# articles

feed_id: https://krebsonsecurity.com/?p=62442
title: Thinking of Hiring or Running a Booter Service? Think Again.
uri: Thinking-of-Hiring-or-Running-a-Booter-Service-Think-Again
url: https://krebsonsecurity.com/2023/01/thinking-of-hiring-or-running-a-booter-service-think-again/
content:
<p>Most people who operate DDoS-for-hire businesses attempt to hide their true identities and location. Proprietors of these so-called &#8220;booter&#8221; or &#8220;stresser&#8221; services &#8212; designed to knock websites and users offline &#8212; have long operated in a legally murky area of cybercrime law. But until recently, their biggest concern wasn&#8217;t avoiding capture or shutdown by the feds: It was minimizing harassment from unhappy customers or victims, and insulating themselves against incessant attacks from competing DDoS-for-hire services.</p>
<p>And then there are booter store operators like <strong>John Dobbs</strong>, a 32-year-old computer science graduate student living in Honolulu, Hawaii. For at least a decade until late last year, Dobbs openly operated <strong>IPStresser[.]com</strong>, a popular and powerful attack-for-hire service that he registered with the state of Hawaii using his real name and address. Likewise, the domain was registered in Dobbs&#8217;s name and hometown in Pennsylvania.</p>
<div id="attachment_62448" style="width: 498px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62448" class="size-full wp-image-62448" src="media/9446ea48.johndobbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/johndobbs.png" alt="" width="488" height="457" /><p id="caption-attachment-62448" class="wp-caption-text">Dobbs, in an undated photo from his Github profile. Image: john-dobbs.github.io</p></div>
<p>The only work experience Dobbs listed on <a href="https://john-dobbs.github.io/bio/" target="_blank" rel="noopener">his resume</a> was as a freelance developer from 2013 to the present day. Dobbs&#8217;s resume doesn&#8217;t name his booter service, but in it he brags about maintaining websites with half a million page views daily, and &#8220;designing server deployments for performance, high-availability and security.&#8221;</p>
<p>In December 2022, the U.S. Department of Justice seized Dobbs&#8217;s IPStresser website and charged him with one count of aiding and abetting computer intrusions. Prosecutors say his service attracted more than two million registered users, and was responsible for launching <em>a staggering 30 million distinct DDoS attacks</em>.</p>
<p>The government seized four-dozen booter domains, and <a href="https://krebsonsecurity.com/2022/12/six-charged-in-mass-takedown-of-ddos-for-hire-sites/" target="_blank" rel="noopener">criminally charged Dobbs and five other U.S. men for allegedly operating stresser services</a>. This was the Justice Department&#8217;s second such mass takedown targeting DDoS-for-hire services and their accused operators. In 2018, the feds <a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" target="_blank" rel="noopener">seized 15 stresser sites, and levied cybercrime charges against three men for their operation of booter services.</p>
<div id="attachment_62452" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62452" loading="lazy" class=" wp-image-62452" src="media/37c5a4cd.ipstresser.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/ipstresser.png" alt="" width="749" height="599" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/01/ipstresser.png 1022w, https://krebsonsecurity.com/wp-content/uploads/2023/01/ipstresser-768x614.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/01/ipstresser-782x625.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-62452" class="wp-caption-text">Dobbs&#8217;s booter service, IPStresser, in June 2020. Image: archive.org.</p></div>
<p>Many accused stresser site operators have pleaded guilty over the years after being hit with federal criminal charges. But the government&#8217;s core claim &#8212; that operating a booter site is a violation of U.S. computer crime laws &#8212; wasn&#8217;t properly tested in the courts until September 2021.</p>
<p>That was when a jury handed down <a href="https://krebsonsecurity.com/2021/09/trial-ends-in-guilty-verdict-for-ddos-for-hire-boss/" rel="noopener" target="_blank">a guilty verdict against <strong>Matthew Gatrel</strong></a>, a then 32-year-old St. Charles, Ill. man charged in the government&#8217;s first 2018 mass booter bust-up. Despite admitting to FBI agents that he ran two booter services (and turning over plenty of incriminating evidence in the process), Gatrel opted to take his case to trial, defended the entire time by court-appointed attorneys.</p>
<p>Prosecutors said Gatrel&#8217;s booter services &#8212; downthem[.]org and ampnode[.]com &#8212; helped some 2,000 paying customers launch debilitating digital assaults on more than 20,000 targets, including many government, banking, university and gaming websites.</p>
<p>Gatrel was convicted on all three charges of violating the Computer Fraud and Abuse Act, including conspiracy to commit unauthorized impairment of a protected computer, conspiracy to commit wire fraud, and unauthorized impairment of a protected computer. He was sentenced to two years in prison.</p>
<p>Now, it appears Dobbs is also planning to take his chances with a jury. On Jan. 4, Dobbs entered a plea of not guilty. Neither Dobbs nor his court-appointed attorney responded to requests for comment.</p>
<p>But as it happens, Dobbs himself provided some perspective on his thinking in an email exchange with KrebsOnSecurity back in 2020. I&#8217;d reached out to Dobbs because it was obvious he didn&#8217;t mind if people knew he operated one of the world&#8217;s most popular DDoS-for-hire sites, and I was genuinely curious why he was so unafraid of getting raided by the feds.</p>
<p>&#8220;Yes, I am the owner of the domain you listed, however you are not authorized to post an article containing said domain name, my name or this email address without my prior written permission,&#8221; Dobbs replied to my initial outreach on March 10, 2020 using his email address from the University of Hawaii at Manoa.</p>
<p>A few hours later, I received more strident instructions from Dobbs, this time via his official email address at ipstresser[.]com.</p>
<p>&#8220;I will state again for absolute clarity, you are not authorized to post an article containing ipstresser.com, my name, my GitHub profile and/or my hawaii.edu email address,&#8221; Dobbs wrote, as if taking dictation from a lawyer who doesn&#8217;t understand how the media works.</p>
<p>When pressed for particulars on his business, Dobbs replied that the number of IPStresser customers was &#8220;privileged information,&#8221; and said he didn&#8217;t even advertise the service. When asked whether he was concerned that many of his competitors were by then serving jail time for operating similar booter services, Dobbs maintained that the way he&#8217;d set up the business insulated him from any liability.</p>
<p>&#8220;I have been aware of the recent law enforcement actions against other operators of stress testing services,&#8221; Dobbs explained. &#8220;I cannot speak to the actions of these other services, but we take proactive measures to prevent misuse of our service and we work with law enforcement agencies regarding any reported abuse of our service.&#8221;</p>
<p>What were those proactive measures? In a 2015 interview with <em>ZDNet France</em>, Dobbs asserted that he was immune from liability because his clients all had to submit a digital signature attesting that they wouldn’t use the site for illegal purposes.</p>
<p>&#8220;Our terms of use are a legal document that protects us, among other things, from certain legal consequences,&#8221; Dobbs told ZDNet. &#8220;Most other sites are satisfied with a simple checkbox, but we ask for a digital signature in order to imply real consent from our customers.&#8221;</p>
<p>Dobbs told KrebsOnSecurity his service didn&#8217;t generate much of a profit, but rather that he was motivated by &#8220;filling a legitimate need.&#8221;</p>
<p>&#8220;My reason for offering the service is to provide the ability to test network security measures before someone with malicious intent attacks said network and causes downtime,&#8221; he said. &#8220;Sure, some people see only the negatives, but there is a long list of companies I have worked with over the years who would say my service is a godsend and has helped them prevent tens of thousands of dollars in downtime resulting from a malicious attack.&#8221;</p>
<p>&#8220;I do not believe that providing such a service is illegal, assuming proper due diligence to prevent malicious use of the service, as is the case for IPstresser[.]com,&#8221; Dobbs continued. &#8220;Someone using such a service to conduct unauthorized testing is illegal in many countries, however, the legal liability is that of the user, not of the service provider.&#8221;</p>
<p>Dobbs&#8217;s profile on GitHub includes more of his ideas about his work, including a curious piece on &#8220;<a href="https://web.archive.org/web/20200905200257/https://john-dobbs.github.io/essays/ethics.html" target="_blank" rel="noopener">software engineering ethics</a>.&#8221; In his January 2020 treatise &#8220;<a href="https://john-dobbs.github.io/essays/my-software-engineering-journey.html" target="_blank" rel="noopener">My Software Engineering Journey</a>,&#8221; Dobbs laments that nothing in his formal education prepared him for the reality that a great deal of his work would be so tedious and repetitive (this tracks closely with a 2020 piece here called <a href="https://krebsonsecurity.com/2020/05/career-choice-tip-cybercrime-is-mostly-boring/" target="_blank" rel="noopener">Career Choice Tip: Cybercrime is Mostly Boring</a>).</p>
<p>&#8220;One area of software engineering that I think should be covered more in university classes is maintenance,&#8221; Dobbs wrote. &#8220;Projects are often worked on for at most a few months, and students do not experience the maintenance aspect of software engineering until they reach the workplace. Let’s face it, ongoing maintenance of a project is boring; there is nothing like the euphoria of completing a project you have been working on for months and releasing it to the world, but I would say that half of my professional career has been related to maintenance.&#8221;<span id="more-62442"></span></p>
<p><strong>Allison Nixon</strong> is chief research officer at the New York-based cybersecurity firm <a href="https://unit221b.com" target="_blank" rel="noopener">Unit 221B</a>. Nixon is part of a small group of researchers who have been closely tracking the DDoS-for-hire industry for years, and she said Dobbs&#8217;s claim that what he&#8217;s doing is legal makes sense given that it took years for the government to recognize the size of the problem.</p>
<p>&#8220;These guys are arguing that their services are legal because for a long time nothing happened to them,&#8221; Nixon said. &#8220;It&#8217;s difficult to argue something is illegal if no one has ever been arrested for it before.&#8221;</p>
<p>Nixon says the government&#8217;s fight against the booter services &#8212; and by extension other types of cybercrimes &#8212; is hampered by a legal system that often takes years to cycle through cybercrime cases.</p>
<p>&#8220;With cybercrime, the cycle between the crime and investigation and arrest can often take a year or more, and that&#8217;s for a really fast case,&#8221; Nixon said. &#8220;If someone robbed a store, we&#8217;d expect a police response within a few minutes. If someone robs a bank&#8217;s website, there might be some indication of police activity within a year.&#8221;</p>
<p>Nixon praised the 2022 and 2018 booter takedown operations as &#8220;huge steps forward,&#8221; but added that &#8220;there need to be more of them, and faster.&#8221;</p>
<p>&#8220;This time lag is part of the reason it&#8217;s so difficult to shut down the pipeline of new talent going into cybercrime,&#8221; she said. &#8220;They think what they&#8217;re doing is legal because nothing has happened, and because of the amount of time it takes to shut these things down. And it&#8217;s really a big problem, where we see a lot of people becoming criminals on the basis that what they&#8217;re doing isn&#8217;t really illegal because the cops won&#8217;t do anything.&#8221;</p>
<p>In December 2020, Dobbs filed an application with the state of Hawaii to withdraw IP Stresser Inc. from its roster of active companies. But according to prosecutors, Dobbs would continue to operate his DDoS-for-hire site until at least November 2022.</p>
<p>Two months after our 2020 email interview, Dobbs would earn his second bachelor&#8217;s degree (in computer science; his resume says he earned a bachelor&#8217;s in civil engineering from Drexel University in 2013). The federal charges against Dobbs came just as he was preparing to enter his final semester toward a master&#8217;s degree in computer science at the University of Hawaii.</p>
<p>Nixon says she has a message for anyone involved in operating a DDoS-for-hire service.</p>
<p>&#8220;Unless you are verifying that the target owns the infrastructure you&#8217;re targeting, there is no legal way to operate a DDoS-for-hire service,&#8221; she said. &#8220;There is no Terms of Service you could put on the site that would somehow make it legal.&#8221;</p>
<p>And her message to the customers of those booter services? It&#8217;s a compelling one to ponder, particularly now that investigators in the United States, U.K. and elsewhere have <a href="https://krebsonsecurity.com/2019/02/250-webstresser-users-to-face-legal-action/" rel="noopener" target="_blank">started going after booter service customers</a>.</p>
<p>&#8220;When a booter service claims they don&#8217;t share logs, they&#8217;re lying because logs are legal leverage for when the booter service operator gets arrested,&#8221; Nixon said. &#8220;And when they do, you&#8217;re going to be the first people they throw under the bus.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=62479
title: New T-Mobile Breach Affects 37 Million Accounts
uri: New-T-Mobile-Breach-Affects-37-Million-Accounts
url: https://krebsonsecurity.com/2023/01/new-t-mobile-breach-affects-37-million-accounts/
content:
<p><strong>T-Mobile</strong> today disclosed a data breach affecting tens of millions of customer accounts, its second major data exposure in as many years. In a filing with federal regulators, T-Mobile said an investigation determined that someone abused its systems to harvest subscriber data tied to approximately 37 million current customer accounts.</p>
<div id="attachment_62480" style="width: 668px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62480" class="wp-image-62480 size-full" src="media/695f9f71.tmobt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/tmobt.png" alt="" width="658" height="664" /><p id="caption-attachment-62480" class="wp-caption-text">Image: customink.com</p></div>
<p>In <a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/0001283699/000119312523010949/d641142d8k.htm" target="_blank" rel="noopener">a filing today</a> with the <strong>U.S. Securities and Exchange Commission</strong>, T-Mobile said a &#8220;bad actor&#8221; abused an application programming interface (API) to hoover up data on roughly 37 million current postpaid and prepaid customer accounts. The data stolen included customer name, billing address, email, phone number, date of birth, T-Mobile account number, as well as information on the number of customer lines and plan features.</p>
<p>APIs are essentially instructions that allow applications to access data and interact with web databases. But left improperly secured, these APIs can be leveraged by malicious actors to mass-harvest information stored in those databases. In October, mobile provider <strong>Optus</strong> disclosed that hackers abused a poorly secured API to steal data on 10 million customers in Australia.</p>
<p>The company said it first learned of the incident on Jan. 5, 2022, and that an investigation determined the bad actor started abusing the API beginning around Nov. 25, 2022.</p>
<p>T-Mobile says it is in the process of notifying affected customers, and that no customer payment card data, passwords, Social Security numbers, driver&#8217;s license or other government ID numbers were exposed.</p>
<p>In August 2021, T-Mobile acknowledged that hackers made off with the names, dates of birth, Social Security numbers and driver&#8217;s license/ID information on more than 40 million current, former or prospective customers who applied for credit with the company. That breach came to light after <a href="https://krebsonsecurity.com/2021/08/t-mobile-breach-exposed-ssn-dob-of-40m-people/" target="_blank" rel="noopener">a hacker began selling the records on a cybercrime forum</a>.</p>
<p>Last year, T-Mobile agreed to pay $500 million to settle all class action lawsuits stemming from the 2021 breach. The company pledged to spend $150 million of that money toward beefing up its own cybersecurity.</p>
<p>In its filing with the SEC, T-Mobile suggested it was going to take years to fully realize the benefits of those cybersecurity improvements, even as it claimed that protecting customer data remains a top priority.</p>
<p>&#8220;As we have previously disclosed, in 2021, we commenced a substantial multi-year investment working with leading external cybersecurity experts to enhance our cybersecurity capabilities and transform our approach to cybersecurity,&#8221; the filing reads. &#8220;We have made substantial progress to date, and protecting our customers’ data remains a top priority.&#8221;</p>
<p>Despite this being the second major customer data spill in as many years, T-Mobile told the SEC the company does not expect this latest breach to have a material impact on its operations.</p>
<p>While that may seem like a daring thing to say in a data breach disclosure affecting a significant portion of your active customer base, consider that T-Mobile <a href="https://www.nasdaq.com/articles/t-mobile-tmus-misses-q3-earnings-and-revenue-estimates" target="_blank" rel="noopener">reported</a> revenues of <em>nearly $20 billion in the third quarter of 2022 alone.</em> In that context, a few hundred million dollars every couple of years to make the class action lawyers go away is a drop in the bucket.<span id="more-62479"></span></p>
<p>The settlement related to the 2021 breach says T-Mobile will make $350 million available to customers who file a claim. But here&#8217;s the catch: If you were affected by that 2021 breach and you haven&#8217;t <a href="https://www.t-mobilesettlement.com/" target="_blank" rel="noopener">filed a claim yet</a>, please know that you have only three more days to do that.</p>
<p>If you were a T-Mobile customer affected by the 2021 incident, it is likely that T-Mobile has already made several efforts to notify you of your eligibility to file a claim, which includes a payout of at least $25, with the possibility of more for those who can document direct costs associated with the breach. <a href="https://openclassactions.com/settlement_tmobile.php" target="_blank" rel="noopener">OpenClassActions.com</a> says the filing deadline is Jan. 23, 2023.</p>
<p>&#8220;If you opt for a <b>cash payment</b> you will receive an estimated $25.00,&#8221; the site explains. &#8220;If you reside in California, you will receive an estimated $100.00. Out of pocket losses can be reimbursed for up to $25,000.00. The amount that you claim from T-Mobile will be determined by the class action administrator based on how many people file a legitimate and timely claim form.&#8221;</p>
<p>There are currently no signs that hackers are selling this latest data haul from T-Mobile, but <a href="https://krebsonsecurity.com/2021/07/the-life-cycle-of-a-breached-database/" target="_blank" rel="noopener">if the past is any teacher much of it will wind up posted online soon</a>. It is a safe bet that scammers will use some of this information to target T-Mobile users with phishing messages, account takeovers and harassment.</p>
<p>T-Mobile customers should fully expect to see phishers taking advantage of public concern over the breach to impersonate the company — and possibly even send messages that include the recipient’s compromised account details to make the communications look more legitimate.</p>
<p>Data stolen and exposed in this breach may also be used for identity theft. Credit monitoring and ID theft protection services can help you recover from having your identity stolen, but most will do nothing to stop the ID theft from happening. If you want the maximum control over who should be able to view your credit or grant new lines of credit in your name, then <a href="https://krebsonsecurity.com/2018/09/credit-freezes-are-free-let-the-ice-age-begin/" target="_blank" rel="noopener">a security freeze</a> is your best option.</p>
<p>Regardless of which mobile provider you patronize, please consider removing your phone number from as many online accounts as you can. Many online services require you to provide a phone number upon registering an account, but in many cases that number can be removed from your profile afterwards.</p>
<p>Why do I suggest this? Many online services allow users to reset their passwords just by clicking a link sent via SMS, and this unfortunately widespread practice has <a href="https://krebsonsecurity.com/2019/03/why-phone-numbers-stink-as-identity-proof/" target="_blank" rel="noopener">turned mobile phone numbers into de facto identity documents</a>. Which means losing control over your phone number thanks to an <a href="https://krebsonsecurity.com/category/sim-swapping/" target="_blank" rel="noopener">unauthorized SIM swap or mobile number port-out</a>, divorce, job termination or financial crisis can be devastating.</p>


