be-49fc-9770-f44b87133dd6/" target="_blank" rel="noopener">Poste Italiane</a> (Italy), <a href="https://urlscan.io/result/5805064e-4fc9-43bf-8c02-a30ac0056d9e/" target="_blank" rel="noopener">PostNL</a> (Netherlands), <a href="https://urlscan.io/result/ae756c37-5ce0-47bf-934b-3c9f217f8ae2/" target="_blank" rel="noopener">PostNord</a> (Denmark, Norway and Sweden), and <a href="https://urlscan.io/result/151c049e-d475-4cad-89c0-ef9cd383cd48/" target="_blank" rel="noopener">Posti</a> (Finland). A complete list of these domains is available <a href="media/79fe1c62.alibaba-postal-phishing-al-ga.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/alibaba-postal-phishing-al-ga.pdf" target="_blank" rel="noopener">here</a> (PDF).<span id="more-65255"></span></p>
<div id="attachment_65273" style="width: 680px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-65273" decoding="async" loading="lazy" class="size-full wp-image-65273" src="media/7321e328.anpostphish.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/anpostphish.png" alt="" width="670" height="651" /><p id="caption-attachment-65273" class="wp-caption-text">A phishing page targeting An Post, the state-owned provider of postal services in Ireland.</p></div>
<p>The Georgia, AL domains at Alibaba also encompass several that spoof sites claiming to collect outstanding road toll fees and fines on behalf of the governments of <a href="https://urlscan.io/result/3a8729af-379c-408a-9623-66b619125e82/" target="_blank" rel="noopener">Australia</a>, <a href="https://urlscan.io/result/c552d0d2-d698-4b0d-8644-88b1938ff173/" target="_blank" rel="noopener">New Zealand</a> and <a href="https://urlscan.io/result/ea135a70-c1b1-43be-ae50-2386c67befcc/" target="_blank" rel="noopener">Singapore</a>.</p>
<p>An anonymous reader wrote in to say they submitted fake information to the above-mentioned phishing site usps.receivepost[.]com via the malware sandbox <strong>any.run</strong>. A <a href="https://app.any.run/tasks/fc79e00c-a26c-4bfa-b658-4a7009ac4682/" target="_blank" rel="noopener">video recording of that analysis</a> shows that the site sends any submitted data via an automated bot on the Telegram instant messaging service.</p>
<p>The traffic analysis just below the any.run video shows that any data collected by the phishing site is being sent to the Telegram user <a href="https://t.me/chenlun" target="_blank" rel="noopener">@chenlun</a>, who offers to sell customized source code for phishing pages. From a review of @chenlun&#8217;s other Telegram channels, it appears this account is being massively spammed at the moment &#8212; possibly thanks to public attention brought by this story.</p>
<p><a href="media/d0018aaf.chenlun.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/chenlun.png" target="_blank" rel="noopener"><img decoding="async" loading="lazy" class="aligncenter wp-image-65291" src="media/d0018aaf.chenlun.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/10/chenlun.png" alt="" width="750" height="381" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/10/chenlun.png 991w, https://krebsonsecurity.com/wp-content/uploads/2023/10/chenlun-768x390.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/10/chenlun-782x397.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a></p>
<p>Meanwhile, researchers at DomainTools recently <a href="https://www.domaintools.com/resources/blog/return-to-sender-a-brief-analysis-of-a-us-postal-service-smishing-campaign/" target="_blank" rel="noopener">published a report</a> on an apparently unrelated but equally sprawling SMS-based phishing campaign targeting USPS customers that appears to be the work of cybercriminals based in Iran.</p>
<p>Phishers tend to cast a wide net and often spoof entities that are broadly used by the local population, and few brands are going to have more household reach than domestic mail services. In June, the <strong>United Parcel Service</strong> (UPS) disclosed that fraudsters were <a href="https://krebsonsecurity.com/2023/06/sms-phishers-harvested-phone-numbers-shipment-data-from-ups-tracking-tool/" target="_blank" rel="noopener">abusing an online shipment tracking tool in Canada</a> to send highly targeted SMS phishing messages that spoofed the UPS and other brands.</p>
<p>With the holiday shopping season nearly upon us, now is a great time to remind family and friends about the best advice to sidestep phishing scams: Avoid clicking on links or attachments that arrive unbidden in emails, text messages and other mediums. Most phishing scams invoke a temporal element that warns of negative consequences should you fail to respond or act quickly.</p>
<p>If you’re unsure whether the message is legitimate, take a deep breath and visit the site or service in question manually — ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>.</p>
<p>Update: Added information about the Telegram bot and any.run analysis.</p>


feed_id: https://krebsonsecurity.com/?p=65298
title: Patch Tuesday, October 2023 Edition
uri: Patch-Tuesday-October-2023-Edition
url: https://krebsonsecurity.com/2023/10/patch-tuesday-october-2023-edition/
content:
<p><strong>Microsoft</strong> today issued security updates for more than 100 newly-discovered vulnerabilities in its <strong>Windows</strong> operating system and related software, including four flaws that are already being exploited. In addition, <strong>Apple</strong> recently released emergency updates to quash a pair of zero-day bugs in <strong>iOS</strong>.</p>
<p><img decoding="async" class="aligncenter  wp-image-52647" src="media/2471c2d6.windowsec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/08/windowsec.png" alt="" width="751" height="551" /></p>
<p>Apple last week shipped <a href="https://support.apple.com/en-us/HT213961" target="_blank" rel="noopener">emergency updates</a> in <strong>iOS 17.0.3</strong> and <strong>iPadOS 17.0.3</strong> in response to active attacks. The patch fixes <strong>CVE-2023-42724</strong>, which attackers have been using in targeted attacks to elevate their access on a local device.</p>