feed_id: https://krebsonsecurity.com/?p=62511
title: Administrator of RSOCKS Proxy Botnet Pleads Guilty
uri: Administrator-of-RSOCKS-Proxy-Botnet-Pleads-Guilty
url: https://krebsonsecurity.com/2023/01/administrator-of-rsocks-proxy-botnet-pleads-guilty/
content:
<p><strong>Denis Emelyantsev</strong>, a 36-year-old Russian man accused of running a massive botnet called <strong>RSOCKS</strong> that stitched malware into millions of devices worldwide, pleaded guilty to two counts of computer crime violations in a California courtroom this week. The plea comes just months after Emelyantsev was extradited from Bulgaria, where he told investigators, “America is looking for me because I have enormous information and they need it.”</p>
<div id="attachment_60166" style="width: 310px" class="wp-caption alignright"><img aria-describedby="caption-attachment-60166" class=" wp-image-60166" src="media/95f9be6f.klosterpp.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/klosterpp.png" alt="" width="300" height="308" /><p id="caption-attachment-60166" class="wp-caption-text">A copy of the passport for Denis Emelyantsev, a.k.a. Denis Kloster, as posted to his Vkontakte page in 2019.</p></div>
<p>First advertised in the cybercrime underground in 2014, RSOCKS was the <a href="https://web.archive.org/web/20160612163110/http://rsocks.net/" target="_blank" rel="noopener">web-based storefront</a> for hacked computers that were sold as “proxies” to cybercriminals looking for ways to route their Web traffic through someone else’s device.</p>
<p>Customers could pay to rent access to a pool of proxies for a specified period, with costs ranging from $30 per day for access to 2,000 proxies, to $200 daily for up to 90,000 proxies.</p>
<p>Many of the infected systems were <a href="https://krebsonsecurity.com/tag/iot/" target="_blank" rel="noopener">Internet of Things (IoT) devices</a>, including industrial control systems, time clocks, routers, audio/video streaming devices, and smart garage door openers. Later in its existence, the RSOCKS botnet expanded into compromising Android devices and conventional computers.</p>
<p>In June 2022, authorities in the United States, Germany, the Netherlands and the United Kingdom <a href="https://www.justice.gov/usao-sdca/pr/russian-botnet-disrupted-international-cyber-operation" target="_blank" rel="noopener">announced a joint operation to dismantle the RSOCKS botnet</a>. But that action did not name any defendants.</p>
<p>Inspired by that takedown, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/" target="_blank" rel="noopener">followed clues</a> from the RSOCKS botnet master’s identity on the cybercrime forums to <a href="https://web-archive-org.translate.goog/web/20220114060032/http://deniskloster.com/%D0%BD%D0%B0%D0%BC-%D1%82%D1%80%D0%B8-%D0%B3%D0%BE%D0%B4%D0%B0-2/?_x_tr_sl=ru&amp;_x_tr_tl=en&amp;_x_tr_hl=en&amp;_x_tr_pto=wapp" target="_blank" rel="noopener">Emelyantsev’s personal blog</a>, where he went by the name <strong>Denis Kloster</strong>. The blog featured musings on the challenges of running a company that sells “security and anonymity services to customers around the world,&#8221; and even included <a href="media/3d2966f9.klosterphoto.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/klosterphoto.png" target="_blank" rel="noopener">a group photo of RSOCKS employees</a>.</p>
<p>&#8220;Thanks to you, we are now developing in the field of information security and anonymity!,” Kloster’s blog enthused. “We make products that are used by thousands of people around the world, and this is very cool! And this is just the beginning!!! We don’t just work together and we’re not just friends, we’re Family.”</p>
<p>But by the time that investigation was published, Emelyantsev had already been <a href="https://krebsonsecurity.com/2022/09/accused-russian-rsocks-botmaster-arrested-requests-extradition-to-u-s/" target="_blank" rel="noopener">captured by Bulgarian authorities</a> responding to an American arrest warrant. At his extradition hearing, Emelyantsev claimed he would prove his innocence in an U.S. courtroom.</p>
<p>“I have hired a lawyer there and I want you to send me as quickly as possible to clear these baseless charges,” Emelyantsev <a href="https://www.struma.com/krimi/ruskiyat-haker-arestuvan-v-bansko-poiska-da-go-ekstradirat-v_197964/" target="_blank" rel="noopener">told</a> the Bulgarian court. “I am not a criminal and I will prove it in an American court.”<span id="more-62511"></span></p>
<div id="attachment_62518" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62518" loading="lazy" class=" wp-image-62518" src="media/8cb9d1d7.rsocksfront.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/rsocksfront.png" alt="" width="751" height="855" /><p id="caption-attachment-62518" class="wp-caption-text">RSOCKS, circa 2016. At that time, RSOCKS was advertising more than 80,000 proxies. Image: archive.org.</p></div>
<p>Emelyantsev was far more than just an administrator of a large botnet. Behind the facade of his Internet advertising company based in Omsk, Russia, the RSOCKS botmaster was <a href="https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/#:~:text=Shortly%20after%20last" target="_blank" rel="noopener">a major player</a> in the Russian email spam industry for more than a decade.</p>
<p>Some of the top Russian cybercrime forums have been hacked over the years, and leaked private messages from those forums show the RSOCKS administrator claimed ownership of the <strong>RUSdot</strong> spam forum. RUSdot is the successor forum to <strong>Spamdot</strong>, a far more secretive and restricted community where most of the world’s top spammers, virus writers and cybercriminals collaborated for years before the forum <a href="https://krebsonsecurity.com/2010/09/spam-affialite-program-spamit-com-to-close/" target="_blank" rel="noopener">imploded in 2010</a>.</p>
<div id="attachment_60181" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-60181" loading="lazy" class=" wp-image-60181" src="media/78b8e106.rusdot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot.png" alt="" width="751" height="447" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot.png 1267w, https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot-768x457.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/06/rusdot-782x465.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-60181" class="wp-caption-text">A Google-translated version of the Rusdot spam forum.</p></div>
<p>Indeed, the very first mentions of RSOCKS on any Russian-language cybercrime forums refer to the service by its full name as the &#8220;<strong>RUSdot Socks Server</strong>.&#8221;</p>
<p>Email spam — and in particular malicious email sent via compromised computers — is still one of the biggest sources of malware infections that lead to data breaches and ransomware attacks. So it stands to reason that as administrator of Russia’s most well-known forum for spammers, Emelyantsev probably knows quite a bit about other top players in the botnet spam and malware community.</p>
<p>It remains unclear whether Emelyantsev made good on his promise to spill that knowledge to American investigators as part of his plea deal. The case is being prosecuted by the U.S. Attorney&#8217;s Office for the Southern District of California, which has not responded to a request for comment.</p>
<p>Emelyantsev pleaded guilty on Monday to two counts, including damage to protected computers and conspiracy to damage protected computers. He faces a maximum of 20 years in prison, and is currently scheduled to be sentenced on April 27, 2023.</p>


feed_id: https://krebsonsecurity.com/?p=62543
title: Experian Glitch Exposing Credit Files Lasted 47 Days
uri: Experian-Glitch-Exposing-Credit-Files-Lasted-47-Days
url: https://krebsonsecurity.com/2023/01/experian-glitch-exposing-credit-files-lasted-47-days/
content:
<p>On Dec. 23, 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2023/01/identity-thieves-bypassed-experian-security-to-view-credit-reports/" target="_blank" rel="noopener">alerted</a> big-three consumer credit reporting bureau <strong>Experian</strong> that identity thieves had worked out how to bypass its security and access any consumer&#8217;s full credit report &#8212; armed with nothing more than a person&#8217;s name, address, date of birth, and Social Security number. Experian fixed the glitch, but remained silent about the incident for a month. This week, however, Experian acknowledged that the security failure persisted for nearly seven weeks, between Nov. 9, 2022 and Dec. 26, 2022.</p>
<p><img class="aligncenter wp-image-62547" src="media/5be7a7a5.experianresponse.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/01/experianresponse.png" alt="" width="651" height="623" /></p>
<p>The tip about the Experian weakness came from <strong>Jenya Kushnir</strong>, a security researcher living in Ukraine who said he discovered the method being used by identity thieves after spending time on <strong>Telegram</strong> chat channels dedicated to cybercrime.</p>
<p>Normally, Experian&#8217;s website will ask a series of multiple-choice questions about one&#8217;s financial history, as a way of validating the identity of the person requesting the credit report. But Kushnir said the crooks learned they could bypass those questions and trick Experian into giving them access to anyone’s credit report, just by editing the address displayed in the browser URL bar at a specific point in Experian’s identity verification process.</p>
<p>When I tested Kushnir&#8217;s instructions on my own identity at Experian, I found I was able to see my report even though Experian&#8217;s website told me it didn&#8217;t have enough information to validate my identity. A security researcher friend who tested it at Experian found she also could bypass Experian&#8217;s four or five multiple-choice security questions and go straight to her full credit report at Experian.</p>
<p>Experian <a href="https://krebsonsecurity.com/2023/01/identity-thieves-bypassed-experian-security-to-view-credit-reports/" target="_blank" rel="noopener">acknowledged receipt of my Dec. 23 report</a> four days later on Dec. 27, a day after Kushnir&#8217;s method stopped working on Experian&#8217;s website (the exploit worked as long as you came to Experian&#8217;s website via <a href="https://www.annualcreditreport.com" target="_blank" rel="noopener">annualcreditreport.com</a> &#8212; the site mandated to provide a free copy of your credit report from each of the major bureaus once a year).</p>
<p>Experian never did respond to official requests for comment on that story. But earlier this week, I received an otherwise unhelpful letter via snail mail from Experian (see image above), which stated that the weakness we reported persisted between Nov. 9, 2022 and Dec. 26, 2022.</p>
<p>&#8220;During this time period, we experienced an isolated technical issue where a security feature may not have functioned,&#8221; Experian explained.<span id="more-62543"></span></p>
<p>It&#8217;s not entirely clear whether Experian sent me this paper notice because they legally had to, or if they felt I deserved a response in writing and thought maybe they&#8217;d kill two birds with one stone. But it&#8217;s pretty crazy that it took them a full month to notify me about the potential impact of a security failure that <em>I</em> notified <em>them</em> about.</p>
<p>It&#8217;s also a little nuts that Experian didn&#8217;t simply include a copy of my current credit report along with this letter, which is confusingly worded and reads like they suspect someone other than me may have been granted access to my credit report without any kind of screening or authorization.</p>
<p>After all, if I hadn&#8217;t authorized the request for my credit file that apparently prompted this letter (I had), that would mean the thieves already had my report. Shouldn&#8217;t I be granted the same visibility into my own credit file as them?</p>
<p>Instead, their woefully inadequate letter once again puts the onus on me to wait endlessly on hold for an Experian representative over the phone, or sign up for a free year&#8217;s worth of Experian monitoring my credit report.</p>
<p>As it stands, using Kushnir&#8217;s exploit was the only time I&#8217;ve ever been able to get Experian&#8217;s website to cough up a copy of my credit report. To make matters worse, a majority of the information in that credit report is not mine. So I&#8217;ve got that to look forward to.</p>
<p>If there is a silver lining here, I suppose that if I were Experian, I probably wouldn&#8217;t want to show Brian Krebs his credit file either. Because it&#8217;s clear this company has no idea who I really am. And in a weird, kind of sad way I guess, that makes me happy.</p>
<p>For thoughts on what you can do to minimize your victimization by and overall worth to the credit bureaus, see <a href="https://krebsonsecurity.com/2023/01/identity-thieves-bypassed-experian-security-to-view-credit-reports/#:~:text=WHAT%20CAN%20YOU%20DO" target="_blank" rel="noopener">this section of the most recent Experian story</a>.</p>


feed_id: https://krebsonsecurity.com/?p=62563
title: Finland’s Most-Wanted Hacker Nabbed in France
uri: Finland-s-Most-Wanted-Hacker-Nabbed-in-France
url: https://krebsonsecurity.com/2023/02/finlands-most-wanted-hacker-nabbed-in-france/
content:
<p><strong>Julius &#8220;Zeekill&#8221; Kivimäki,</strong> a 25-year-old Finnish man charged with extorting a local online psychotherapy practice and leaking therapy notes for more than 22,000 patients online, was arrested this week in France. A notorious hacker convicted of perpetrating tens of thousands of cybercrimes, Kivimäki had been in hiding since October 2022, when he failed to show up in court and Finland issued an international warrant for his arrest.</p>
<p><img class="aligncenter size-full wp-image-61773" src="media/0074dfea.kikmaki-wanted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png" alt="" width="2936" height="1398" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted.png 2936w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-768x366.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-1536x731.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-2048x975.png 2048w, https://krebsonsecurity.com/wp-content/uploads/2022/11/kikmaki-wanted-782x372.png 782w" sizes="(max-width: 2936px) 100vw, 2936px" /></p>
<p>In late October 2022, Kivimäki was charged (and &#8220;arrested in absentia,&#8221; according to the Finns) with attempting to extort money from the<strong> Vastaamo Psychotherapy Center</strong>. In that breach, which occurred in October 2020, a hacker using the handle &#8220;Ransom Man&#8221; threatened to publish patient psychotherapy notes if Vastaamo did not pay a six-figure ransom demand.</p>
<p>Vastaamo refused, so Ransom Man shifted to extorting individual patients &#8212; sending them targeted emails threatening to publish their therapy notes unless paid a 500-euro ransom.</p>
<p>When Ransom Man found little success extorting patients directly, they uploaded to the dark web a large compressed file containing all of the stolen Vastaamo patient records.</p>
<p>But as <a href="https://krebsonsecurity.com/2022/11/hacker-charged-with-extorting-online-psychotherapy-service/" target="_blank" rel="noopener">documented by KrebsOnSecurity in November 2022</a>, security experts soon discovered Ransom Man had mistakenly included an entire copy of their home folder, where investigators found many clues pointing to Kivimäki&#8217;s involvement. From that story:</p>
<p>&#8220;Among those who grabbed a copy of the database was <strong>Antti Kurittu</strong>, a team lead at <strong>Nixu Corporation</strong> and a former criminal investigator. In 2013, Kurittu worked on an investigation involving Kivimäki’s use of the Zbot botnet, among other activities Kivimäki engaged in as a member of the hacker group <a href="https://krebsonsecurity.com/2015/02/webnic-registrar-blamed-for-hijack-of-lenovo-google-domains/" target="_blank" rel="noopener">Hack the Planet</a> (HTP).&#8221;</p>
<p>“It was a huge opsec [operational security] fail, because they had a lot of stuff in there — including the user’s private SSH folder, and a lot of known hosts that we could take a very good look at,” Kurittu told KrebsOnSecurity, declining to discuss specifics of the evidence investigators seized. “There were also other projects and databases.”</p>
<p>According to the <a href="https://actu.fr/ile-de-france/courbevoie_92026/courbevoie-appelee-pour-violences-conjugales-la-police-arrete-un-criminel-international_57121782.html" target="_blank" rel="noopener">French news site actu.fr</a>, Kivimäki was arrested around 7 a.m. on Feb. 3, after authorities in <a href="https://en.wikipedia.org/wiki/Courbevoie" target="_blank" rel="noopener">Courbevoie</a> responded to a domestic violence report. Kivimäki had been out earlier with a woman at a local nightclub, and later the two returned to her home but reportedly got into a heated argument.</p>
<p>Police responding to the scene were admitted by another woman &#8212; possibly a roommate &#8212; and found the man inside still sleeping off a long night. When they roused him and asked for identification, the 6&#8242; 4&#8243; blonde, green-eyed man presented an ID that stated he was of Romanian nationality.</p>
<p>The French police were doubtful. After consulting records on most-wanted criminals, they quickly identified the man as Kivimäki and took him into custody.<span id="more-62563"></span></p>
<p>Kivimäki initially gained notoriety as a self-professed member of the <a href="https://krebsonsecurity.com/tag/lizard-squad/" target="_blank" rel="noopener">Lizard Squad</a>, a mainly low-skilled hacker group that specialized in DDoS attacks. But American and Finnish investigators say Kivimäki&#8217;s involvement in cybercrime dates back to at least 2008, when he was introduced to a founding member of what would soon become HTP.</p>
<p>Finnish police said Kivimäki also used the nicknames &#8220;Ryan&#8221;, &#8220;RyanC&#8221; and &#8220;Ryan Cleary&#8221; (Ryan Cleary was actually a member of a rival hacker group &#8212; <a href="https://en.wikipedia.org/wiki/LulzSec" target="_blank" rel="noopener">LulzSec</a> &#8212; who was sentenced to prison for hacking).</p>
<p>Kivimaki and other HTP members were involved in mass-compromising web servers using known vulnerabilities, and by 2012 Kivimäki&#8217;s alias Ryan Cleary was selling access to those servers in the form of a DDoS-for-hire service. Kivimäki was 15 years old at the time.</p>
<div id="attachment_62569" style="width: 633px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62569" loading="lazy" class="size-full wp-image-62569" src="media/d5f793b4.ryancddos.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/ryancddos.png" alt="" width="623" height="588" /><p id="caption-attachment-62569" class="wp-caption-text">The DDoS-for-hire service allegedly operated by Kivimäki in 2012.</p></div>
<p>In 2013, investigators going through devices seized from Kivimäki found computer code that had been used to crack more than 60,000 web servers using a previously unknown vulnerability in <strong>Adobe&#8217;s ColdFusion</strong> software.</p>
<p>KrebsOnSecurity detailed the work of HTP in September 2013, after the group <a href="https://krebsonsecurity.com/2013/09/data-broker-giants-hacked-by-id-theft-service/" target="_blank" rel="noopener">compromised servers inside data brokers LexisNexis, Kroll, and Dun &amp; Bradstreet</a>.</p>
<p>The group used the same ColdFusion flaws <a href="https://krebsonsecurity.com/2013/10/data-broker-hackers-also-compromised-nw3c/" target="_blank" rel="noopener">to break into the National White Collar Crime Center (NWC3)</a>, a non-profit that provides research and investigative support to the <strong>U.S. Federal Bureau of Investigation</strong> (FBI).</p>
<p>As KrebsOnSecurity reported at the time, this small ColdFusion botnet of data broker servers was being controlled by the same cybercriminals who&#8217;d assumed control over <strong>ssndob[.]ms</strong>, which operated one of the underground&#8217;s most reliable services for obtaining Social Security Number, dates of birth and credit file information on U.S. residents.</p>
<p>Multiple law enforcement sources told KrebsOnSecurity that Kivimäki was responsible for making <a href="http://www.forbes.com/sites/insertcoin/2014/08/24/sony-online-entertainment-presidents-flight-diverted-by-psn-hackers-bomb-threat/" target="_blank" rel="noopener">an August 2014 bomb threat</a> against former <strong>Sony Online Entertainment President John Smedley</strong> that grounded an American Airlines plane. That incident was widely reported to have started with a tweet from the Lizard Squad, but Smedley and others said it started with a call from Kivimäki.</p>
<p class="p1">Kivimäki also was involved in calling in multiple fake bomb threats and “swatting” incidents — reporting fake hostage situations at an address to prompt a heavily armed police response to that location.</p>
<p>Kivimäki&#8217;s apparent indifference to hiding his tracks drew the interest of Finnish and American cybercrime investigators, and soon Finnish prosecutors charged him with an array of cybercrime violations. At trial, prosecutors presented evidence showing he&#8217;d used stolen credit cards to buy luxury goods and shop vouchers, and participated in a money laundering scheme that he used to fund a trip to Mexico.</p>
<p>Kivimäki was ultimately convicted of orchestrating more than 50,000 cybercrimes. But largely because he was still a minor at the time (17) , he was given a 2-year suspended sentence and ordered to forfeit EUR 6,558.</p>
<p>As <a href="https://krebsonsecurity.com/2015/07/finnish-decision-is-win-for-internet-trolls/" target="_blank" rel="noopener">I wrote in 2015 following Kivimäki&#8217;s trial</a>:</p>
<blockquote><p>&#8220;The danger in such a decision is that it emboldens young malicious hackers by reinforcing the already popular notion that there are no consequences for cybercrimes committed by individuals under the age of 18.</p>
<p>Kivimäki is now crowing about the sentence; He’s changed the description on his Twitter profile to “Untouchable hacker god.” The Twitter account for the Lizard Squad tweeted the news of Kivimäki’s non-sentencing triumphantly: “All the people that said we would rot in prison don’t want to comprehend what we’ve been saying since the beginning, we have free passes.”</p></blockquote>
<p>Something tells me Kivimäki won&#8217;t get off so easily this time, assuming he is successfully extradited back to Finland. A statement by the Finnish police says they are seeking Kivimäki&#8217;s extradition and that they expect the process to go smoothly.</p>
<p>Kivimäki could not be reached for comment. But he has been <a href="https://www.reddit.com/user/AleksanteriKivimaki/" target="_blank" rel="noopener">discussing his case on Reddit</a> using his legal first name &#8212; <strong>Aleksanteri</strong> (he stopped using his middle name Julius when he moved abroad several years ago). In a post dated Jan. 31, 2022, Kivimäki responded to another Finnish-speaking Reddit user who said they were a fugitive from justice.</p>
<p>&#8220;Same thing,&#8221; Kivimäki replied. &#8220;Shall we start some kind of club? A support organization for wanted persons?&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=62568
title: KrebsOnSecurity in Upcoming Hulu Series on Ashley Madison Breach
uri: KrebsOnSecurity-in-Upcoming-Hulu-Series-on-Ashley-Madison-Breach
url:
https://krebsonsecurity.com/2023/02/krebsonsecurity-in-upcoming-hulu-series-on-ashley-madison-breach/

content:
<p>KrebsOnSecurity will likely have a decent amount of screen time in an upcoming <strong>Hulu</strong> documentary series about the 2015 megabreach at marital infidelity site <strong>Ashley Madison</strong>. While I can&#8217;t predict what the producers will do with the video interviews we shot, it&#8217;s fair to say the series will explore compelling new clues as to who may have been responsible for the attack.</p>
<p><img class="aligncenter wp-image-62593" src="media/fd6e442c.wrap-ashmadhulu.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/wrap-ashmadhulu.png" alt="" width="749" height="530" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/02/wrap-ashmadhulu.png 934w, https://krebsonsecurity.com/wp-content/uploads/2023/02/wrap-ashmadhulu-768x544.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/02/wrap-ashmadhulu-782x553.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/02/wrap-ashmadhulu-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The new docuseries produced by <strong>ABC News Studios</strong> and <strong>Wall to Wall Media</strong> is tentatively titled, &#8220;<em>The Ashley Madison Affair</em>,&#8221; and is slated for release on Hulu in late Spring 2023. Wall to Wall Media is part of the Warner Bros. International Television Production group.</p>
<p>&#8220;Featuring exclusive footage and untold firsthand interviews from those involved, the series will explore infidelity, morality, cyber-shaming and blackmail and tell the story of ordinary people with big secrets and a mystery that remains unsolved to this day,&#8221; reads a <a href="https://www.thewrap.com/ashley-madison-affair-hulu-original-docuseries-cheating-dating-website/" target="_blank" rel="noopener">Jan. 12, 2023 scoop</a> from <em>The Wrap</em>.</p>
<p>There are several other studios pursuing documentaries on the Ashley Madison breach, and it&#8217;s not hard to see why. On July 19, 2015, a hacker group calling itself The Impact Team leaked Ashley Madison internal company data, and announced it would leak all user data in a month unless Ashley Madison voluntarily shut down before then.</p>
<p>A month later, The Impact Team published more than 60 gigabytes of data, including user names, home addresses, search history, and credit card transaction records. The leak led to the public shaming and extortion of many Ashley Madison users, and to at least two suicides. It&#8217;s impossible to say how many users lost their jobs or marriages as a result of the breach.</p>
<p>I&#8217;m aware that there are multiple studios working on Ashley Madison documentaries because <a href="https://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/" target="_blank" rel="noopener">I broke the story of the breach in 2015</a>, and all of those production houses approached me with essentially the same pitch: It would be a shame if your voice wasn&#8217;t included in our project.</p>
<p>What stood out about the inquiry from Wall to Wall was that their researchers had already gathered piles of clues about the breach that I&#8217;d never seen before.</p>
<p>I&#8217;d assumed that participating in their documentary would involve sitting for a few interviews about known historical facts related to the breach. But when Wall to Wall shared what they&#8217;d found, I was hooked, and spent several weeks investigating those leads further.</p>
<p>The result was a collaborative research effort revealing key aspects of the breach that have somehow escaped public notice over the years.</p>
<p>I won&#8217;t go into detail on what we discovered until the Hulu series is ready for release. Also, I am not privy to what they will produce with the interviews I gave. I can&#8217;t say that what we found untangles everything about the breach that was previously unknown, but it sure explains a lot.</p>


feed_id: https://krebsonsecurity.com/?p=62610
title: U.S., U.K. Sanction 7 Men Tied to Trickbot Hacking Group
uri: U-S-U-K-Sanction-7-Men-Tied-to-Trickbot-Hacking-Group
url: https://krebsonsecurity.com/2023/02/u-s-u-k-sanction-7-men-tied-to-trickbot-hacking-group/
content:
<p>Authorities in the United States and United Kingdom today levied financial sanctions against seven men accused of operating &#8220;<strong>Trickbot</strong>,&#8221; a cybercrime-as-a-service platform based in Russia that has enabled countless ransomware attacks and bank account takeovers since its debut in 2016. The <strong>U.S. Department of the Treasury</strong> says the Trickbot group is associated with Russian intelligence services, and that this alliance led to the targeting of many U.S. companies and government entities.</p>
<p>Initially a stealthy trojan horse program delivered via email and used to steal passwords, Trickbot evolved into &#8220;a highly modular malware suite that provides the Trickbot Group with the ability to conduct a variety of illegal cyber activities, including ransomware attacks,&#8221; the Treasury Department said.</p>
<div id="attachment_53335" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53335" class=" wp-image-53335" src="media/7ca909a9.trickbotemail.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotemail.png" alt="" width="750" height="604" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotemail.png 950w, https://krebsonsecurity.com/wp-content/uploads/2020/10/trickbotemail-768x618.png 768w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-53335" class="wp-caption-text">A spam email from 2020 containing a Trickbot-infected attachment. Image: Microsoft.</p></div>
<p>&#8220;During the height of the COVID-19 pandemic in 2020, Trickbot targeted hospitals and healthcare centers, launching a wave of ransomware attacks against hospitals across the United States,&#8221; the <a href="https://home.treasury.gov/news/press-releases/jy1256" target="_blank" rel="noopener">sanctions notice</a> continued. &#8220;In one of these attacks, the Trickbot Group deployed ransomware against three Minnesota medical facilities, disrupting their computer networks and telephones, and causing a diversion of ambulances. Members of the Trickbot Group publicly gloated over the ease of targeting the medical facilities and the speed with which the ransoms were paid to the group.&#8221;</p>
<p>Only one of the men sanctioned today is known to have been criminally charged in connection with hacking activity. According to the Treasury Department, the alleged senior leader of the Trickbot group is 34-year-old Russian national <strong>Vitaly &#8220;Bentley&#8221; Kovalev</strong>.</p>
<p>A New Jersey grand jury indicted Kovalev in 2012 after an investigation by the <strong>U.S. Secret Service</strong> determined that he ran a massive &#8220;money mule&#8221; scheme, which used phony job offers to trick people into laundering money stolen from hacked small to mid-sized businesses in the United States. The 2012 indictment against Kovalev relates to cybercrimes he allegedly perpetrated prior to the creation of Trickbot.</p>
<h2>BOTNET, THE MOVIE</h2>
<p>In 2015, Kovalev reportedly began filming a movie in Russia about cybercrime called &#8220;<a href="https://en.kinorium.com/1482233/" target="_blank" rel="noopener">Botnet</a>.&#8221; According to <a href="https://www.forbes.ru/tekhnologii/312709-ochen-strannoe-kino-zachem-fsb-prikhodilo-v-kinokompaniyu-25-etazh" target="_blank" rel="noopener">a 2016 story</a> from <em>Forbes.ru</em>, Botnet&#8217;s opening scene was to depict the plight of <strong>Christina Svechinskaya</strong>, a Russian student <a href="https://krebsonsecurity.com/2010/09/u-s-charges-37-alleged-money-mules/" target="_blank" rel="noopener">arrested by FBI agents in September 2010</a>.</p>
<div id="attachment_62613" style="width: 295px" class="wp-caption alignright"><img aria-describedby="caption-attachment-62613" loading="lazy" class=" wp-image-62613" src="media/1a8490b0.Svechinskaya.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/Svechinskaya.png" alt="" width="285" height="388" /><p id="caption-attachment-62613" class="wp-caption-text">Christina Svechinskaya, a money mule hired by Bentley who was arrested by the FBI in 2010.</p></div>
<p>Svechinskaya was one of Bentley&#8217;s money mules, most of whom were young Russian students on temporary travel visas in the United States. She was among 37 alleged mules charged with aiding an international cybercrime operation &#8212; basically, setting up phony corporate bank accounts for the sole purpose of laundering stolen funds.</p>
<p>Although she possessed no real hacking skills, Svechinskaya&#8217;s mugshot and social media photos went viral online and she was quickly dubbed &#8220;the world&#8217;s sexiest computer hacker&#8221; by the tabloids.</p>
<p>Kovalev&#8217;s Botnet film project was disrupted after Russian authorities raided the film production company&#8217;s offices as part of a cybercrime investigation. In February 2016, <em>Reuters</em> <a href="https://www.reuters.com/article/us-cybercrime-russia-dyre-exclusive/exclusive-top-cybercrime-ring-disrupted-as-authorities-raid-moscow-offices-sources-idUSKCN0VE2QS" target="_blank" rel="noopener">reported</a> that the raid was connected to a crackdown on &#8220;<strong>Dyre</strong>,&#8221; a sophisticated trojan that U.S. federal investigators say was the precursor to the Trickbot malware. The Forbes.ru article cited sources close to the investigation who said the film studio was operating as a money-laundering front for the cybercrooks behind Dyre.<span id="more-62610"></span></p>
<h2>TREASON</h2>
<p>But shifting political winds in Russia would soon <a href="https://krebsonsecurity.com/2017/01/a-shakeup-in-russias-top-cybercrime-unit/" target="_blank" rel="noopener">bring high treason charges</a> against three of the Russian cybercrime investigators tied to the investigation into the film studio. In a major shakeup in 2017, the Kremlin <a href="https://krebsonsecurity.com/2017/01/a-shakeup-in-russias-top-cybercrime-unit/" target="_blank" rel="noopener">levied treason charges</a> against <strong>Sergey Mikhaylov</strong>, then deputy chief of Russia&#8217;s top anti-cybercrime unit.</p>
<p>Also charged with treason was <strong>Ruslan Stoyanov</strong>, then a senior employee at Russian security firm <strong>Kaspersky Lab</strong> [the Forbes.ru report from 2016 said investigators from Mikhaylov&#8217;s unit and Kaspersky Lab were present at the film company raid].</p>
<p>Russian media outlets have speculated that the men were accused of treason for helping American cybercrime investigators pursue top Russian hackers. However, the charges against both men were classified and have never been officially revealed. After their brief, closed trial, both men were convicted of treason. Mikhaylov was <a href="https://krebsonsecurity.com/2019/02/former-russian-cybersecurity-chief-sentenced-to-22-years-in-prison/" target="_blank" rel="noopener">given a 22 year prison sentence</a>; Stoyanov was sentenced to 14 years in prison.</p>
<p>In September 2021, the Kremlin issued treason charges against <strong>Ilya Sachkov</strong>, formerly head of the cybersecurity firm <strong>Group-IB</strong>. According to Reuters, Sachkov and his company were hired by the film studio &#8220;to advise the Botnet director and writers on the finer points of cybercrime.&#8221; Sachkov remains imprisoned in Russia <a href="https://www.rferl.org/a/russia-sachkov-treason-cybersecurity/31871716.html" target="_blank" rel="noopener">pending his treason trial</a>.</p>
<h2>A WELL-OILED CYBERCRIME MACHINE</h2>
<p>Trickbot was heavily used by <strong>Conti</strong> and <strong>Ryuk</strong>, two of Russia&#8217;s most ruthless and successful ransomware groups. Blockchain analysis firm <strong>Chainalysis</strong> estimates that in 2021 alone, Conti extorted more than USD $100 million from its hacking victims; Chainalysis estimates Ryuk extorted more than USD $150 million from its ransomware victims.</p>
<p>The U.S. cybersecurity firm <strong>CrowdStrike</strong> has long tracked the activities of Trickbot, Ryuk and Conti under the same moniker &#8212; &#8220;<strong>Wizard Spider</strong>&#8221; &#8212; which CrowdStrike describes as &#8220;a Russia-nexus cybercriminal group behind the core development and distribution of a sophisticated arsenal of criminal tools, that allow them to run multiple different types of operations.&#8221;</p>
<p>&#8220;CrowdStrike Intelligence has observed WIZARD SPIDER targeting multiple countries and industries such as academia, energy, financial services, government, and more,&#8221; said <strong>Adam Meyers</strong>, head of intelligence at CrowdStrike.</p>
<p>This is not the U.S. government&#8217;s first swipe at the Trickbot group. In early October 2020, KrebsOnSecurity <a href="https://krebsonsecurity.com/2020/10/attacks-aimed-at-disrupting-the-trickbot-botnet/" target="_blank" rel="noopener">broke the news</a> that someone had launched a series of coordinated attacks designed to disrupt the Trickbot botnet. A week later, <em>The Washington Post</em> <a href="https://www.washingtonpost.com/national-security/cyber-command-trickbot-disrupt/2020/10/09/19587aae-0a32-11eb-a166-dc429b380d10_story.html" target="_blank" rel="noopener">ran a story</a> saying the attack on Trickbot was the work of <strong>U.S. Cyber Command</strong>, a branch of the <strong>Department of Defense</strong> headed by the director of the <strong>U.S. National Security Agency</strong> (NSA).</p>
<p>Days after Russia invaded Ukraine in February 2022, a Ukrainian researcher <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">leaked several years of internal chat logs from the Conti ransomware gang</a>. Those candid conversations offer a fascinating view into the challenges of running a sprawling criminal enterprise with more than 100 salaried employees. They also showed that Conti enjoyed protection from prosecution by Russian authorities, as long as the hacker group took care not to target Russian organizations.</p>
<p>In addition, the leaked Conti chats confirmed there was considerable overlap in the operation and leadership of Conti, Trickbot and Ryuk.</p>
<p><strong>Michael DeBolt</strong>, chief intelligence officer at cybersecurity firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, said the leaked Conti chats showed Bentley oversaw a team of coders tasked with ensuring that the Trickbot and Conti malware remained undetected by the different antivirus and security software vendors.</p>
<p>In the years prior to the emergence of Trickbot in 2016, Bentley worked closely on the <a href="https://krebsonsecurity.com/2014/06/operation-tovar-targets-gameover-zeus-botnet-cryptolocker-scourge/" target="_blank" rel="noopener">Gameover ZeuS trojan</a>, a peer-to-peer malware threat that infected between 500,000 and a million computers with an automated ransomware strain called Cryptolocker, DeBolt said.</p>
<p>The FBI has a standing $3 million bounty offered for the capture of <strong>Evgeny &#8220;Slavik&#8221; Bogachev</strong>, the alleged author of the Zeus trojan. And there are indications that Bentley worked directly with Bogachev. DeBolt pointed to an October 2014 discussion on the exclusive Russian hacking forum Mazafaka that included a complaint by a Russian hosting firm against a forum user by the name &#8220;<strong>Ferrari</strong>&#8221; who had failed to pay a $30,000 hosting bill.</p>
<p>In that discussion thread, it emerged that the hosting company thought it was filing a complaint against Slavik. But the Mazafaka member who vouched for Ferrari&#8217;s membership on the forum said they knew Ferrari as Bentley the mule handler, and at some point Slavik and Bentley must have been sharing the Ferrari user account.</p>
<p>&#8220;It is likely that Slavik (aka. Bogachev) and Bentley (aka. Kovalev) shared the same &#8216;Ferrari&#8217; handle on the Mazafaka forum circa 2014, which suggests the two had a working relationship at that time, and supports the recent US and UK Government announcements regarding Kovalev&#8217;s past involvement in cybercrime predating Dyre or the Trickbot Group,&#8221; DeBolt said.</p>
<p>CrowdStrike&#8217;s Meyers said while Wizard Spider operations have significantly reduced following the demise of Conti in June 2022, today&#8217;s sanctions will likely cause temporary disruptions for the cybercriminal group while they look for ways to circumvent the financial restrictions &#8212; which make it illegal to transact with or hold the assets of sanctioned persons or entities.</p>
<p>&#8220;Often, when cybercriminal groups are disrupted, they will go dark for a time only to rebrand under a new name,&#8221; Meyers said.</p>
<p>The prosecution of Kovalev is being handled by the <a href="https://www.justice.gov/usao-nj/pr/russian-national-charged-bank-fraud-related-hacking-campaign" target="_blank" rel="noopener">U.S. Attorney&#8217;s Office in New Jersey</a>. A copy of the now-unsealed 2012 indictment of Kovalev is <a href="https://www.justice.gov/usao-nj/press-release/file/1568051/download" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=62660
title: Microsoft Patch Tuesday, February 2023 Edition
uri: Microsoft-Patch-Tuesday-February-2023-Edition
url: https://krebsonsecurity.com/2023/02/microsoft-patch-tuesday-february-2023-edition/
content:
<p><strong>Microsoft</strong> is sending the world a whole bunch of love today, in the form of patches to plug dozens of security holes in its <strong>Windows</strong> operating systems and other software. This year&#8217;s special Valentine&#8217;s Day Patch Tuesday includes fixes for a whopping three different &#8220;zero-day&#8221; vulnerabilities that are already being used in active attacks.</p>
<p><img class="aligncenter wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="750" height="528" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Microsoft&#8217;s security advisories are somewhat sparse with details about the zero-day bugs. Redmond flags <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23376" target="_blank" rel="noopener">CVE-2023-23376</a> as an &#8220;Important&#8221; elevation of privilege vulnerability in the <strong>Windows Common Log File System Driver</strong>, which is present in Windows 10 and 11 systems, as well as many server versions of Windows.</p>
<p>&#8220;Sadly, there’s just a little solid information about this privilege escalation,&#8221; said <strong>Dustin Childs</strong>, head of threat awareness at Trend Micro&#8217;s <strong>Zero Day Initiative</strong>. “Microsoft does note that the vulnerability would allow an attacker to exploit code as SYSTEM, which would allow them to completely take over a target. This is likely being chained with a remote code execution bug to spread malware or ransomware. Considering this was discovered by Microsoft’s Threat Intelligence Center, it could mean it was used by advanced threat actors. Either way, make sure you test and roll these fixes quickly.”</p>
<p>The zero-day <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21715" target="_blank" rel="noopener">CVE-2023-21715</a> is a weakness in <strong>Microsoft Office</strong> that Redmond describes as a &#8220;security feature bypass vulnerability.&#8221;</p>
<p>&#8220;Microsoft lists this as under active exploit, but they offer no info on how widespread these exploits may be,&#8221; Childs said. “Based on the write-up, it sounds more like a privilege escalation than a security feature bypass, but regardless, active attacks in a common enterprise application shouldn’t be ignored. It’s always alarming when a security feature is not just bypassed but exploited. Let’s hope the fix comprehensively addresses the problem.”</p>
<p>The third zero-day flaw already seeing exploitation is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823" target="_blank" rel="noopener">CVE-2023-21823</a>, which is another elevation of privilege weakness &#8212; this one in the <strong>Microsoft Windows Graphic</strong> component. Researchers at cybersecurity forensics firm <strong>Mandiant</strong> were credited with reporting the bug.</p>
<p><strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>, pointed out that the security bulletin for CVE-2023-21823 specifically calls out <strong>OneNote</strong> as being a vulnerable component for the vulnerability.</p>
<p>&#8220;In recent weeks, we have seen an increase in the use of OneNote files as part of <a href="https://www.bleepingcomputer.com/news/security/hackers-now-use-microsoft-onenote-attachments-to-spread-malware/" target="_blank" rel="noopener">targeted malware campaigns</a>,&#8221; Breen said. &#8220;Patches for this are delivered via the app stores and not through the typical formats, so it&#8217;s important to double check your organization&#8217;s policies.&#8221;<span id="more-62660"></span></p>
<p>Microsoft fixed another Office vulnerability in <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716" target="_blank" rel="noopener">CVE-2023-21716</a>, which is a <strong>Microsoft Word</strong> bug that can lead to remote code execution &#8212; even if a booby-trapped Word document is merely viewed in the preview pane of <strong>Microsoft Outlook</strong>. This security hole has a CVSS (severity) score of 9.8 out of a possible 10.</p>
<p>Microsoft also has more valentines for organizations that rely on <strong>Microsoft Exchange Server</strong> to handle email. Redmond patched three Exchange Server flaws (<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21706" target="_blank" rel="noopener">CVE-2023-21706</a>, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21707" target="_blank" rel="noopener">CVE-2023-21707</a>, and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529" target="_blank" rel="noopener">CVE-2023-21529</a>), all of which Microsoft says are remote code execution flaws that are likely to be exploited.</p>
<p>Microsoft said authentication is required to exploit these bugs, but then again threat groups that attack Exchange vulnerabilities also tend to phish targets for their Exchange credentials.</p>
<p>Microsoft isn&#8217;t alone in dropping fixes for scary, ill-described zero-day flaws. Apple on Feb. 13 released an update for iOS that <a href="https://arstechnica.com/gadgets/2023/02/actively-exploited-webkit-vulnerability-fixed-in-ios-16-3-1-macos-13-2-1-updates/" target="_blank" rel="noopener">resolves a zero-day vulnerability in Webkit</a>, Apple&#8217;s open source browser engine. <strong>Johannes Ullrich</strong> at the <strong>SANS Internet Storm Center</strong> notes that in addition to the WebKit problem, Apple fixed a privilege escalation issue. Both flaws are fixed in iOS 16.3.1.</p>
<p>&#8220;This privilege escalation issue could be used to escape the browser sandbox and gain full system access after executing code via the WebKit vulnerability,&#8221; Ullrich warned.</p>
<p>On a lighter note (hopefully), Microsoft drove the final nail in the coffin for <strong>Internet Explorer 11 (IE11)</strong>. According to Redmond, the out-of-support IE11 desktop application was permanently disabled on certain versions of Windows 10 on February 14, 2023 through a <strong>Microsoft Edge</strong> update.</p>
<p>&#8220;All remaining consumer and commercial devices that were not already redirected from IE11 to Microsoft Edge were redirected with the Microsoft Edge update. Users will be unable to reverse the change,&#8221; Microsoft <a href="https://techcommunity.microsoft.com/t5/windows-it-pro-blog/internet-explorer-11-desktop-app-retirement-faq/ba-p/2366549" target="_blank" rel="noopener">explained</a>. &#8220;Additionally, redirection from IE11 to Microsoft Edge will be included as part of all future Microsoft Edge updates. IE11 visual references, such as the IE11 icons on the Start Menu and taskbar, will be removed by the June 2023 Windows security update (“B” release) scheduled for June 13, 2023.&#8221;</p>
<p>For a more granular rundown on the updates released today, see <a href="https://isc.sans.edu/diary/Microsoft%20February%202023%20Patch%20Tuesday/29548" rel="noopener">the SANS Internet Storm Center roundup</a>. If today&#8217;s updates cause any stability or usability issues in Windows, AskWoody.com will likely have the lowdown on that.</p>
<p>Please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any problems as a result of these patches.</p>