<p>Apple said it also patched <strong>CVE-2023-5217</strong>, which is not listed as a zero-day bug. However, as <em>Bleeping Computer</em> <a href="https://www.bleepingcomputer.com/news/apple/apple-emergency-update-fixes-new-zero-day-used-to-hack-iphones/" target="_blank" rel="noopener">pointed out</a>, this flaw is caused by a weakness in the open-source &#8220;<strong>libvpx</strong>&#8221; video codec library, which was previously patched as a zero-day flaw by <strong>Google</strong> in the Chrome browser and by Microsoft in <strong>Edge</strong>, <strong>Teams</strong>, and <strong>Skype</strong> products. For anyone keeping count, this is <em>the 17th zero-day flaw that Apple has patched so far this year.</em></p>
<p>Fortunately, the zero-days affecting Microsoft customers this month are somewhat less severe than usual, with the exception of <strong>CVE-2023-44487</strong>. This weakness is not specific to Windows but instead exists within the <a href="https://httpwg.org/specs/rfc7540.html" target="_blank" rel="noopener">HTTP/2 protocol</a> used by the World Wide Web: Attackers have figured out how to use a feature of HTTP/2 to massively increase the size of distributed denial-of-service (DDoS) attacks, and these monster attacks reportedly have been going on for several weeks now.</p>
<p><a href="https://aws.amazon.com/blogs/security/how-aws-protects-customers-from-ddos-events/" target="_blank" rel="noopener">Amazon</a>, <a href="https://www.cloudflare.com/press-releases/2023/cloudflare-helps-discover-new-online-threat-that-led-to-largest-attack-in/" target="_blank" rel="noopener">Cloudflare</a> and <a href="https://cloud.google.com/blog/products/identity-security/how-it-works-the-novel-http2-rapid-reset-ddos-attack" target="_blank" rel="noopener">Google</a> all released advisories today about how they&#8217;re addressing CVE-2023-44487 in their cloud environments. Google&#8217;s <strong>Damian Menscher</strong> <a href="https://twitter.com/menscher/status/1711715943385325958" target="_blank" rel="noopener">wrote on Twitter/X</a> that the exploit &#8212; dubbed a &#8220;<strong>rapid reset attack</strong>&#8221; &#8212; works by sending a request and then immediately cancelling it (a feature of HTTP/2). &#8220;This lets attackers skip waiting for responses, resulting in a more efficient attack,&#8221; Menscher explained.</p>
<p><strong>Natalie Silva</strong>, lead security engineer at <strong>Immersive Labs</strong>, said this flaw&#8217;s impact to enterprise customers could be significant, and lead to prolonged downtime.</p>
<p>&#8220;It is crucial for organizations to apply the latest patches and updates from their web server vendors to mitigate this vulnerability and protect against such attacks,&#8221; Silva said. In this month’s Patch Tuesday release by Microsoft, they have released both an update to this vulnerability, as well as a temporary workaround should you not be able to patch immediately.&#8221;<span id="more-65298"></span></p>
<p>Microsoft also patched zero-day bugs in <strong>Skype for Business</strong> (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-41763" target="_blank" rel="noopener">CVE-2023-41763</a>) and <strong>Wordpad</strong> (<a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36563" target="_blank" rel="noopener">CVE-2023-36563</a>). The latter vulnerability could expose <a href="https://www.ired.team/offensive-security/initial-access/netntlmv2-hash-stealing-using-outlook" target="_blank" rel="noopener">NTLM hashes</a>, which are used for authentication in Windows environments.</p>
<p>&#8220;It may or may not be a coincidence that Microsoft announced last month that WordPad is no longer being updated, and will be removed in a future version of Windows, although no specific timeline has yet been given,&#8221; said <strong>Adam Barnett</strong>, lead software engineer at <strong>Rapid7</strong>. &#8220;Unsurprisingly, Microsoft recommends Word as a replacement for WordPad.&#8221;</p>
<p>Other notable bugs addressed by Microsoft include <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-35349" target="_blank" rel="noopener">CVE-2023-35349</a>, a remote code execution weakness in the <strong>Message Queuing</strong> (MSMQ) service, a technology that allows applications across multiple servers or hosts to communicate with each other. This vulnerability has earned a <a href="https://nvd.nist.gov/vuln-metrics/cvss" target="_blank" rel="noopener">CVSS severity score</a> of 9.8 (10 is the worst possible). Happily, the MSMQ service is not enabled by default in Windows, although Immersive Labs notes that <strong>Microsoft Exchange Server</strong> can enable this service during installation.</p>
<p>Speaking of Exchange, Microsoft also patched <a href="https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-36778" target="_blank" rel="noopener">CVE-2023-36778</a>,  a vulnerability in all current versions of Exchange Server that could allow attackers to run code of their choosing. Rapid7&#8217;s Barnett said successful exploitation requires that the attacker be on the same network as the Exchange Server host, and use valid credentials for an Exchange user in a PowerShell session.</p>
<p>For a more detailed breakdown on the updates released today, see the <a href="https://isc.sans.edu/forums/diary/October%202023%20Microsoft%20Patch%20Tuesday%20Summary/30300/" target="_blank" rel="noopener">SANS Internet Storm Center roundup</a>. If today’s updates cause any stability or usability issues in Windows, <a href="https://www.askwoody.com/2023/october-updates-here-comes-copilot/" target="_blank" rel="noopener">AskWoody.com</a> will likely have the lowdown on that.</p>
<p>Please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any difficulties as a result of these patches.</p>