feed_id: https://krebsonsecurity.com/?p=62561
title: New Protections for Food Benefits Stolen by Skimmers
uri: New-Protections-for-Food-Benefits-Stolen-by-Skimmers
url: https://krebsonsecurity.com/2023/02/new-protections-for-food-benefits-stolen-by-skimmers/
content:
<p>Millions of Americans receiving food assistance benefits just earned a new right that they can&#8217;t yet enforce: The right to be reimbursed if funds on their Electronic Benefit Transfer (EBT) cards are stolen by card skimming devices secretly installed at cash machines and grocery store checkout lanes.</p>
<p><img class="aligncenter  wp-image-62711" src="media/c6eb3372.ebtwelcome.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/ebtwelcome.jpg" alt="" width="751" height="501" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/02/ebtwelcome.jpg 1000w, https://krebsonsecurity.com/wp-content/uploads/2023/02/ebtwelcome-768x512.jpg 768w, https://krebsonsecurity.com/wp-content/uploads/2023/02/ebtwelcome-782x522.jpg 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>On December 29, 2022, <strong>President Biden</strong> signed into law the <strong>Consolidated Appropriations Act of 2023</strong>, which &#8212; for the first time ever &#8212; includes provisions for the replacement of stolen EBT benefits. This is a big deal because in 2022, organized crime groups <a href="https://krebsonsecurity.com/2022/10/how-card-skimming-disproportionally-affects-those-most-in-need/" target="_blank" rel="noopener">began massively targeting EBT accounts</a> &#8212; often emptying affected accounts at ATMs <a href="https://www.latimes.com/california/story/2023-02-08/ebt-fraud-la-county" target="_blank" rel="noopener">immediately after the states disperse funds each month</a>.</p>
<p>EBT cards can be used along with a personal identification number (PIN) to pay for goods at participating stores, and to withdraw cash from an ATM. However, EBT cards differ from debit cards issued to most Americans in two important ways. First, most states do not equip EBT cards with smart chip technology, which can make the cards more difficult and expensive for skimming thieves to clone.</p>
<p>More critically, EBT participants traditionally have had little hope of recovering food assistance funds when their cards were copied by card-skimming devices and used for fraud. That&#8217;s because while the EBT programs are operated by individually by the states, those programs are funded by the <strong>U.S. Department of Agriculture</strong> (USDA), which until late last year was barred from reimbursing states for stolen EBT funds.</p>
<p>The protections passed in the 2023 Appropriations Act allow states to use federal funds to replace stolen EBT benefits, and they permit states to seek reimbursement for any skimmed EBT funds they may have replaced from their own coffers (dating back to Oct. 1, 2022).</p>
<p>But first, all 50 states must each submit a plan for how they are going to protect and replace food benefits stolen via card skimming. Guidance for the states in drafting those plans was <a href="media/62494d2d.3.01.31-State-Plan-Guidance-Replacement-of-Stolen-Benefits-a.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/2023.01.31-State-Plan-Guidance-Replacement-of-Stolen-Benefits-a.pdf" target="_blank" rel="noopener">issued by the USDA on Jan. 31</a> (PDF), and states that don&#8217;t get them done before Feb. 27, 2023 risk losing the ability to be reimbursed for EBT fraud losses.</p>
<p><strong>Deborah Harris</strong> is a staff attorney at <strong>The Massachusetts Law Reform Institute</strong> (MLRI), a nonprofit legal assistance organization that has closely tracked the EBT skimming epidemic. In November 2022, the MLRI <a href="https://krebsonsecurity.com/2022/11/lawsuit-seeks-food-benefits-stolen-by-skimmers/" target="_blank" rel="noopener">filed a class-action lawsuit against Massachusetts</a> on behalf of thousands of low-income families who were collectively robbed of more than $1 million in food assistance benefits by card skimming devices secretly installed at cash machines and grocery store checkout lanes across the state.</p>
<p>Harris said she&#8217;s pleased that the USDA guidelines were issued so promptly, and that the guidance for states was not overly prescriptive. For example, some security experts have suggested that adding contactless capability to EBT cards could help participants avoid skimming devices altogether. But Harris said contactless cards do not require a PIN, which is the only thing that stops EBT cards from being drained at the ATM when a participant&#8217;s card is lost or stolen.</p>
<p>Then again, nothing in the guidance even mentions chip-based cards, or any other advice for improving the physical security of EBT cards. Rather, it suggests states should seek to develop the capability to perform basic fraud detection and alerting on suspicious transactions, such as when an EBT card that is normally used only in one geographic area suddenly is used to withdraw cash at an ATM halfway across the country.</p>
<p>&#8220;Besides having the states move fast to approve their plans, we&#8217;d also like to see a focused effort to move states from magstripe-only cards to chip, and also assisting states to develop the algorithms that will enable them to identify likely incidents of stolen benefits,&#8221; Harris said.</p>
<p>Harris said Massachusetts has begun using algorithms to look for these suspicious transaction patterns throughout its EBT network, and now has the ability to alert households and verify transactions. But she said most states do not have this capability.</p>
<p>&#8220;We have heard that other states aren&#8217;t currently able to do that,&#8221; Harris said. &#8220;But encouraging states to more affirmatively identify instances of likely theft and assisting with the claims and verification process is critical. Most households can&#8217;t do that on their own, and in Massachusetts it&#8217;s very hard for a person to get a copy of their transaction history. Some states can do that through third-party apps, but something so basic should not be on the burden of EBT households.&#8221;</p>
<p>Some states aren&#8217;t waiting for direction from the federal government to beef up EBT card security. Like Maryland, which identified more than 1,400 households hit by EBT skimming attacks last year &#8212; a tenfold increase over 2021.<span id="more-62561"></span></p>
<p>Advocates for EBT beneficiaries in Maryland are backing <a href="media/80040f36.sb0401f.pdf" data-original-source="https://mgaleg.maryland.gov/2023RS/bills/sb/sb0401f.pdf" target="_blank" rel="noopener">Senate Bill 401</a> (PDF), which would require the use of chip technology and ongoing monitoring for suspicious activity (a hearing on SB401 is scheduled in the Maryland Senate Finance Commission for Thursday, Feb. 23, at 1 p.m.).</p>
<p><strong>Michelle Salomon Madaio</strong> is a director at the <a href="https://www.hprplaw.org/" target="_blank" rel="noopener">Homeless Persons Representation Project</a>, a legal assistance organization based in Silver Spring, Md. Madaio said the bill would require the state Department of Human Services to replace skimmed benefits, not only after the bill goes into effect but also retroactively from January 2020 to the present.</p>
<p>Madaio said the bill also would require the state to monitor for patterns of suspicious activity on EBT cards, and to develop a mechanism to contact potentially affected households.</p>
<p>&#8220;For most of the skimming victims we&#8217;ve worked with, the fraudulent transactions would be pretty easy to spot because they mostly happened in the middle of the night or out of state, or both,&#8221; Madaio said. &#8220;To make matters worse, a lot of families whose benefits were scammed then incurred late fees on many other things as a result.&#8221;</p>
<p>It is not difficult to see why organized crime groups have pounced on EBT cards as easy money. In most traditional payment card transactions, there are usually several parties that have a financial interest in minimizing fraud and fraud losses, including the bank that issued the card, the card network (Visa, MasterCard, Discover, etc.), and the merchant.</p>
<p>But that infrastructure simply does not exist within state EBT programs, and it certainly isn&#8217;t a thing at the inter-state level. What that means is that the vast majority of EBT cards have zero fraud controls, which is exactly what continues to make them so appealing to thieves.</p>
<p>For now, the only fraud controls available to most EBT cardholders include being especially paranoid about where they use their cards, and frequently changing their PINs.</p>
<p>According to <a href="media/537536b6.usda-snapskim.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/11/usda-snapskim.png" target="_blank" rel="noopener">USDA guidance</a> issued prior to the passage of the appropriations act, EBT cardholders <em>should consider changing their card PIN at least once a month</em>.</p>
<p>&#8220;By changing PINs frequently, at least monthly, and doing so before benefit issuance dates, households can minimize their risk of stolen benefits from a previously skimmed EBT card,&#8221; the USDA advised.</p>


feed_id: https://krebsonsecurity.com/?p=62690
title: Who’s Behind the Botnet-Based Service BHProxies?
uri: Who-s-Behind-the-Botnet-Based-Service-BHProxies
url: https://krebsonsecurity.com/2023/02/whos-behind-the-botnet-based-service-bhproxies/
content:
<p>A security firm has discovered that a six-year-old crafty botnet known as <strong>Mylobot</strong> appears to be powering a residential proxy service called <strong>BHProxies</strong>, which offers paying customers the ability to route their web traffic anonymously through compromised computers. Here&#8217;s a closer look at Mylobot, and a deep dive into who may be responsible for operating the BHProxies service.</p>
<div id="attachment_62728" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62728" class=" wp-image-62728" src="media/52d1bcd9.bhproxies.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/bhproxies.png" alt="" width="749" height="579" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/02/bhproxies.png 1086w, https://krebsonsecurity.com/wp-content/uploads/2023/02/bhproxies-768x593.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/02/bhproxies-782x604.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-62728" class="wp-caption-text">The BHProxies website.</p></div>
<p>First identified in 2017 by the security firm <a href="https://www.deepinstinct.com/blog/meet-mylobot-a-new-highly-sophisticated-never-seen-before-botnet-thats-out-in-the-wild" target="_blank" rel="noopener">Deep Instinct</a>, Mylobot employs a number of fairly sophisticated methods to remain undetected on infected hosts, such as running exclusively in the computer&#8217;s temporary memory, and waiting 14 days before attempting to contact the botnet&#8217;s command and control servers.</p>
<p>Last year, researchers at <strong>Minerva Labs</strong> spotted the botnet <a href="https://minerva-labs.com/blog/mylobot-2022-so-many-evasive-techniques-just-to-send-extortion-emails/" target="_blank" rel="noopener">being used to blast out sextortion scams</a>. But according to <a href="https://www.bitsight.com/blog/mylobot-investigating-proxy-botnet" rel="noopener" target="_blank">a new report</a> from <strong>BitSight</strong>, the Mylobot botnet&#8217;s main functionality has always been about transforming the infected system into a proxy.</p>
<p>The Mylobot malware includes more than 1,000 hard-coded and encrypted domain names, any one of which can be registered and used as control networks for the infected hosts. BitSight researchers found significant overlap in the Internet addresses used by those domains and a domain called <strong>BHproxies[.]com</strong>.</p>
<p>BHProxies sells access to &#8220;residential proxy&#8221; networks, which allow someone to rent a residential IP address to use as a relay for their Internet communications, providing anonymity and the advantage of being perceived as a residential user surfing the web. The service is currently advertising access to more than 150,000 devices globally.</p>
<p>&#8220;At this point, we cannot prove that BHProxies is linked to Mylobot, but we have a strong suspicion,&#8221; wrote BitSight&#8217;s <strong>Stanislas Arnoud</strong>.</p>
<p>To test their hypothesis, BitSight obtained 50 proxies from BHProxies. The researchers were able to use 48 of those 50 proxies to browse to a website they controlled &#8212; allowing them to record the true IP addresses of each proxy device.</p>
<p>&#8220;Among these 48 recovered residential proxies IP addresses, 28 (58.3%) of those were already present in our sinkhole systems, associated with the Mylobot malware family,&#8221; Arnoud continued. &#8220;This number is probably higher, but we don&#8217;t have a full visibility of the botnet. This gave us clear evidence that Mylobot infected computers are used by the BHProxies service.&#8221;</p>
<p>BitSight said it is currently seeing more than 50,000 unique Mylobot infected systems every day, and that India appears to be the most targeted country, followed by the United States, Indonesia and Iran.</p>
<p>&#8220;We believe we are only seeing part of the full botnet, which may lead to more than 150,000 infected computers as advertised by BHProxies’ operators,&#8221; Arnoud wrote.</p>
<h2>WHO&#8217;S BEHIND BHPROXIES?</h2>
<p>The website BHProxies[.]com has been advertised for nearly a decade on the forum <strong>Black Hat World</strong> by the user <strong>BHProxies</strong>. BHProxies has authored 129 posts on Black Hat World since 2012, and their last post on the forum was in December 2022. </p>
<p>BHProxies initially was fairly active on Black Hat World between May and November 2012, after which it suddenly ceased all activity. The account didn&#8217;t resume posting on the forum until April 2014.</p>
<p>According to cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, the user BHProxies also used the handle &#8220;<strong>hassan_isabad_subar</strong>&#8221; and marketed various software tools, including &#8220;Subar&#8217;s free email creator&#8221; and &#8220;Subar&#8217;s free proxy scraper.&#8221; </p>
<p>Intel 471&#8217;s data shows that hassan_isabad_subar registered on the forum using the email address <strong>jesus.fn.christ@gmail.com</strong>. In a June 2012 private message exchange with a website developer on Black Hat World, hassan_isabad_subar confided that they were working at the time to develop two websites, including the now-defunct <strong>customscrabblejewelry.com</strong>.<span id="more-62690"></span></p>
<p><a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> reports that customscrabblejewelry.com was registered in 2012 to a <strong>Teresa Shotliff</strong> in Chesterland, Ohio. A search on jesus.fn.christ@gmail.com at <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a company that tracks compromised databases, shows this email address is tied to an account at the fundraising platform <strong>omaze.com,</strong> for a <strong>Brian Shotliff</strong> from Chesterland, Ohio.</p>
<p>Reached via LinkedIn, Mr. Shotliff said he sold his BHProxies account to another Black Hat World forum user from Egypt back in 2014. Shotliff shared an April 2014 password reset email from Black Hat World, which shows he forwarded the plaintext password to the email address <strong>legendboy2050@yahoo.com</strong>. He also shared a PayPal receipt and snippets of Facebook Messenger logs showing conversations in March 2014 with legendboy2050@yahoo.com.</p>
<p>Constella Intelligence confirmed that legendboy2050@yahoo.com was indeed another email address tied to the hassan_isabad_subar/BHProxies identity on Black Hat World. Constella also connects legendboy2050 to Facebook and Instagram accounts for one <strong>Abdala Tawfik</strong> from Cairo. This user&#8217;s <a href="https://www.facebook.com/abdala.tawfik/photos" target="_blank" rel="noopener">Facebook page</a> says Tawfik also uses the name <strong>Abdalla Khafagy</strong>.</p>
<p>Tawfik&#8217;s <a href="https://www.instagram.com/AbdalaTawfik/?fbclid=IwAR252TAYDV-MZRFSzTEzMBJ4xwNWziITiuAEylUuf2J5xhjhmzxGpoHRRDU" target="_blank" rel="noopener">Instagram account</a> says he is a former operations manager at the social media network <strong>TikTok</strong>, as well as a former director at <strong>Crypto.com</strong>.</p>
<p>Abdalla Khafagy&#8217;s <a href="https://www.linkedin.com/in/abdu-abdalla-khafagy-116635168/" target="_blank" rel="noopener">LinkedIn profile</a> says he was &#8220;global director of community&#8221; at Crypto.com for about a year ending in January 2022. Before that, the resume says he was operations manager of TikTok&#8217;s Middle East and North Africa region for approximately seven months ending in April 2020.</p>
<p>Khafagy&#8217;s LinkedIn profile says he is currently founder of <strong>LewkLabs</strong>, a Dubai-based &#8220;blockchain-powered, SocialFi content monetization platform&#8221; that <a href="https://www.globenewswire.com/news-release/2022/01/15/2367456/0/en/LEWK-Announces-Successful-Closing-Of-3-26M-Seed-Private-Sale.html" target="_blank" rel="noopener">last year reported funding of $3.26 million</a> from private investors.</p>
<p>The only experience listed for Khafagy prior to the TikTok job is labeled &#8220;Marketing&#8221; at &#8220;Confidential,&#8221; from February 2014 to October 2019. </p>
<p>Reached via LinkedIn, Mr. Khafagy told KrebsOnSecurity that he had a Black Hat World account at some point, but that he didn&#8217;t recall ever having used an account by the name BHProxies or hassan_isabad_subar. Khafagy said he couldn&#8217;t remember the name of the account he had on the forum.</p>
<p>&#8220;I had an account that was simply hacked from me shortly after and I never bothered about it because it wasn’t mine in the first place,&#8221; he explained.</p>
<p>Khafagy declined to elaborate on the five-year stint in his resume marked &#8220;Confidential.&#8221; When asked directly whether he had ever been associated with the BHProxies service, Mr. Khafagy said no. </p>
<p>That Confidential job listing is interesting because its start date lines up with the creation of BHproxies[.]com. Archive.org indexed its first copy of BHProxies[.]com <a href="https://web.archive.org/web/20140401000000*/bhproxies.com" target="_blank" rel="noopener">on Mar. 5, 2014</a>, but historic DNS records show BHproxies[.]com first came online Feb. 25, 2014.</p>
<p>Shortly after that conversation with Mr. Khafagy, Mr. Shotliff shared a Facebook/Meta message he received that indicated Mr. Khafagy wanted him to support the claim that the BHProxies account had somehow gone missing.</p>
<p>&#8220;Hey mate, it&#8217;s been a long time. Hope you are doing well. Someone from Krebs on Security reached out to me about the account I got from you on BHW,&#8221; Khafagy&#8217;s Meta account wrote. &#8220;Didn&#8217;t we try to retrieve this account? I remember mentioning to you that it got stolen and I was never able to retrieve it.&#8221;</p>
<p>Mr. Shotliff said Khafagy&#8217;s sudden message this week was the first time he&#8217;d heard that claim.</p>
<p>&#8220;He bought the account,&#8221; Shotliff said. &#8220;He might have lost the account or had it stolen, but it&#8217;s not something I remember.&#8221;</p>
<p>If you liked this story, you may also enjoy these other investigations into botnet-based proxy services:</p>
<p><a href="https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/" target="_blank" rel="noopener">A Deep Dive Into the Residential Proxy Service &#8216;911&#8217;</a><br />
<a href="https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/" target="_blank" rel="noopener">911 Proxy Service Implodes After Disclosing Breach</a><br />
<a href="https://krebsonsecurity.com/2022/06/meet-the-administrators-of-the-rsocks-proxy-botnet/" target="_blank" rel="noopener">Meet the Administrators of the RSOCKS Proxy Botnet</a><br />
<a href="https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/" target="_blank" rel="noopener">The Link Between AWM Proxy &amp; the Glupteba Botnet</a><br />
<a href="https://krebsonsecurity.com/2021/09/15-year-old-malware-proxy-network-vip72-goes-dark/" target="_blank" rel="noopener">15-Year-Old Malware Proxy Network VIP72 Goes Dark</a><br />
<a href="https://krebsonsecurity.com/2011/09/whos-behind-the-tdss-botnet/" target="_blank" rel="noopener">Who&#8217;s Behind the TDSS Botnet?</a></p>


feed_id: https://krebsonsecurity.com/?p=62835
title: When Low-Tech Hacks Cause High-Impact Breaches
uri: When-Low-Tech-Hacks-Cause-High-Impact-Breaches
url: https://krebsonsecurity.com/2023/02/when-low-tech-hacks-cause-high-impact-breaches/
content:
<p>Web hosting giant <strong>GoDaddy</strong> made headlines this month when it disclosed that a multi-year breach allowed intruders to steal company source code, siphon customer and employee login credentials, and foist malware on customer websites. Media coverage understandably focused on GoDaddy&#8217;s admission that it suffered three different cyberattacks over as many years at the hands of the same hacking group.  But it&#8217;s worth revisiting how this group typically got in to targeted companies: By calling employees and tricking them into navigating to a phishing website.</p>
<p><img class=" wp-image-45226 aligncenter" src="media/c61b924f.cell8.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/cell8.png" alt="" width="733" height="844" /></p>
<p>In <a href="https://www.sec.gov/ix?doc=/Archives/edgar/data/1609711/000160971123000031/gddy-20221231.htm" target="_blank" rel="noopener">a filing</a> with the <strong>U.S. Securities and Exchange Commission</strong> (SEC), GoDaddy said it determined that the same &#8220;sophisticated threat actor group&#8221; was responsible for three separate intrusions, including:</p>
<p><strong>-March 2020: </strong>A spear-phishing attack on a GoDaddy employee compromised the hosting login credentials of approximately 28,000 GoDaddy customers, as well as login credentials for a small number employees;</p>
<p><strong>-November 2021: </strong>A compromised GoDaddy password let attackers steal source code and information tied to 1.2 million customers, including website administrator passwords, sFTP credentials, and private SSL keys;</p>
<p><strong>-December 2022: </strong>Hackers gained access to and installed malware on GoDaddy&#8217;s cPanel hosting servers that &#8220;intermittently redirected random customer websites to malicious sites.&#8221;</p>
<p>&#8220;Based on our investigation, we believe these incidents are part of a multi-year campaign by a sophisticated threat actor group that, among other things, installed malware on our systems and obtained pieces of code related to some services within GoDaddy,&#8221; the company stated in its SEC filing.</p>
<p>What else do we know about the cause of these incidents? We don&#8217;t know much about the source of the November 2021 incident, other than GoDaddy&#8217;s statement that it involved a compromised password, and that it took about two months for the company to detect the intrusion. GoDaddy has not disclosed the source of the breach in December 2022 that led to malware on some customer websites.</p>
<p>But we do know the March 2020 attack was precipitated by <a href="https://krebsonsecurity.com/2020/03/phish-of-godaddy-employee-jeopardized-escrow-com-among-others/" target="_blank" rel="noopener">a spear-phishing attack against a GoDaddy employee</a>. GoDaddy described the incident at the time in general terms as a social engineering attack, but one of its customers affected by that March 2020 breach actually spoke to one of the hackers involved.</p>
<p>The hackers were able to change the Domain Name System (DNS) records for the transaction brokering site <strong>escrow.com</strong> so that it pointed to an address in Malaysia that was host to just a few other domains, including the then brand-new phishing domain <strong>servicenow-godaddy[.]com</strong>.</p>
<p>The general manager of Escrow.com found himself on the phone with one of the GoDaddy hackers, after someone who claimed they worked at GoDaddy called and said they needed him to authorize some changes to the account.</p>
<p>In reality, the caller had just tricked a GoDaddy employee into giving away their credentials, and he could see from the employee&#8217;s account that Escrow.com required a specific security procedure to complete a domain transfer.</p>
<p>The general manager of Escrow.com said he suspected the call was a scam, but decided to play along for about an hour &#8212; all the while recording the call and coaxing information out of the scammer.</p>
<p>&#8220;This guy had access to the notes, and knew the number to call,&#8221; to make changes to the account, the CEO of Escrow.com told KrebsOnSecurity. &#8220;He was literally reading off the tickets to the notes of the admin panel inside GoDaddy.&#8221;</p>
<p>About halfway through this conversation &#8212; after being called out by the general manager as an imposter &#8212; the hacker admitted that he was not a GoDaddy employee, and that he was in fact part of a group that enjoyed repeated success with social engineering employees at targeted companies over the phone.</p>
<p>Absent from GoDaddy&#8217;s SEC statement is another spate of attacks in November 2020, in which unknown intruders <a href="https://krebsonsecurity.com/2020/11/godaddy-employees-used-in-attacks-on-multiple-cryptocurrency-services/" target="_blank" rel="noopener">redirected email and web traffic for multiple cryptocurrency services</a> that used GoDaddy in some capacity.</p>
<p>It is possible this incident was not mentioned because it was the work of yet another group of intruders. But in response to questions from KrebsOnSecurity at the time, GoDaddy said that incident also stemmed from a &#8220;limited&#8221; number of GoDaddy employees falling for a sophisticated social engineering scam.<span id="more-62835"></span></p>
<p>&#8220;As threat actors become increasingly sophisticated and aggressive in their attacks, we are constantly educating employees about new tactics that might be used against them and adopting new security measures to prevent future attacks,&#8221; GoDaddy said in a written statement back in 2020.</p>
<p>Voice phishing or &#8220;vishing&#8221; attacks typically target employees who work remotely. The phishers will usually claim that they’re calling from the employer’s IT department, supposedly to help troubleshoot some issue. The goal is to convince the target to enter their credentials at a website set up by the attackers that mimics the organization’s corporate email or VPN portal.</p>
<p>Experts interviewed for an <a href="https://krebsonsecurity.com/2020/08/voice-phishers-targeting-corporate-vpns/" target="_blank" rel="noopener">August 2020 story on a steep rise in successful voice phishing attacks</a> said there are generally at least two people involved in each vishing scam: One who is social engineering the target over the phone, and another co-conspirator who takes any credentials entered at the phishing page &#8212; including multi-factor authentication codes shared by the victim &#8212; and quickly uses them to log in to the company&#8217;s website.</p>
<p>The attackers are usually careful to do nothing with the phishing domain until they are ready to initiate a vishing call to a potential victim. And when the attack or call is complete, they disable the website tied to the domain.</p>
<p>This is key because many domain registrars will only respond to external requests to take down a phishing website if the site is live at the time of the abuse complaint. This tactic also can stymie efforts by companies that focus on identifying newly-registered phishing domains before they can be used for fraud.</p>
<div id="attachment_28417" style="width: 310px" class="wp-caption alignright"><img aria-describedby="caption-attachment-28417" loading="lazy" class=" wp-image-28417" src="media/699f5ad0.yubikey.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey.png" alt="" width="300" height="365" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey.png 468w, https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey-285x346.png 285w" sizes="(max-width: 300px) 100vw, 300px" /><p id="caption-attachment-28417" class="wp-caption-text">A U2F device made by Yubikey.</p></div>
<p>GoDaddy&#8217;s latest SEC filing indicates the company had nearly 7,000 employees as of December 2022. In addition, GoDaddy contracts with another 3,000 people who work full-time for the company via business process outsourcing companies based primarily in India, the Philippines and Colombia.</p>
<p>Many companies now require employees to supply a one-time password &#8212; such as one sent via SMS or produced by a mobile authenticator app &#8212; in addition to their username and password when logging in to company assets online. But both SMS and app-based codes can be undermined by phishing attacks that simply request this information in addition to the user&#8217;s password.</p>
<p>One multifactor option — physical security keys — appears to be immune to these advanced scams. The most commonly used security keys are inexpensive USB-based devices. A security key implements a form of multi-factor authentication known as Universal 2nd Factor (U2F), which allows the user to complete the login process simply by inserting the USB device and pressing a button on the device. The key works without the need for any special software drivers.</p>
<p>The allure of U2F devices for multi-factor authentication is that even if an employee who has enrolled a security key for authentication tries to log in at an impostor site, the company’s systems simply refuse to request the security key if the user isn’t on their employer’s legitimate website, and the login attempt fails. Thus, the second factor cannot be phished, either over the phone or Internet.</p>
<p>In July 2018, Google <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">disclosed</a> that it had not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical security keys in place of one-time codes.</p>


feed_id: https://krebsonsecurity.com/?p=62757
title: Hackers Claim They Breached T-Mobile More Than 100 Times in 2022
uri: Hackers-Claim-They-Breached-T-Mobile-More-Than-100-Times-in-2022
url:
https://krebsonsecurity.com/2023/02/hackers-claim-they-breached-t-mobile-more-than-100-times-in-2022/

content:
<div id="attachment_62788" style="width: 999px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62788" class="size-full wp-image-62788" src="media/47e30de1.tmoblog.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoblog.png" alt="" width="989" height="656" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoblog.png 989w, https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoblog-768x509.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoblog-782x519.png 782w" sizes="(max-width: 989px) 100vw, 989px" /><p id="caption-attachment-62788" class="wp-caption-text">Image: Shutterstock.com</p></div>
<p>Three different cybercriminal groups claimed access to internal networks at communications giant <strong>T-Mobile </strong>in more than 100 separate incidents throughout 2022, new data suggests. In each case, the goal of the attackers was the same: Phish T-Mobile employees for access to internal company tools, and then convert that access into a cybercrime service that could be hired to divert <em>any</em> T-Mobile user&#8217;s text messages and phone calls to another device.</p>
<p>The conclusions above are based on an extensive analysis of <strong>Telegram</strong> chat logs from three distinct cybercrime groups or actors that have been identified by security researchers as particularly active in and effective at &#8220;<strong>SIM-swapping</strong>,&#8221; which involves temporarily seizing control over a target&#8217;s mobile phone number.</p>
<p>Countless websites and online services use SMS text messages for both password resets and multi-factor authentication. This means that stealing someone&#8217;s phone number often can let cybercriminals hijack the target&#8217;s entire digital life in short order &#8212; including access to any financial, email and social media accounts tied to that phone number.</p>
<p>All three SIM-swapping entities that were tracked for this story remain active in 2023, and they all conduct business in open channels on the instant messaging platform Telegram. KrebsOnSecurity is not naming those channels or groups here because they will simply migrate to more private servers if exposed publicly, and for now those servers remain a useful source of intelligence about their activities.</p>
<p>Each advertises their claimed access to T-Mobile systems in a similar way. At a minimum, every SIM-swapping opportunity is announced with a brief &#8220;<em>Tmobile up!&#8221;</em> or &#8220;<em>Tmo up!</em>&#8221; message to channel participants. Other information in the announcements includes the price for a single SIM-swap request, and the handle of the person who takes the payment and information about the targeted subscriber.</p>
<p>The information required from the customer of the SIM-swapping service includes the target&#8217;s phone number, and <a href="https://www.hologram.io/blog/whats-an-iccid-number-and-why-does-it-matter-for-cellular-iot/" target="_blank" rel="noopener">the serial number</a> tied to the new SIM card that will be used to receive text messages and phone calls from the hijacked phone number.</p>
<p>Initially, the goal of this project was to count how many times each entity claimed access to T-Mobile throughout 2022, by cataloging the various &#8220;Tmo up!&#8221; posts from each day and working backwards from Dec. 31, 2022.</p>
<p>But by the time we got to claims made in the middle of May 2022, completing the rest of the year&#8217;s timeline seemed unnecessary. The tally shows that in the last seven-and-a-half months of 2022, these groups collectively made SIM-swapping claims against T-Mobile on 104 separate days &#8212; often with multiple groups claiming access on the same days.</p>
<div id="attachment_62772" style="width: 761px" class="wp-caption aligncenter"><a href="media/7f2341ca.tmoup.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoup.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-62772" loading="lazy" class="wp-image-62772" src="media/7f2341ca.tmoup.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoup.png" alt="" width="751" height="578" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoup.png 931w, https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoup-768x591.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/02/tmoup-782x602.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-62772" class="wp-caption-text">The 104 days in the latter half of 2022 in which different known SIM-swapping groups claimed access to T-Mobile employee tools.</p></div>
<p>KrebsOnSecurity shared a large amount of data gathered for this story with T-Mobile. The company declined to confirm or deny any of these claimed intrusions. But in a written statement, T-Mobile said this type of activity affects the entire wireless industry.</p>
<p>&#8220;And we are constantly working to fight against it,&#8221; the statement reads. &#8220;We have continued to drive enhancements that further protect against unauthorized access, including enhancing multi-factor authentication controls, hardening environments, limiting access to data, apps or services, and more. We are also focused on gathering threat intelligence data, like what you have shared, to help further strengthen these ongoing efforts.&#8221;</p>
<h2>TMO UP!</h2>
<p>While it is true that each of these cybercriminal actors periodically offer SIM-swapping services for other mobile phone providers &#8212; including <strong>AT&amp;T</strong>, <strong>Verizon</strong> and smaller carriers &#8212; those solicitations appear <em>far</em> less frequently in these group chats than T-Mobile swap offers. And when those offers do materialize, they are considerably more expensive.</p>
<p>The prices advertised for a SIM-swap against T-Mobile customers in the latter half of 2022 ranged between USD $1,000 and $1,500, while SIM-swaps offered against AT&amp;T and Verizon customers often cost well more than twice that amount.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-62880" src="media/e72d1082.mobiletheft.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/02/mobiletheft.png" alt="" width="707" height="369" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/02/mobiletheft.png 707w, https://krebsonsecurity.com/wp-content/uploads/2023/02/mobiletheft-267x140.png 267w" sizes="(max-width: 707px) 100vw, 707px" /></p>
<p>To be clear, KrebsOnSecurity is not aware of specific SIM-swapping incidents tied to any of these breach claims. However, the vast majority of advertisements for SIM-swapping claims against T-Mobile tracked in this story had two things in common that set them apart from random SIM-swapping ads on Telegram.</p>
<p>First, they included an offer to use a mutually trusted &#8220;middleman&#8221; or escrow provider for the transaction (to protect either party from getting scammed). More importantly, the cybercriminal handles that were posting ads for SIM-swapping opportunities from these groups generally did so on a daily or near-daily basis &#8212; often teasing their upcoming swap events in the hours before posting a &#8220;Tmo up!&#8221; message announcement.</p>
<p>In other words, if the crooks offering these SIM-swapping services were ripping off their customers or claiming to have access that they didn&#8217;t, this would be almost immediately obvious from the responses of the more seasoned and serious cybercriminals in the same chat channel.</p>
<p>There are plenty of people on Telegram claiming to have SIM-swap access at major telecommunications firms, but a great many such offers are simply four-figure scams, and any pretenders on this front are soon identified and banned (<a href="https://krebsonsecurity.com/2022/09/violence-as-a-service-brickings-firebombings-shootings-for-hire/" target="_blank" rel="noopener">if not worse</a>).</p>
<p>One of the groups that reliably posted &#8220;Tmo up!&#8221; messages to announce SIM-swap availability against T-Mobile customers also reliably posted &#8220;Tmo down!&#8221; follow-up messages announcing exactly when their claimed access to T-Mobile employee tools was discovered and revoked by the mobile giant.</p>
<p>A review of the timestamps associated with this group&#8217;s incessant &#8220;Tmo up&#8221; and &#8220;Tmo down&#8221; posts indicates that while their claimed access to employee tools usually lasted less than an hour, in some cases that access apparently went undiscovered for several hours or even days.<span id="more-62757"></span></p>
<h2>TMO TOOLS</h2>
<p>How could these SIM-swapping groups be gaining access to T-Mobile&#8217;s network as frequently as they claim? Peppered throughout the daily chit-chat on their Telegram channels are solicitations for people urgently needed to serve as &#8220;callers,&#8221; or those who can be hired to social engineer employees over the phone into navigating to a phishing website and entering their employee credentials.</p>
<p><strong>Allison Nixon </strong>is chief research officer for the New York City-based cybersecurity firm <a href="https://unit221b.com" target="_blank" rel="noopener">Unit 221B</a>. Nixon said these SIM-swapping groups will typically call employees on their mobile devices, pretend to be someone from the company&#8217;s IT department, and then try to get the person on the other end of the line to visit a phishing website that mimics the company&#8217;s employee login page.</p>
<p>Nixon argues that many people in the security community tend to discount the threat from voice phishing attacks as somehow &#8220;low tech&#8221; and &#8220;low probability&#8221; threats.</p>
<p>&#8220;I see it as not low-tech at all, because there are a lot of moving parts to phishing these days,&#8221; Nixon said. &#8220;You have the caller who has the employee on the line, and the person operating the phish kit who needs to spin it up and down fast enough so that it doesn&#8217;t get flagged by security companies. Then they have to get the employee on that phishing site and steal their credentials.&#8221;</p>
<p>In addition, she said, often there will be yet another co-conspirator whose job it is to use the stolen credentials and log into employee tools. That person may also need to figure out how to make their device pass &#8220;posture checks,&#8221; a form of device authentication that some companies use to verify that each login is coming only from employee-issued phones or laptops.</p>
<p>For aspiring criminals with little experience in scam calling, there are plenty of sample call transcripts available on these Telegram chat channels that walk one through how to impersonate an IT technician at the targeted company &#8212; and how to respond to pushback or skepticism from the employee. Here&#8217;s a snippet from one such tutorial that appeared recently in one of the SIM-swapping channels:</p>
<blockquote><p>&#8220;Hello this is James calling from Metro IT department, how&#8217;s your day today?&#8221;</p>
<p>(yea im doing good, how r u)</p>
<p>i&#8217;m doing great, thank you for asking</p>
<p>i&#8217;m calling in regards to a ticket we got last week from you guys, saying you guys were having issues with the network connectivity which also interfered with [Microsoft] Edge, not letting you sign in or disconnecting you randomly. We haven&#8217;t received any updates to this ticket ever since it was created so that&#8217;s why I&#8217;m calling in just to see if there&#8217;s still an issue or not&#8230;.&#8221;</p></blockquote>
<h2>TMO DOWN!</h2>
<p>The TMO UP data referenced above, combined with comments from the SIM-swappers themselves, indicate that while many of their claimed accesses to T-Mobile tools in the middle of 2022 lasted hours on end, both the frequency and duration of these events began to steadily decrease as the year wore on.</p>
<p><img loading="lazy" class="aligncenter  wp-image-45224" src="media/57d2a628.phonescam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/phonescam.png" alt="" width="751" height="473" /></p>
<p>T-Mobile declined to discuss what it may have done to combat these apparent intrusions last year. However, one of the groups began to complain loudly in late October 2022 that T-Mobile must have been doing something that was causing their phished access to employee tools to die very soon after they obtained it.</p>
<p>One group even remarked that they suspected T-Mobile&#8217;s security team had begun monitoring their chats.</p>
<p>Indeed, the timestamps associated with one group&#8217;s TMO UP/TMO DOWN notices show that their claimed access was often limited to less than 15 minutes throughout November and December of 2022.</p>
<p>Whatever the reason, the calendar graphic above clearly shows that the frequency of claimed access to T-Mobile decreased significantly across all three SIM-swapping groups in the waning weeks of 2022.</p>
<h2>SECURITY KEYS</h2>
<p>T-Mobile US reported revenues of nearly $80 billion last year. It currently employs more than 71,000 people in the United States, any one of whom can be a target for these phishers.</p>
<p>T-Mobile declined to answer questions about what it may be doing to beef up employee authentication. But <strong>Nicholas Weaver</strong>, a researcher and lecturer at University of California, Berkeley&#8217;s <a href="https://www.icsi.berkeley.edu/icsi/" target="_blank" rel="noopener">International Computer Science Institute</a>, said T-Mobile and all the major wireless providers should be requiring employees to use physical security keys for that second factor when logging into company resources.</p>
<div id="attachment_28417" style="width: 269px" class="wp-caption alignright"><img aria-describedby="caption-attachment-28417" loading="lazy" class=" wp-image-28417" src="media/52411418.yubikey-285x346.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey-285x346.png" alt="" width="259" height="314" srcset="https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey-285x346.png 285w, https://krebsonsecurity.com/wp-content/uploads/2014/10/yubikey.png 468w" sizes="(max-width: 259px) 100vw, 259px" /><p id="caption-attachment-28417" class="wp-caption-text">A U2F device made by Yubikey.</p></div>
<p>&#8220;These breaches should not happen,&#8221; Weaver said. &#8220;Because T-Mobile should have long ago issued all employees security keys and switched to security keys for the second factor. And because security keys provably block this style of attack.&#8221;</p>
<p>The most commonly used security keys are inexpensive USB-based devices. A security key implements a form of multi-factor authentication known as Universal 2nd Factor (U2F), which allows the user to complete the login process simply by inserting the USB key and pressing a button on the device. The key works without the need for any special software drivers.</p>
<p>The allure of U2F devices for multi-factor authentication is that even if an employee who has enrolled a security key for authentication tries to log in at an impostor site, the company’s systems simply refuse to request the security key if the user isn’t on their employer’s legitimate website, and the login attempt fails. Thus, the second factor cannot be phished, either over the phone or Internet.</p>
<h2>THE ROLE OF MINORS IN SIM-SWAPPING</h2>
<p>Nixon said one confounding aspect of SIM-swapping is that these criminal groups tend to recruit teenagers to do their dirty work.</p>
<p>&#8220;A huge reason this problem has been allowed to spiral out of control is because children play such a prominent role in this form of breach,&#8221; Nixon said.</p>
<p>Nixon said SIM-swapping groups often advertise low-level jobs on places like <strong>Roblox</strong> and <strong>Minecraft</strong>, online games that are extremely popular with young adolescent males.</p>
<p>&#8220;Statistically speaking, that kind of recruiting is going to produce a lot of people who are underage,&#8221; she said. &#8220;They recruit children because they&#8217;re naive, you can get more out of them, and they have legal protections that other people over 18 don&#8217;t have.&#8221;</p>
<p>For example, she said, even when underage SIM-swappers are arrested, the offenders tend to go right back to committing the same crimes as soon as they&#8217;re released.</p>
<p>In January 2023, T-Mobile <a href="https://krebsonsecurity.com/2023/01/new-t-mobile-breach-affects-37-million-accounts/" target="_blank" rel="noopener">disclosed</a> that a &#8220;bad actor&#8221; stole records on roughly 37 million current customers, including their name, billing address, email, phone number, date of birth, and T-Mobile account number.</p>
<p>In August 2021, T-Mobile acknowledged that hackers made off with the names, dates of birth, Social Security numbers and driver’s license/ID information on more than 40 million current, former or prospective customers who applied for credit with the company. That breach came to light after <a href="https://krebsonsecurity.com/2021/08/t-mobile-breach-exposed-ssn-dob-of-40m-people/" target="_blank" rel="noopener">a hacker began selling the records on a cybercrime forum</a>.</p>
<p>In the shadow of such mega-breaches, any damage from the continuous attacks by these SIM-swapping groups can seem insignificant by comparison. But Nixon says it&#8217;s a mistake to dismiss SIM-swapping as a low volume problem.</p>
<p>&#8220;Logistically, you may only be able to get a few dozen or a hundred SIM-swaps in a day, but you can pick <em>any</em> customer you want across their entire customer base,&#8221; she said. &#8220;Just because a targeted account takeover is low volume doesn&#8217;t mean it&#8217;s low risk. These guys have crews that go and identify people who are high net worth individuals and who have a lot to lose.&#8221;</p>
<p>Nixon said another aspect of SIM-swapping that causes cybersecurity defenders to dismiss the threat from these groups is the perception that they are full of low-skilled &#8220;script kiddies,&#8221; a derisive term used to describe novice hackers who rely mainly on point-and-click hacking tools.</p>
<p>&#8220;They underestimate these actors and say this person isn&#8217;t technically sophisticated,&#8221; she said. &#8220;But if you&#8217;re rolling around in millions worth of stolen crypto currency, you can buy that sophistication. I know for a fact some of these compromises were at the hands of these &#8216;script kiddies,&#8217; but they&#8217;re not ripping off other people&#8217;s scripts so much as hiring people to make scripts for them. And they don&#8217;t care what gets the job done, as long as they get to steal the money.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=62912
title: Highlights from the New U.S. Cybersecurity Strategy
uri: Highlights-from-the-New-U-S-Cybersecurity-Strategy
url: https://krebsonsecurity.com/2023/03/highlights-from-the-new-u-s-cybersecurity-strategy/
content:
<p>The Biden administration today issued its vision for beefing up the nation&#8217;s collective cybersecurity posture, including calls for legislation establishing liability for software products and services that are sold with little regard for security. The White House&#8217;s new national cybersecurity strategy also envisions a more active role by cloud providers and the U.S. military in disrupting cybercriminal infrastructure, and it names China as the single biggest cyber threat to U.S. interests.</p>
<p><img class="aligncenter size-full wp-image-62928" src="media/d853dd26.nationalcyberstrategy2023.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/nationalcyberstrategy2023.png" alt="" width="694" height="311" /></p>
<p>The strategy says the White House will work with Congress and the private sector to develop legislation that would prevent companies from disavowing responsibility for the security of their software products or services.</p>
<p>Coupled with this stick would be a carrot: An as-yet-undefined &#8220;safe harbor framework&#8221; that would lay out what these companies could do to demonstrate that they are making cybersecurity a central concern of their design and operations.</p>
<p>&#8220;Any such legislation should prevent manufacturers and software publishers with market power from fully disclaiming liability by contract, and establish higher standards of care for software in specific high-risk scenarios,&#8221; the strategy explains. &#8220;To begin to shape standards of care for secure software development, the Administration will drive the development of an adaptable safe harbor framework to shield from liability companies that securely develop and maintain their software products and services.&#8221;</p>
<p><strong>Brian Fox</strong>, chief technology officer and founder of the software supply chain security firm <a href="https://www.sonatype.com" target="_blank" rel="noopener">Sonatype</a>, called the software liability push a landmark moment for the industry.</p>
<p>&#8220;Market forces are leading to a race to the bottom in certain industries, while contract law allows software vendors of all kinds to shield themselves from liability,&#8221; Fox said. &#8220;Regulations for other industries went through a similar transformation, and we saw a positive result &#8212; there&#8217;s now an expectation of appropriate due care, and accountability for those who fail to comply. Establishing the concept of safe harbors allows the industry to mature incrementally, leveling up security best practices in order to retain a liability shield, versus calling for sweeping reform and unrealistic outcomes as previous regulatory attempts have.&#8221;</p>
<h2>THE MOST ACTIVE, PERSISTENT THREAT</h2>
<p>In 2012 (approximately three national cyber strategies ago), then director of the U.S. National Security Agency (NSA) <strong>Keith Alexander</strong> made headlines when he remarked that years of successful cyber espionage campaigns from Chinese state-sponsored hackers represented &#8220;the greatest transfer of wealth in history.&#8221;</p>
<p>The document released today says the People’s Republic of China (PRC) &#8220;now presents the broadest, most active, and most persistent threat to both government and private sector networks,&#8221; and says China is &#8220;the only country with both the intent to reshape the international order and, increasingly, the economic, diplomatic, military, and technological power to do so.&#8221;</p>
<p>Many of the U.S. government&#8217;s efforts to restrain China&#8217;s technology prowess involve ongoing initiatives like the CHIPS Act, a new law signed by President Biden last year that <a href="https://www.nytimes.com/2022/09/06/business/economy/biden-tech-chips.html" target="_blank" rel="noopener">sets aside more than $50 billion to expand U.S.-based semiconductor manufacturing and research</a> and to make the U.S. less dependent on foreign suppliers; the <a href="https://www.ai.gov/" target="_blank" rel="noopener">National Artificial Intelligence Initiative</a>; and the <a href="https://ntia.gov/other-publication/national-strategy-secure-5g-implementation-plan" target="_blank" rel="noopener">National Strategy to Secure 5G</a>.</p>
<p>As the maker of most consumer gizmos with a computer chip inside, China is also the source of an incredible number of low-cost Internet of Things (IoT) devices that are not only poorly secured, but are probably more accurately described as <a href="https://krebsonsecurity.com/2016/10/who-makes-the-iot-things-under-attack/" target="_blank" rel="noopener">insecure by design</a>.</p>
<p>The Biden administration said it would continue its previously announced plans <a href="https://www.nist.gov/itl/executive-order-14028-improving-nations-cybersecurity/cybersecurity-labeling-consumers-0" target="_blank" rel="noopener">to develop a system of labeling that could be applied to various IoT products</a> and give consumers some idea of how secure the products may be. But it remains unclear how those labels might apply to products made by companies outside of the United States.<span id="more-62912"></span></p>
<h2>FIGHTING BADNESS IN THE CLOUD</h2>
<p>One could convincingly make the case that the world has witnessed yet another historic transfer of wealth and trade secrets over the past decade &#8212; in the form of ransomware and data ransom attacks by Russia-based cybercriminal syndicates, as well as Russian intelligence agency operations like <a href="https://krebsonsecurity.com/tag/solarwinds-breach/" target="_blank" rel="noopener">the U.S. government-wide Solar Winds compromise</a>.</p>
<p><img loading="lazy" class="aligncenter wp-image-48090" src="media/52678f94.cloudrain.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2019/06/cloudrain.jpg" alt="" width="714" height="447" /></p>
<p>On the ransomware front, the White House strategy seems to focus heavily on building the capability to disrupt the digital infrastructure used by adversaries that are threatening vital U.S. cyber interests. The document points to <a href="https://krebsonsecurity.com/2021/01/international-action-targets-emotet-crimeware/" target="_blank" rel="noopener">the 2021 takedown of the Emotet botnet</a> &#8212; a cybercrime machine that was heavily used by multiple Russian ransomware groups &#8212; as a model for this activity, but says those disruptive operations need to happen faster and more often.</p>
<p>To that end, the Biden administration says it will expand the capacity of the <a href="https://en.wikipedia.org/wiki/National_Cyber_Investigative_Joint_Task_Force" target="_blank" rel="noopener">National Cyber Investigative Joint Task Force</a> (NCIJTF), the primary federal agency for coordinating cyber threat investigations across law enforcement agencies, the intelligence community, and the Department of Defense.</p>
<p>&#8220;To increase the volume and speed of these integrated disruption campaigns, the Federal Government must further develop technological and organizational platforms that enable continuous, coordinated operations,&#8221; the strategy observes. &#8220;The NCIJTF will expand its capacity to coordinate takedown and disruption campaigns with greater speed, scale, and frequency. Similarly, DoD and the Intelligence Community are committed to bringing to bear their full range of complementary authorities to disruption campaigns.&#8221;</p>
<p>The strategy anticipates the U.S. government working more closely with cloud and other Internet infrastructure providers to quickly identify malicious use of U.S.-based infrastructure, share reports of malicious use with the government, and make it easier for victims to report abuse of these systems.</p>
<p>&#8220;Given the interest of the cybersecurity community and digital infrastructure owners and operators in continuing this approach, we must sustain and expand upon this model so that collaborative disruption operations can be carried out on a continuous basis,&#8221; the strategy argues. &#8220;Threat specific collaboration should take the form of nimble, temporary cells, comprised of a small number of trusted operators, hosted and supported by a relevant hub. Using virtual collaboration platforms, members of the cell would share information bidirectionally and work rapidly to disrupt adversaries.&#8221;</p>
<p>But here, again, there is a carrot-and-stick approach: The administration said it is taking steps to implement <a href="https://www.federalregister.gov/documents/2021/01/25/2021-01714/taking-additional-steps-to-address-the-national-emergency-with-respect-to-significant-malicious" target="_blank" rel="noopener">Executive Order (EO) 13984</a> &#8211;issued by the Trump administration in January 2021 &#8212; which requires cloud providers to verify the identity of foreign persons using their services.</p>
<p>&#8220;All service providers must make reasonable attempts to secure the use of their infrastructure against abuse or other criminal behavior,&#8221; the strategy states. &#8220;The Administration will prioritize adoption and enforcement of a risk-based approach to cybersecurity across Infrastructure-as-a-Service providers that addresses known methods and indicators of malicious activity including through implementation of EO 13984.&#8221;</p>
<p><strong>Ted Schlein</strong>, founding partner of the cybersecurity venture capital firm <a href="https://ballisticventures.com/" target="_blank" rel="noopener">Ballistic Ventures</a>, said how this gets implemented will determine whether it can be effective.</p>
<p>&#8220;Adversaries know the NSA, which is the elite portion of the nation’s cyber defense, cannot monitor U.S.-based infrastructure, so they just use U.S.-based cloud infrastructure to perpetrate their attacks,&#8221; Schlein said. &#8220;We have to fix this. I believe some of this section is a bit pollyannaish, as it assumes a bad actor with a desire to do a bad thing will self-identify themselves, as the major recommendation here is around KYC (‘know your customer’).”</p>
<h2>INSURING THE INSURERS</h2>
<p>One brief but interesting section of the strategy titled &#8220;Explore a Federal Cyber Insurance Backdrop&#8221; contemplates the government&#8217;s liability and response to a too-big-to-fail scenario or &#8220;catastrophic cyber incident.&#8221;</p>
<p>&#8220;We will explore how the government can stabilize insurance markets against catastrophic risk to drive better cybersecurity practices and to provide market certainty when catastrophic events do occur,&#8221; the strategy reads.</p>
<p>When the Bush administration released the first U.S. national cybersecurity strategy 20 years ago after the 9/11 attacks, the popular term for that same scenario was a &#8220;digital Pearl Harbor,&#8221; and there was a great deal of talk then about <a href="https://www.washingtonpost.com/archive/business/2004/12/08/tougher-cyber-security-measures-urged/486553db-5e09-4bfb-96c1-cd4ab9105724/" target="_blank" rel="noopener">how the cyber insurance market would soon help companies shore up their cybersecurity practices</a>.</p>
<p>In the wake of countless ransomware intrusions, many companies now hold cybersecurity insurance to help cover the considerable costs of responding to such intrusions. Leaving aside the question of whether insurance coverage has helped companies improve security, what happens if every one of these companies has to make a claim at the same time?</p>
<p>The notion of a Digital Pearl Harbor incident struck many experts at the time as a hyperbolic justification for expanding the government&#8217;s digital surveillance capabilities, and an overstatement of the capabilities of our adversaries. But back in 2003, most of the world&#8217;s companies didn&#8217;t host their entire business in the cloud.</p>
<p>Today, nobody questions the capabilities, goals and outcomes of dozens of nation-state level cyber adversaries. And these days, a catastrophic cyber incident could be little more than an extended, simultaneous outage at multiple cloud providers.</p>
<p>The full national cybersecurity strategy is available from <a href="media/c066730d.National-Cybersecurity-Strategy-2023.pdf" data-original-source="https://www.whitehouse.gov/wp-content/uploads/2023/03/National-Cybersecurity-Strategy-2023.pdf" target="_blank" rel="noopener">the White House website</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=62953
title: Sued by Meta, Freenom Halts Domain Registrations
uri: Sued-by-Meta-Freenom-Halts-Domain-Registrations
url: https://krebsonsecurity.com/2023/03/sued-by-meta-freenom-halts-domain-registrations/
content:
<p>The domain name registrar <strong>Freenom</strong>, whose free domain names have long been a draw for spammers and phishers, has stopped allowing new domain name registrations. The move comes just days after the Dutch registrar was sued by <strong>Meta</strong>, which alleges the company ignores abuse complaints about phishing websites while monetizing traffic to those abusive domains.</p>
<div id="attachment_62960" style="width: 760px" class="wp-caption aligncenter"><a href="media/be406a36.freenomsuspend.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/freenomsuspend.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-62960" class="wp-image-62960 " src="media/be406a36.freenomsuspend.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/freenomsuspend.png" alt="" width="750" height="397" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/freenomsuspend.png 1458w, https://krebsonsecurity.com/wp-content/uploads/2023/03/freenomsuspend-768x407.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/03/freenomsuspend-782x414.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/03/freenomsuspend-267x140.png 267w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-62960" class="wp-caption-text">Freenom&#8217;s website features a message saying it is not currently allowing new registrations.</p></div>
<p>Freenom is the domain name registry service provider for five so-called &#8220;country code top level domains&#8221; (ccTLDs), including <strong>.cf</strong> for the Central African Republic; <strong>.ga</strong> for Gabon; <strong>.gq</strong> for Equatorial Guinea; <strong>.ml</strong> for Mali; and <strong>.tk</strong> for Tokelau.</p>
<p>Freenom has always waived the registration fees for domains in these country-code domains, presumably as a way to encourage users to pay for related services, such as registering a .com or .net domain, for which Freenom does charge a fee.</p>
<p>On March 3, 2023, social media giant Meta sued Freenom in a Northern California court, alleging <a href="https://www.winston.com/en/legal-glossary/cybersquatting.html" target="_blank" rel="noopener">cybersquatting</a> violations and trademark infringement. The lawsuit also seeks information about the identities of 20 different &#8220;John Does&#8221; &#8212; Freenom customers that Meta says have been particularly active in <a href="https://urlscan.io/result/d9118a63-0f82-42e8-b8b3-7e9a09d334bb/" target="_blank" rel="noopener">phishing attacks</a> against <strong>Facebook</strong>, <strong>Instagram</strong>, and <strong>WhatsApp</strong> users.</p>
<p>The lawsuit points to <a href="media/60f7e27d.PhishingLandscape2021.pdf" data-original-source="https://www.interisle.net/PhishingLandscape2021.pdf" target="_blank" rel="noopener">a 2021 study</a> (PDF) on the abuse of domains conducted for the European Commission, which discovered that those ccTLDs operated by Freenom made up five of the Top Ten TLDs most abused by phishers.</p>
<p>&#8220;The five ccTLDs to which Freenom provides its services are the TLDs of choice for cybercriminals because Freenom provides free domain name registration services and shields its customers&#8217; identity, even after being presented with evidence that the domain names are being used for illegal purposes,&#8221; the complaint charges. &#8220;Even after receiving notices of infringement or phishing by its customers, Freenom continues to license new infringing domain names to those same customers.&#8221;</p>
<p>Meta further alleges that &#8220;Freenom has repeatedly failed to take appropriate steps to investigate and respond appropriately to reports of abuse,&#8221; and that it monetizes the traffic from infringing domains by reselling them and by adding &#8220;parking pages&#8221; that redirect visitors to other commercial websites, websites with pornographic content, and websites used for malicious activity like phishing.</p>
<p>Freenom has not yet responded to requests for comment. But attempts to register a domain through the company&#8217;s website as of publication time generated an error message that reads:</p>
<p>&#8220;Because of technical issues the Freenom application for new registrations is temporarily out-of-order. Please accept our apologies for the inconvenience. We are working on a solution and hope to resume operations shortly. Thank you for your understanding.&#8221;</p>
<div id="attachment_62969" style="width: 552px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62969" loading="lazy" class="wp-image-62969" src="media/ca827fc3.combotld.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/combotld.png" alt="" width="542" height="358" /><p id="caption-attachment-62969" class="wp-caption-text">Image: Interisle Consulting Group, Phishing Landscape 2021, Sept. 2021.</p></div>
<p>Although Freenom is based in The Netherlands, some of its other sister companies named as defendants in the lawsuit names <em>are</em> incorporated in the United States.</p>
<p>Meta initially filed this lawsuit in December 2022, but it asked the court to seal the case, which would have restricted public access to court documents in the dispute. That request was denied, and Meta amended and re-filed the lawsuit last week.<span id="more-62953"></span></p>
<p>According to Meta, this isn&#8217;t just a case of another domain name registrar ignoring abuse complaints because it&#8217;s bad for business. The lawsuit alleges that the owners of Freenom &#8220;are part of a web of companies created to facilitate cybersquatting, all for the benefit of Freenom.&#8221;</p>
<p>&#8220;On information and belief, one or more of the ccTLD Service Providers, ID Shield, Yoursafe, Freedom Registry, Fintag, Cervesia, VTL, Joost Zuurbier Management Services B.V., and Doe Defendants were created to hide assets, ensure unlawful activity including cybersquatting and phishing goes undetected, and to further the goals of Freenom,&#8221; Meta charged.</p>
<p>It remains unclear why Freenom has stopped allowing domain registration, but it could be that the company was recently the subject of some kind of disciplinary action by the <strong>Internet Corporation for Assigned Names and Numbers</strong> (ICANN), the nonprofit entity which oversees the domain registrars.</p>
<p>In June 2015, ICANN suspended Freenom&#8217;s ability to create new domain names or initiate inbound transfers of domain names for 90 days. According to Meta, the suspension was premised on ICANN&#8217;s determination that Freenom &#8220;has engaged in a pattern and practice of trafficking in or use of domain names identical or confusingly similar to a trademark or service mark of a third party in which the Registered Name Holder has no rights or legitimate interest.&#8221;</p>
<p>ICANN has not yet responded to requests for comment.</p>
<p>A copy of the amended complaint against Freenom, et. al, is available <a href="media/f5b84a68.Freenom-First-Amended-Complaint-3March2023.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/Freenom-First-Amended-Complaint-3March2023.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=62987
title: Who’s Behind the NetWire Remote Access Trojan?
uri: Who-s-Behind-the-NetWire-Remote-Access-Trojan
url: https://krebsonsecurity.com/2023/03/whos-behind-the-netwire-remote-access-trojan/
content:
<p>A Croatian national has been arrested for allegedly operating <strong>NetWire</strong>, a Remote Access Trojan (RAT) marketed on cybercrime forums since 2012 as a stealthy way to spy on infected systems and siphon passwords. The arrest coincided with a seizure of the NetWire sales website by the <strong>U.S. Federal Bureau of Investigation</strong> (FBI). While the defendant in this case hasn&#8217;t yet been named publicly, the NetWire website has been leaking information about the likely true identity and location of its owner for the past 11 years.</p>
<p><img class="aligncenter wp-image-62995" src="media/a0eb599b.wwls.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/wwls.png" alt="" width="750" height="536" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/wwls.png 799w, https://krebsonsecurity.com/wp-content/uploads/2023/03/wwls-768x549.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/03/wwls-782x559.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/03/wwls-100x70.png 100w" sizes="(max-width: 750px) 100vw, 750px" /></p>
<p>Typically installed by <a href="https://unit42.paloaltonetworks.com/guloader-installing-netwire-rat/" target="_blank" rel="noopener">booby-trapped Microsoft Office documents</a> and distributed via email, <strong>NetWire</strong> is a multi-platform threat that is capable of targeting not only <strong>Microsoft Windows</strong> machines but also <strong>Android</strong>, <strong>Linux</strong> and <strong>Mac</strong> systems.</p>
<p>NetWire&#8217;s reliability and relatively low cost ($80-$140 depending on features) has made it an extremely popular RAT on the cybercrime forums for years, and NetWire infections consistently rank among the <a href="https://decoded.avast.io/threatresearch/avast-q4-2022-threat-report/" target="_blank" rel="noopener">top 10 most active RATs in use</a>.</p>
<p>NetWire has been sold openly on the same website since 2012: <strong>worldwiredlabs[.]com</strong>. That website now features a seizure notice from the <strong>U.S. Department of Justice</strong>, which says the domain was taken as part of &#8220;a coordinated law enforcement action taken against the NetWire Remote Access Trojan.&#8221;</p>
<p>&#8220;As part of this week’s law enforcement action, authorities in Croatia on Tuesday arrested a Croatian national who allegedly was the administrator of the website,&#8221; reads <a href="https://www.justice.gov/usao-cdca/pr/federal-authorities-seize-internet-domain-selling-malware-used-illegally-control-and" rel="noopener" target="_blank">a statement</a> by the <strong>U.S. Department of Justice</strong> today. &#8220;This defendant will be prosecuted by Croatian authorities. Additionally, law enforcement in Switzerland on Tuesday seized the computer server hosting the NetWire RAT infrastructure.&#8221;</p>
<p>Neither the DOJ&#8217;s statement nor <a href="https://www-index-hr.translate.goog/vijesti/clanak/kod-zagreba-uhicen-haker-hrvatskoj-policiji-u-istrazi-pomogao-fbi/2445145.aspx?index_tid=328489&#038;index_ref=naslovnica_vijesti_ostalo_d&#038;_x_tr_sl=auto&#038;_x_tr_tl=en&#038;_x_tr_hl=en&#038;_x_tr_pto=wapp" rel="noopener" target="_blank">a press release</a> on the operation published by Croatian authorities mentioned the name of the accused. But it&#8217;s fairly remarkable that it has taken so long for authorities in the United States and elsewhere to move against NetWire and its alleged proprietor, given that the RAT&#8217;s author apparently did very little to hide his real-life identity.</p>
<p>The WorldWiredLabs website first came online in February 2012 using a dedicated host with no other domains. The site&#8217;s true WHOIS registration records have always been hidden by privacy protection services, but there are plenty of clues in historical Domain Name System (DNS) records for WorldWiredLabs that point in the same direction.</p>
<p>In October 2012, the WorldWiredLabs domain moved to another dedicated server at the Internet address 198.91.90.7, which was home to just one other domain: <strong>printschoolmedia[.]org</strong>, also registered in 2012.</p>
<p>According to <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a>, printschoolmedia[.]org was registered to a <strong>Mario Zanko</strong> in Zapresic, Croatia, and to the email address <strong>zankomario@gmail.com</strong>. DomainTools further shows this email address was used to register one other domain in 2012: <strong>wwlabshosting[.]com</strong>, also registered to Mario Zanko from Croatia.</p>
<p>A review of DNS records for both printschoolmedia[.]org and wwlabshosting[.]com shows that while these domains were online they both used the DNS name server <strong>ns1.worldwiredlabs[.]com</strong>. No other domains have been recorded using that same name server.</p>
<div id="attachment_62996" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-62996" loading="lazy" class=" wp-image-62996" src="media/428bdca9.wwl2013.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/wwl2013.png" alt="" width="750" height="586" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/wwl2013.png 952w, https://krebsonsecurity.com/wp-content/uploads/2023/03/wwl2013-768x600.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/03/wwl2013-782x611.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-62996" class="wp-caption-text">The WorldWiredLabs website, in 2013. Source: Archive.org.</p></div>
<p>DNS records for worldwiredlabs[.]com also show the site forwarded incoming email to the address <strong>tommaloney@ruggedinbox.com</strong>. <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a service that indexes information exposed by public database leaks, shows this email address was used to register an account at the clothing retailer romwe.com, using the password &#8220;<strong>123456xx</strong>.&#8221;</p>
<p>Running a reverse search on this password in Constella Intelligence shows there are more than 450 email addresses known to have used this credential, and two of those are <strong>zankomario@gmail.com</strong> and <strong>zankomario@yahoo.com</strong>.</p>
<p><span id="more-62987"></span></p>
<p>A search on zankomario@gmail.com in <strong>Skype</strong> returns three results, including the account name &#8220;Netwire&#8221; and the username &#8220;<strong>Dugidox</strong>,&#8221; and another for a Mario Zanko (username zanko.mario).</p>
<p><img loading="lazy" class="alignright  wp-image-63016" src="media/3d0b93af.zankomarioskype.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/zankomarioskype.png" alt="" width="371" height="299" />Dugidox corresponds to the hacker handle most frequently associated with NetWire sales and support discussion threads on multiple cybercrime forums over the years.</p>
<p>Constella ties dugidox@gmail.com to a number of website registrations, including the Dugidox handle on BlackHatWorld and HackForums, and to IP addresses in Croatia for both. Constella also shows the email address zankomario@gmail.com used the password &#8220;dugidox2407.&#8221;</p>
<p>In 2010, someone using the email address dugidox@gmail.com registered the domain <strong>dugidox[.]com</strong>. The WHOIS registration records for that domain list a &#8220;Senela Eanko&#8221; as the registrant, but the address used was the same street address in Zapresic that appears in the WHOIS records for printschoolmedia[.]org, which is registered in Mr. Zanco&#8217;s name.</p>
<p>Prior to the demise of <strong>Google+</strong>, the email address dugidox@gmail.com mapped to an account with the nickname &#8220;<strong>Netwire wwl</strong>.&#8221; The dugidox email also was tied to a Facebook account (<strong>mario.zanko3</strong>), which featured check-ins and photos from various places in Croatia.</p>
<p>That Facebook profile is no longer active, but back in January 2017, the administrator of WorldWiredLabs posted that he was considering adding certain Android mobile functionality to his service. Three days after that, the Mario.Zank3 profile posted a photo saying he was selected for an Android instruction course &#8212; with his dugidox email in the photo, naturally.</p>
<p>Incorporation records from the U.K.&#8217;s Companies House shows that in 2017 Mr. Zanko became an officer in a company called <strong>Godbex Solutions LTD</strong>. A <a href="https://www.youtube.com/watch?v=jO_qmXaiJ98" target="_blank" rel="noopener">Youtube video</a> invoking this corporate name describes Godbex as a &#8220;next generation platform&#8221; for exchanging gold and cryptocurrencies.</p>
<p>The U.K. Companies House records show Godbex was dissolved in 2020. It also says Mr. Zanko was born in July 1983, and lists his occupation as &#8220;electrical engineer.&#8221;</p>
<p>Mr. Zanko did not respond to multiple requests for comment.</p>


feed_id: https://krebsonsecurity.com/?p=63055
title: Two U.S. Men Charged in 2022 Hacking of DEA Portal
uri: Two-U-S-Men-Charged-in-2022-Hacking-of-DEA-Portal
url: https://krebsonsecurity.com/2023/03/two-us-men-charged-in-2022-hacking-of-dea-portal/
content:
<p>Two U.S. men have been charged with hacking into a <strong>U.S. Drug Enforcement Agency</strong> (DEA) online portal that taps into 16 different federal law enforcement databases. Both are alleged to be part of a larger criminal organization that specializes in using fake emergency data requests from compromised police and government email accounts to publicly threaten and extort their victims.</p>
<p><img class="aligncenter wp-image-59128" src="media/b7372c46.legalrequest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png" alt="" width="742" height="616" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest.png 864w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-768x638.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/03/legalrequest-782x650.png 782w" sizes="(max-width: 742px) 100vw, 742px" /></p>
<p>Prosecutors for the Eastern District of New York today unsealed criminal complaints against <strong>Sagar Steven Singh</strong> &#8212; also known as &#8220;<strong>Weep</strong>&#8221; &#8212; a 19-year-old from Pawtucket, Rhode Island; and <strong>Nicholas Ceraolo</strong>, 25, of Queens, NY, who allegedly also went by the handles &#8220;<strong>Convict</strong>&#8221; and &#8220;<strong>Ominus</strong>.&#8221;</p>
<p>The Justice Department says Singh and Ceraolo belong to a group of cybercriminals known to its members as &#8220;<strong>ViLE</strong>,&#8221; who specialize in obtaining personal information about third-party victims, which they then use to harass, threaten or extort the victims, a practice known as &#8220;doxing.&#8221;</p>
<p>&#8220;ViLE is collaborative, and the members routinely share tactics and illicitly obtained information with each other,&#8221; prosecutors charged.</p>
<p>The government alleges the defendants and other members of ViLE use various methods to obtain victims’ personal information, including:</p>
<p>-tricking customer service employees;<br />
-submitting fraudulent legal process to social media companies to elicit users’ registration information;<br />
-co-opting and corrupting corporate insiders;<br />
-searching public and private online databases;<br />
-accessing a nonpublic United States government database without authorization<br />
-unlawfully using official email accounts belonging to other countries.</p>
<p>The complaint says once they obtained a victim&#8217;s information, Singh and Ceraolo would post the information in an online forum. The government refers to this community only as &#8220;<strong>Forum-1</strong>,&#8221; saying that it is administered by the leader of ViLE (referenced in the complaint at CC-1).</p>
<p>&#8220;Victims are extorted into paying CC-1 to have their information removed from Forum-1,&#8221; prosecutors allege. &#8220;Singh also uses the threat of revealing personal information to extort victims into giving him access to their social media accounts, which Singh then resells.&#8221;</p>
<p>Sources tell KrebsOnSecurity in addition to being members of ViLE, both Weep and Ominous are or were staff members for <strong>Doxbin</strong>, a highly toxic online community that provides a forum for digging up personal information on people and posting it publicly. This is supported by the Doxin administrator&#8217;s claimed responsibility for a high-profile intrusion at the DEA&#8217;s law enforcement data sharing portal last year.</p>
<div id="attachment_59765" style="width: 761px" class="wp-caption aligncenter"><a href="media/1fc6e049.esp-screenshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-59765" loading="lazy" class="wp-image-59765" src="media/1fc6e049.esp-screenshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot.png" alt="" width="751" height="372" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot.png 1283w, https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot-768x380.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/05/esp-screenshot-782x387.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-59765" class="wp-caption-text">A screenshot of alleged access to the Drug Enforcement Agency&#8217;s intelligence sharing portal, shared by &#8220;KT,&#8221; the current administrator of the doxing and harassment community Doxbin.</p></div>
<p>The government alleges that on May 7, 2022, Singh used stolen credentials to log into a U.S. federal government portal without authorization. The complaint doesn&#8217;t specify which agency portal was hacked, but it does state that the portal included access to law enforcement databases that track narcotics seizures in the United States.</p>
<p>On May 12, 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/05/dea-investigating-breach-of-law-enforcement-data-portal/" target="_blank" rel="noopener">broke the news</a> that hackers had gained access to a DEA portal that taps into 16 different federal law enforcement databases. As reported at the time, the inside scoop on how that hack went down came from <strong>KT</strong>, the current administrator of the Doxbin and the individual referenced in the government&#8217;s complaint as &#8220;CC-1.&#8221;</p>
<p>Indeed, a screenshot of the ViLE group website includes the group&#8217;s official roster, which lists KT at the top, followed by Weep and Ominus.</p>
<div id="attachment_63060" style="width: 729px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63060" loading="lazy" class="size-full wp-image-63060" src="media/a6c3c7ae.ViLE.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/ViLE.png" alt="" width="719" height="475" /><p id="caption-attachment-63060" class="wp-caption-text">A screenshot of the website for the cybercriminal group &#8220;ViLE.&#8221; Image: USDOJ.</p></div>
<p><span id="more-63055"></span></p>
<p>In March 2022, KrebsOnSecurity <a href="https://krebsonsecurity.com/2022/03/hackers-gaining-power-of-subpoena-via-fake-emergency-data-requests/" target="_blank" rel="noopener">warned</a> that multiple cybercrime groups were finding success with fraudulent Emergency Data Requests (EDRs), wherein the hackers use compromised police and government email accounts to file warrantless data requests with social media firms and mobile telephony providers, attesting that the information being requested can&#8217;t wait for a warrant because it relates to an urgent matter of life and death.</p>
<p>That story showed that the previous owner of the Doxbin also was part of a teenage hacking group that specialized in offering fake EDRs as a service on the dark web.</p>
<p>Prosecutors say they tied Singh to the government portal hack because he connected to it from an Internet address that he&#8217;d previously used to access a social media account registered in his name. When they raided Singh&#8217;s residence on Sept. 8, 2022 and seized his devices, investigators with Homeland Security found a cellular phone and laptop that allegedly &#8220;contained extensive evidence of access to the Portal.&#8221;</p>
<p>The complaint alleges that between February 2022 and May 2022, Ceraolo used an official email account belonging to a Bangladeshi police official to pose as a police officer in communication with U.S.-based social media platforms.</p>
<p>&#8220;In these communications, Ceraolo requested personal information about users of these platforms, under the false pretense that the users were committing crimes or in life-threatening danger,&#8221; the complaint states.</p>
<p>For example, on or about March 13, 2022, Ceraolo allegedly used the Bangladeshi police email account to falsely claim that the target of the EDR had sent bomb threats, distributed child pornography and threatened officials of the Bangladeshi government.</p>
<p>On or about May 9, 2022, the government says, Singh sent a friend screenshots of text messages between himself and someone he had doxed on the Doxbin and was trying to extort for their Instagram handle. The data included the victim&#8217;s Social Security number, driver’s license number, cellphone number, and home address.</p>
<p>&#8220;Look familiar?” Singh allegedly wrote to the victim. &#8220;You’re gonna comply to me if you don’t want anything negative to happen to your parents. . . I have every detail involving your parents . . . allowing me to do whatever I desire to them in malicious ways.&#8221;</p>
<p>Neither of the defendants could be immediately reached for comment. KT, the current administrator of the Doxbin, has not responded to requests for comment.</p>
<p>Ceraolo is a self-described security researcher who has been credited in <a href="https://www.google.com/search?q=%22nicholas+convict+ceraolo%22#ip=1" target="_blank" rel="noopener">many news stories over the years</a> with discovering security vulnerabilities at <strong>AT&amp;T</strong>, <strong>T-Mobile</strong>, <strong>Comcast</strong> and <strong>Cox Communications</strong>.</p>
<p>Ceraolo&#8217;s stated partner in most of these discoveries &#8212; a 30-year-old Connecticut man named <strong>Ryan &#8220;Phobia&#8221; Stevenson</strong> &#8212; was charged in 2019 with being part of a group that stole millions of dollars worth of cryptocurrencies via <a href="https://krebsonsecurity.com/?s=sim-swapping" target="_blank" rel="noopener">SIM-swapping</a>, a crime that involves tricking a mobile provider into routing a target&#8217;s calls and text messages to another device.</p>
<p>In 2018, KrebsOnSecurity detailed how Stevenson earned bug bounty rewards and public recognition from top telecom companies for finding and reporting security holes in their websites, all the while <a href="https://krebsonsecurity.com/2018/11/bug-bounty-hunter-ran-isp-doxing-service/" target="_blank" rel="noopener">secretly peddling those same vulnerabilities to cybercriminals</a>.</p>
<p>According to the Justice Department, if convicted Ceraolo faces up to 20 years’ imprisonment for conspiracy to commit wire fraud; both Ceraolo and Singh face five years’ imprisonment for conspiracy to commit computer intrusions.</p>
<p>A copy of the complaint against Ceraolo and Singh is <a href="media/2db027d7.Singh-and-Ceraolo-Complaint.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/Singh-and-Ceraolo-Complaint.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=63082
title: Microsoft Patch Tuesday, March 2023 Edition
uri: Microsoft-Patch-Tuesday-March-2023-Edition
url: https://krebsonsecurity.com/2023/03/microsoft-patch-tuesday-march-2023-edition/
content:
<p><strong>Microsoft </strong>on Tuesday released updates to quash at least 74 security bugs in its <strong>Windows</strong> operating systems and software. Two of those flaws are already being actively attacked, including an especially severe weakness in <strong>Microsoft Outlook</strong> that can be exploited without any user interaction.</p>
<p><img class="aligncenter wp-image-60331" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="749" height="496" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The Outlook vulnerability (<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397" target="_blank" rel="noopener">CVE-2023-23397</a>) affects all versions of Microsoft Outlook from 2013 to the newest. Microsoft said it has seen evidence that attackers are exploiting this flaw, which can be done without any user interaction by sending a booby-trapped email that triggers automatically when retrieved by the email server &#8212; <em>before the email is even viewed in the Preview Pane</em>.</p>
<p>While CVE-2023-23397 is labeled as an &#8220;Elevation of Privilege&#8221; vulnerability, that label doesn’t accurately reflect its severity, said <strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>.</p>
<p>Known as an NTLM relay attack, it allows an attacker to get someone’s NTLM hash [Windows account password] and use it in an attack commonly referred to as &#8220;<a href="https://en.wikipedia.org/wiki/Pass_the_hash" target="_blank" rel="noopener">Pass The Hash</a>.&#8221;</p>
<p>&#8220;The vulnerability effectively lets the attacker authenticate as a trusted individual without having to know the person’s password,&#8221; Breen said. &#8220;This is on par with an attacker having a valid password with access to an organization’s systems.&#8221;</p>
<p>Security firm <strong>Rapid7</strong> points out that this bug affects self-hosted versions of Outlook like <strong>Microsoft 365 Apps for Enterprise</strong>, but Microsoft-hosted online services like <strong>Microsoft 365</strong> are <em>not</em> vulnerable.<span id="more-63082"></span></p>
<p>The other zero-day flaw being actively exploited in the wild &#8212; <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24880" target="_blank" rel="noopener">CVE-2023-24800</a> &#8212; is a &#8220;Security Feature Bypass&#8221; in <strong>Windows SmartScreen</strong>, part of Microsoft&#8217;s slate of endpoint protection tools.</p>
<p>Patch management vendor <strong>Action1</strong> notes that the exploit for this bug is low in complexity and requires no special privileges. But it does require some user interaction, and can&#8217;t be used to gain access to private information or privileges. However, the flaw can allow other malicious code to run without being detected by SmartScreen reputation checks.</p>
<p><strong>Dustin Childs</strong>, head of threat awareness at Trend Micro&#8217;s <strong>Zero Day Initiative</strong>, said CVE-2023-24800 allows attackers to create files that would bypass Mark of the Web (MOTW) defenses.</p>
<p>&#8220;Protective measures like SmartScreen and Protected View in Microsoft Office rely on MOTW, so bypassing these makes it easier for threat actors to spread malware via crafted documents and other infected files that would otherwise be stopped by SmartScreen,&#8221; Childs said.</p>
<p>Seven other vulnerabilities Microsoft patched this week earned its most-dire &#8220;critical&#8221; severity label, meaning the updates address security holes that could be exploited to give the attacker full, remote control over a Windows host with little or no interaction from the user.</p>
<p>Also this week, Adobe released eight patches addressing a whopping 105 security holes across a variety of products, including <strong>Adobe Photoshop</strong>, <strong>Cold Fusion</strong>, <strong>Experience Manager</strong>, <strong>Dimension</strong>, <strong>Commerce</strong>, <strong>Magento</strong>, <strong>Substance 3D Stager</strong>, <strong>Cloud Desktop Applicatio</strong>n, and <strong>Illustrator</strong>.</p>
<p>For a more granular rundown on the updates released today, see the <a href="https://isc.sans.edu/diary/Microsoft%20March%202023%20Patch%20Tuesday/29634" target="_blank" rel="noopener">SANS Internet Storm Center roundup</a>. If today’s updates cause any stability or usability issues in Windows, <a href="https://www.askwoody.com/2023/march-madness-here-we-come/" target="_blank" rel="noopener">AskWoody.com</a> will likely have the lowdown on that.</p>
<p>Please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any problems as a result of these patches.</p>


feed_id: https://krebsonsecurity.com/?p=63100
title: Feds Charge NY Man as BreachForums Boss “Pompompurin”
uri: Feds-Charge-NY-Man-as-BreachForums-Boss-Pompompurin
url: https://krebsonsecurity.com/2023/03/feds-charge-ny-man-as-breachforums-boss-pompompurin/
content:
<p>The <strong>U.S. Federal Bureau of Investigation</strong> (FBI) this week arrested a New York man on suspicion of running <strong>BreachForums</strong>, a popular English-language cybercrime forum where some of the world biggest hacked databases routinely first show up for sale. The forum&#8217;s administrator &#8220;<strong>Pompompurin</strong>&#8221; has been a thorn in the side of the FBI for years, and BreachForums is widely considered a reincarnation of <strong>RaidForums</strong>, a remarkably similar crime forum that the FBI infiltrated and dismantled in 2022.</p>
<div id="attachment_63107" style="width: 725px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63107" class="wp-image-63107 size-full" src="media/d3e64dd6.pompompshome.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/pompompshome.png" alt="" width="715" height="402" /><p id="caption-attachment-63107" class="wp-caption-text">FBI agents carting items out of Fitzpatrick&#8217;s home on March 15. Image: News 12 Westchester.</p></div>
<p>In an affidavit filed with the District Court for the Southern District of New York, FBI Special Agent <strong>John Langmire</strong> said that at around 4:30 p.m. on March 15, 2023, he led a team of law enforcement agents that made a probable cause arrest of a <strong>Conor Brian Fitzpatrick</strong> in Peekskill, NY.</p>
<p>&#8220;When I arrested the defendant on March 15, 2023, he stated to me in substance and in part that: a) his name was Conor Brian Fitzpatrick; b) he used the alias &#8216;pompompurin/&#8217; and c) he was the owner and administrator of &#8216;BreachForums the data breach website referenced in the Complaint,&#8221; Langmire wrote.</p>
<p>Pompompurin has been something of a nemesis to the FBI for several years. In November 2021, KrebsOnSecurity broke the news that <a href="https://krebsonsecurity.com/2021/11/hoax-email-blast-abused-poor-coding-in-fbi-website/" target="_blank" rel="noopener">thousands of fake emails about a cybercrime investigation were blasted out from the FBI&#8217;s email systems and Internet addresses</a>.</p>
<p>Pompompurin took credit for that stunt, and said he was able to send the FBI email blast by exploiting a flaw in an FBI portal designed to share information with state and local law enforcement authorities. The FBI later acknowledged that a software misconfiguration allowed someone to send the fake emails.</p>
<p>In December, 2022, KrebsOnSecurity broke the news that <a href="https://krebsonsecurity.com/2022/12/fbis-vetted-info-sharing-network-infragard-hacked/" target="_blank" rel="noopener">hackers active on BreachForums had infiltrated the FBI&#8217;s InfraGard program</a>, a vetted FBI program designed to build cyber and physical threat information sharing partnerships with experts in the private sector. The hackers impersonated the CEO of a major financial company, applied for InfraGard membership in the CEO&#8217;s name, and were granted admission to the community.</p>
<p>From there, the hackers plundered the InfraGard member database, and proceeded to sell contact information on more than 80,000 InfraGard members in an auction on BreachForums. The FBI responded by disabling the portal for some time, before ultimately forcing all InfraGard members to re-apply for membership.</p>
<p>More recently, BreachForums was the sales forum for <a href="https://cyberscoop.com/dc-health-data-posted-online/" target="_blank" rel="noopener">data stolen</a> from <strong>DC Health Link</strong>, a health insurance exchange based in Washington, D.C. that suffered a data breach this month. The sales thread initially said the data included the names, Social Security numbers, dates of birth, health plan and enrollee information and more on 170,000 individuals, although the official notice about the breach says 56,415 people were affected in the DC Health Link breach.</p>
<p>In April 2022, U.S. Justice Department <a href="https://krebsonsecurity.com/2022/04/raidforums-get-raided-alleged-admin-arrested/" target="_blank" rel="noopener">seized the servers and domains for RaidForums</a>, an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. As part of that operation, the feds also charged the alleged administrator, 21-year-old Diogo Santos Coelho of Portugal, with six criminal counts.</p>
<p>Coelho was arrested in the United Kingdom on Jan. 31, 2022. By that time, the new BreachForums had been live for just under a week, but with a familiar look.</p>
<p>BreachForums remains accessible online, and from reviewing the live chat stream on the site&#8217;s home page it appears the forum&#8217;s active users are only just becoming aware that their administrator &#8212; and the site&#8217;s database &#8212; is likely now in FBI hands:</p>
<div id="attachment_63109" style="width: 761px" class="wp-caption aligncenter"><a href="media/9b9f7b92.breachedruhroh.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/breachedruhroh.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63109" loading="lazy" class="wp-image-63109" src="media/9b9f7b92.breachedruhroh.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/breachedruhroh.png" alt="" width="751" height="281" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/breachedruhroh.png 1409w, https://krebsonsecurity.com/wp-content/uploads/2023/03/breachedruhroh-768x287.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/03/breachedruhroh-782x292.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-63109" class="wp-caption-text">Members of BreachForums discuss the arrest of the forum&#8217;s alleged owner.</p></div>
<p>&#8220;Wait if they arrested pom then doesn&#8217;t the FBI have all of our details we&#8217;ve registered with?&#8221; asked one worried BreachForums member.</p>
<p>&#8220;But we all have good VPNs I guess, right&#8230;right guys?&#8221; another denizen offered.</p>
<p>&#8220;Like pom would most likely do a plea bargain and cooperate with the feds as much as possible,&#8221; replied another.</p>
<p>Fitzpatrick could not be immediately reached for comment. The FBI declined to comment for this story.</p>
<p>There is only one page to the <a href="media/28b17a4e.pomcomplaint.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/pomcomplaint.pdf" target="_blank" rel="noopener">criminal complaint against Fitzpatrick</a> (PDF), which charges him with one count of conspiracy to commit access device fraud. The affidavit on his arrest is available <a href="media/f84289af.gov.uscourts.nysd.595805.1.0.pdf" data-original-source="https://storage.courtlistener.com/recap/gov.uscourts.nysd.595805/gov.uscourts.nysd.595805.1.0.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=62964
title: Why You Should Opt Out of Sharing Data With Your Mobile Provider
uri: Why-You-Should-Opt-Out-of-Sharing-Data-With-Your-Mobile-Provider
url:
https://krebsonsecurity.com/2023/03/why-you-should-opt-out-of-sharing-data-with-your-mobile-provider/

content:
<p>A new breach involving data from nine million <strong>AT&amp;T</strong> customers is a fresh reminder that your mobile provider likely collects and shares a great deal of information about where you go and what you do with your mobile device &#8212; unless and until you affirmatively opt out of this data collection. Here&#8217;s a primer on why you might want to do that, and how.</p>
<div id="attachment_63008" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63008" class="wp-image-63008" src="media/53743d64.attbldg.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/attbldg.png" alt="" width="750" height="498" /><p id="caption-attachment-63008" class="wp-caption-text">Image: Shutterstock</p></div>
<p>Telecommunications giant <strong>AT&amp;T</strong> disclosed this month that a breach at a marketing vendor exposed certain account information for nine million customers. AT&amp;T said the data exposed did not include sensitive information, such as credit card or Social Security numbers, or account passwords, but was limited to &#8220;Customer Proprietary Network Information&#8221; (CPNI), such as the number of lines on an account.</p>
<p>Certain questions may be coming to mind right now, like &#8220;What the heck is CPNI?&#8221; And, &#8216;If it&#8217;s so &#8216;customer proprietary,&#8217; why is AT&amp;T sharing it with marketers?&#8221; Also maybe, &#8220;What can I do about it?&#8221; Read on for answers to all three questions.</p>
<p>AT&amp;T&#8217;s disclosure said the information exposed included customer first name, wireless account number, wireless phone number and email address. In addition, a small percentage of customer records also exposed the rate plan name, past due amounts, monthly payment amounts and minutes used.</p>
<p>CPNI refers to customer-specific &#8220;metadata&#8221; about the account and account usage, and may include:</p>
<p>-Called phone numbers<br />
-Time of calls<br />
-Length of calls<br />
-Cost and billing of calls<br />
-Service features<br />
-Premium services, such as directory call assistance</p>
<p>According to <a href="https://www.techtarget.com/searchnetworking/definition/CPNI" target="_blank" rel="noopener">a succinct CPNI explainer at TechTarget</a>, CPNI is private and protected information that cannot be used for advertising or marketing directly.</p>
<p>&#8220;An individual&#8217;s CPNI can be shared with other telecommunications providers for network operating reasons,&#8221; wrote TechTarget&#8217;s <strong>Gavin Wright</strong>. &#8220;So, when the individual first signs up for phone service, this information is automatically shared by the phone provider to partner companies.&#8221;</p>
<p>Is your mobile Internet usage covered by CPNI laws? That&#8217;s less clear, as the CPNI rules were established before mobile phones and wireless Internet access were common. TechTarget&#8217;s CPNI primer explains:</p>
<p>&#8220;Under current U.S. law, cellphone use is only protected as CPNI when it is being used as a telephone. During this time, the company is acting as a telecommunications provider requiring CPNI rules. Internet use, websites visited, search history or apps used are not protected CPNI because the company is acting as an information services provider not subject to these laws.&#8221;</p>
<p>Hence, the carriers can share and sell this data because they&#8217;re not explicitly prohibited from doing so. All three major carriers say they take steps to anonymize the customer data they share, but researchers have shown it is not terribly difficult <a href="https://www.vice.com/en/article/gygx7y/your-anonymous-browsing-data-isnt-actually-anonymous" target="_blank" rel="noopener">to de-anonymize supposedly anonymous web-browsing data</a>.</p>
<p>&#8220;Your phone, and consequently your mobile provider, know a lot about you,&#8221; <a href="https://mashable.com/article/how-to-stop-tmobile-att-verizon-from-sharing-my-data" target="_blank" rel="noopener">wrote</a> Jack Morse for <strong>Mashable</strong>. &#8220;The places you go, apps you use, and the websites you visit potentially reveal all kinds of private information — e.g. religious beliefs, health conditions, travel plans, income level, and specific tastes in pornography. This should bother you.&#8221;</p>
<p>Happily, all of the U.S. carriers are required to offer customers ways to opt out of having data about how they use their devices shared with marketers. Here&#8217;s a look at some of the carrier-specific practices and opt-out options.<span id="more-62964"></span></p>
<h2>AT&amp;T</h2>
<p>AT&amp;T&#8217;s policy says it shares device or &#8220;ad ID&#8221;, combined with demographics including age range, gender, and ZIP code information with third parties which explicitly include advertisers, programmers, and networks, social media networks, analytics firms, ad networks and other similar companies that are involved in creating and delivering advertisements.</p>
<p>AT&amp;T said the data exposed on 9 million customers was several years old, and mostly related to device upgrade eligibility. This may sound like the data went to just one of its partners who experienced a breach, but in all likelihood it also went to hundreds of AT&amp;T&#8217;s partners.</p>
<p>AT&amp;T&#8217;s <a href="https://www.att.com/ecpnioptout/InitiateCPNIForm.action" target="_blank" rel="noopener">CPNI opt-out page</a> says it shares CPNI data with several of its affiliates, including <strong>WarnerMedia</strong>, <strong>DirecTV</strong> and <strong>Cricket Wireless</strong>. Until recently, AT&amp;T also shared CPNI data with <strong>Xandr</strong>, whose <a href="https://docs.xandr.com/bundle/service-policies/page/third-party-providers.html" target="_blank" rel="noopener">privacy policy</a> in turn explains that it shares data with <em>hundreds of other advertising firms</em>. Microsoft <a href="https://about.att.com/story/2022/xandr-microsoft.html" target="_blank" rel="noopener">bought Xandr from AT&amp;T last year</a>.</p>
<h2>T-MOBILE</h2>
<p>According to the <a href="https://www.epic.org" target="_blank" rel="noopener">Electronic Privacy Information Center</a> (EPIC),<strong> T-Mobile</strong> seems to be the only company out of the big three to extend to all customers the rights conferred by the <a href="https://en.wikipedia.org/wiki/California_Consumer_Privacy_Act" target="_blank" rel="noopener">California Consumer Privacy Act</a> (CCPA).</p>
<p>EPIC says T-Mobile customer data sold to third parties uses another unique identifier called mobile advertising IDs or &#8220;<strong>MAIDs</strong>.&#8221; T-Mobile claims that MAIDs don&#8217;t directly identify consumers, but under the CCPA MAIDs are considered &#8220;personal information&#8221; that can be connected to IP addresses, mobile apps installed or used with the device, any video or content viewing information, and device activity and attributes.</p>
<p>T-Mobile customers can opt out by logging into their account and navigating to the profile page, then to &#8220;Privacy and Notifications.&#8221; From there, toggle off the options for &#8220;Use my data for analytics and reporting&#8221; and &#8220;Use my data to make ads more relevant to me.&#8221;</p>
<h2>VERIZON</h2>
<p>Verizon&#8217;s privacy policy says it does not sell information that personally identities customers (e.g., name, telephone number or email address), but it does allow third-party advertising companies to collect information about activity on Verizon websites and in Verizon apps, through MAIDs, <a href="https://en.wikipedia.org/wiki/Web_beacon" target="_blank" rel="noopener">pixels, web beacons</a> and social network plugins.</p>
<p>According to <a href="https://www.wired.com/story/verizon-user-privacy-settings/" target="_blank" rel="noopener">Wired.com&#8217;s tutorial</a>, Verizon users can opt out by logging into their Verizon account through a web browser or the My Verizon mobile app. From there, select the Account tab, then click Account Settings and Privacy Settings on the web. For the mobile app, click the gear icon in the upper right corner and then Manage Privacy Settings.</p>
<p>On the privacy preferences page, web users can choose &#8220;Don’t use&#8221; under the Custom Experience section. On the My Verizon app, toggle any green sliders to the left.</p>
<p>EPIC notes that all three major carriers say resetting the consumer&#8217;s device ID and/or clearing cookies in the browser will similarly reset any opt-out preferences (i.e., the customer will need to opt out again), and that blocking cookies by default may also block the opt-out cookie from being set.</p>
<p>T-Mobile says its opt out is device-specific and/or browser-specific. &#8220;In most cases, your opt-out choice will apply only to the specific device or browser on which it was made. You may need to separately opt out from your other devices and browsers.&#8221;</p>
<p>Both AT&amp;T and Verizon offer <em>opt-in</em> programs that gather and share far more information, including device location, the phone numbers you call, and which sites you visit using your mobile and/or home Internet connection. AT&amp;T calls this their <strong>Enhanced Relevant Advertising Program</strong>; Verizon&#8217;s is called <strong>Custom Experience Plus</strong>.</p>
<p>In 2021, multiple media outlets <a href="https://arstechnica.com/information-technology/2021/12/verizon-ignored-users-previous-opt-outs-in-latest-push-to-scan-web-browsing/?amp=1" target="_blank" rel="noopener">reported</a> that some Verizon customers were being automatically enrolled in Custom Experience Plus &#8212; even after those customers had already opted out of the same program under its previous name &#8212; &#8220;Verizon Selects.&#8221;</p>
<p>If none of the above opt out options work for you, at a minimum you should be able to opt out of CPNI sharing by calling your carrier, or by visiting one of their stores.</p>
<h2>THE CASE FOR OPTING OUT</h2>
<p>Why should you opt out of sharing CPNI data? For starters, some of the nation&#8217;s largest wireless carriers don&#8217;t have a great track record in terms of protecting the sensitive information that you give them solely for the purposes of becoming a customer &#8212; let alone the information they collect about your use of their services after that point.</p>
<p>In January 2023, T-Mobile disclosed that someone <a href="https://krebsonsecurity.com/2023/01/new-t-mobile-breach-affects-37-million-accounts/" target="_blank" rel="noopener">stole data on 37 million customer accounts</a>, including customer name, billing address, email, phone number, date of birth, T-Mobile account number and plan details. In August 2021, T-Mobile <a href="https://krebsonsecurity.com/2021/08/t-mobile-breach-exposed-ssn-dob-of-40m-people/" target="_blank" rel="noopener">acknowledged</a> that hackers made off with the names, dates of birth, Social Security numbers and driver’s license/ID information on more than 40 million current, former or prospective customers who applied for credit with the company.</p>
<p>Last summer, a cybercriminal began selling the names, email addresses, phone numbers, SSNs and dates of birth on 23 million Americans. An <a href="https://krebsonsecurity.com/2022/08/it-might-be-our-data-but-its-not-our-breach/" target="_blank" rel="noopener">exhaustive analysis of the data</a> strongly suggested it all belonged to customers of one AT&amp;T company or another. AT&amp;T stopped short of saying the data wasn&#8217;t theirs, but said the records did not appear to have come from its systems and may be tied to a previous data incident at another company.</p>
<p>However frequently the carriers may alert consumers about CPNI breaches, it&#8217;s probably nowhere near often enough. Currently, the carriers are required to report a consumer CPNI breach only in cases &#8220;when a person, without authorization or exceeding authorization, has intentionally gained access to, used or disclosed CPNI.&#8221;</p>
<p>But that definition of breach was crafted eons ago, back when the primary way CPNI was exposed was through &#8220;pretexting,&#8221; such when the phone company&#8217;s employees are tricked into giving away protected customer data.</p>
<p>In January, regulators at the <strong>U.S. Federal Communications Commission</strong> (FCC) <a href="https://www.fcc.gov/document/fcc-proposes-updated-data-breach-reporting-requirements" target="_blank" rel="noopener">proposed</a> amending the definition of &#8220;breach&#8221; to include things like inadvertent disclosure &#8212; such as when companies expose CPNI data on a poorly-secured server in the cloud. The FCC is accepting public comments on the matter until March 24, 2023.</p>
<p>While it&#8217;s true that the leak of CPNI data does not involve sensitive information like Social Security or credit card numbers, one thing AT&amp;T&#8217;s breach notice doesn&#8217;t mention is that CPNI data &#8212; such as balances and payments made &#8212; can be abused by fraudsters to make scam emails and text messages more believable <em>when they&#8217;re trying to impersonate AT&amp;T and phish AT&amp;T customers</em>.</p>
<p>The other problem with letting companies share or sell your CPNI data is that the wireless carriers can change their privacy policies at any time, and you are assumed to be okay with those changes as long as you keep using their services.</p>
<p>For example, location data from your wireless device is most definitely CPNI, and yet until very recently all of the major carriers sold their customers&#8217; real-time location data to third party data brokers without customer consent.</p>
<p>What was their punishment? In 2020, the FCC <a href="https://arstechnica.com/tech-policy/2020/02/fcc-issues-wrist-slap-fines-to-carriers-that-sold-your-phone-location-data/" target="_blank" rel="noopener">proposed fines totaling $208 million against all of the major carriers</a> for selling their customers&#8217; real-time location data. If that sounds like a lot of money, consider that all of the major wireless providers reported tens of billions of dollars in revenue last year (e.g., Verizon&#8217;s consumer revenue alone was more than $100 billion last year).</p>
<p>If the United States had federal privacy laws that were at all consumer-friendly and relevant to today&#8217;s digital economy, this kind of data collection and sharing would always be opt-in by default. In such a world, the enormously profitable wireless industry would likely be forced to offer clear financial incentives to customers who choose to share this information.</p>
<p>But until that day arrives, understand that the carriers can change their data collection and sharing policies when it suits them. And regardless of whether you actually read any notices about changes to their privacy policies, you will have agreed to those changes as long as you continue using their service.</p>


feed_id: https://krebsonsecurity.com/?p=63156
title: Google Suspends Chinese E-Commerce App Pinduoduo Over Malware
uri: Google-Suspends-Chinese-E-Commerce-App-Pinduoduo-Over-Malware
url: https://krebsonsecurity.com/2023/03/google-suspends-chinese-e-commerce-app-pinduoduo-over-malware/
content:
<p><strong>Google</strong> says it has suspended the app for the Chinese e-commerce giant <strong>Pinduoduo </strong>after malware was found in versions of the app. The move comes just weeks after Chinese security researchers published an analysis suggesting the popular e-commerce app sought to seize total control over affected devices by exploiting multiple security vulnerabilities in a variety of Android-based smartphones.</p>
<p>In November 2022, researchers at Google&#8217;s <a href="https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html" target="_blank" rel="noopener">Project Zero warned</a> about active attacks on <strong>Samsung</strong> mobile phones which chained together three security vulnerabilities that Samsung patched in March 2021, and which would have allowed an app to add or read any files on the device.</p>
<p>Google said it believes the exploit chain for Samsung devices belonged to a &#8220;commercial surveillance vendor,&#8221; without elaborating further. The <a href="https://googleprojectzero.blogspot.com/2022/11/a-very-powerful-clipboard-samsung-in-the-wild-exploit-chain.html" target="_blank" rel="noopener">highly technical writeup</a> also did not name the malicious app in question.</p>
<p>On Feb. 28, 2023, researchers at the Chinese security firm <strong>DarkNavy</strong> published <a href="https://mp.weixin.qq.com/s/P_EYQxOEupqdU0BJMRqWsw" target="_blank" rel="noopener">a blog post</a> purporting to show evidence that a major Chinese ecommerce company&#8217;s app was using this same three-exploit chain to read user data stored by other apps on the affected device, and to make its app nearly impossible to remove.</p>
<div id="attachment_63161" style="width: 977px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63161" class="size-full wp-image-63161" src="media/83c6f25e.dnec.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/dnec.png" alt="" width="967" height="515" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/dnec.png 967w, https://krebsonsecurity.com/wp-content/uploads/2023/03/dnec-768x409.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/03/dnec-782x416.png 782w" sizes="(max-width: 967px) 100vw, 967px" /><p id="caption-attachment-63161" class="wp-caption-text">The three Samsung exploits that DarkNavy says were used by the malicious app. In November 2022, Google documented these three same vulnerabilities being used together to compromise Samsung devices.</p></div>
<p>DarkNavy likewise did not name the app they said was responsible for the attacks. In fact, the researchers took care to redact the name of the app from multiple code screenshots published in their writeup. DarkNavy did not respond to requests for clarification.</p>
<p>&#8220;At present, a large number of end users have complained on multiple social platforms,&#8221; reads a translated version of the DarkNavy blog post. &#8220;The app has problems such as inexplicable installation, privacy leakage, and inability to uninstall.&#8221;</p>
<p>On March 3, 2023, a denizen of the now-defunct cybercrime community <strong>BreachForums</strong> posted a thread which noted that a unique component of the malicious app code highlighted by DarkNavy also was found in the ecommerce application whose name was apparently redacted from the DarkNavy analysis: Pinduoduo.</p>
<div id="attachment_63159" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63159" loading="lazy" class="wp-image-63159" src="media/fbd205c2.breached-pdd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/breached-pdd.png" alt="" width="751" height="339" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/breached-pdd.png 1151w, https://krebsonsecurity.com/wp-content/uploads/2023/03/breached-pdd-768x347.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/03/breached-pdd-782x353.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-63159" class="wp-caption-text">A Mar. 3, 2023 post on BreachForums, comparing the redacted code from the DarkNavy analysis with the same function in the Pinduoduo app available for download at the time.</p></div>
<p>On March 4, 2023, e-commerce expert <strong>Liu Huafang</strong> posted on the Chinese social media network <strong>Weibo</strong> that Pinduoduo&#8217;s app was using security vulnerabilities to gain market share by stealing user data from its competitors. That Weibo post has since been deleted.</p>
<p><img loading="lazy" class="aligncenter size-full wp-image-63158" src="media/3e3ea18b.liuhuafang.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/liuhuafang.png" alt="" width="622" height="451" /></p>
<p>On March 7, the newly created Github account Davinci1010 published <a href="https://github.com/davinci1010/pinduoduo_backdoor" target="_blank" rel="noopener">a technical analysis</a> claiming that until recently Pinduoduo&#8217;s source code included a &#8220;backdoor,&#8221; a hacking term used to describe code that allows an adversary to remotely and secretly connect to a compromised system at will.<span id="more-63156"></span></p>
<p>That analysis includes <a href="http://github.com/davinci1012/Pinduoduo_backdoor_unpacker" target="_blank" rel="noopener">links to archived versions of Pinduoduo&#8217;s app</a> released before March 5 (version 6.50 and lower), which is when Davinci1010 says a new version of the app removed the malicious code.</p>
<p>Pinduduo has not yet responded to requests for comment. Pinduoduo parent company <strong>PDD Holdings</strong> told Reuters Google has not shared details about why it suspended the app.</p>
<p>The company <a href="https://www.cnn.com/2023/03/21/tech/china-google-pinduoduo-malware-app-intl-hk/index.html" target="_blank" rel="noopener">told CNN</a> that it strongly rejects “the speculation and accusation that Pinduoduo app is malicious just from a generic and non-conclusive response from Google,” and said there were &#8220;several apps that have been suspended from Google Play at the same time.&#8221;</p>
<p>Pinduoduo is among China&#8217;s most popular e-commerce platforms, boasting approximately 900 million monthly active users.</p>
<p>Most of the news coverage of Google&#8217;s move against Pinduoduo emphasizes that the malware was found in versions of the Pinduoduo app available outside of Google&#8217;s app store &#8212; <strong>Google Play</strong>.</p>
<p>&#8220;Off-Play versions of this app that have been found to contain malware have been enforced on via Google Play Protect,&#8221; a Google spokesperson said in a statement to <a href="https://www.reuters.com/technology/google-suspends-chinas-pinduoduo-app-due-malware-issues-2023-03-21/" target="_blank" rel="noopener">Reuters</a>, adding that the Play version of the app has been suspended for security concerns.</p>
<p>However, Google Play is not available to consumers in China. As a result, the app will still be available via other mobile app stores catering to the Chinese market &#8212; including those operated by <strong>Huawei</strong>, <strong>Oppo</strong>, <strong>Tencent</strong> and <strong>VIVO</strong>.</p>
<p>Google said its ban did not affect the PDD Holdings app <strong>Temu</strong>, which is an online shopping platform in the United States. According to <a href="https://www.washingtonpost.com/technology/2023/03/21/tiktok-ceo-profile-congress/" target="_blank" rel="noopener">The Washington Post</a>, four of the Apple App Store&#8217;s 10 most-downloaded free apps are owned by Chinese companies, including Temu and the social media network <strong>TikTok</strong>.</p>
<p>The Pinduoduo suspension comes as lawmakers in Congress this week are gearing up to grill the CEO of TikTok over national security concerns. TikTok, which is owned by Beijing-based <strong>ByteDance</strong>, said last month that it now has roughly 150 million monthly active users in the United States.</p>
<p>A <a href="https://krebsonsecurity.com/2023/03/highlights-from-the-new-u-s-cybersecurity-strategy/" target="_blank" rel="noopener">new cybersecurity strategy</a> released earlier this month by the Biden administration singled out China as the greatest cyber threat to the U.S. and Western interests. The strategy says China now presents the &#8220;broadest, most active, and most persistent threat to both government and private sector networks,” and says China is “the only country with both the intent to reshape the international order and, increasingly, the economic, diplomatic, military, and technological power to do so.”</p>


feed_id: https://krebsonsecurity.com/?p=63197
title: UK Sets Up Fake Booter Sites To Muddy DDoS Market
uri: UK-Sets-Up-Fake-Booter-Sites-To-Muddy-DDoS-Market
url: https://krebsonsecurity.com/2023/03/uk-sets-up-fake-booter-sites-to-muddy-ddos-market/
content:
<p>The United Kingdom&#8217;s <strong>National Crime Agency</strong> (NCA) has been busy setting up phony DDoS-for-hire websites that seek to collect information on users, remind them that launching DDoS attacks is illegal, and generally increase the level of paranoia for people looking to hire such services.</p>
<div id="attachment_63209" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63209" class=" wp-image-63209" src="media/135b2b02.ncabootersplash.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/ncabootersplash.png" alt="" width="751" height="423" /><p id="caption-attachment-63209" class="wp-caption-text">The warning displayed to users on one of the NCA&#8217;s fake booter sites. Image: NCA.</p></div>
<p>The NCA says all of its fake so-called &#8220;booter&#8221; or &#8220;stresser&#8221; sites &#8212; which have so far been accessed by several thousand people &#8212; have been created to look like they offer the tools and services that enable cyber criminals to execute these attacks.</p>
<p>&#8220;However, after users register, rather than being given access to cyber crime tools, their data is collated by investigators,&#8221; reads an NCA advisory on the program. &#8220;Users based in the UK will be contacted by the National Crime Agency or police and warned about engaging in cyber crime. Information relating to those based overseas is being passed to international law enforcement.&#8221;</p>
<p>The NCA declined to say how many phony booter sites it had set up, or for how long they have been running. The NCA says hiring or launching attacks designed to knock websites or users offline is punishable in the UK under the Computer Misuse Act 1990.</p>
<p>&#8220;Going forward, people who wish to use these services can&#8217;t be sure who is actually behind them, so why take the risk?&#8221; the NCA announcement continues.</p>
<p>The NCA campaign comes closely on the heels of an international law enforcement takedown involving four-dozen websites that made powerful DDoS attacks a point-and-click operation.<span id="more-63197"></span></p>
<p>In mid-December 2022, the <strong>U.S. Department of Justice</strong> (DOJ) announced &#8220;<a href="https://krebsonsecurity.com/2022/12/six-charged-in-mass-takedown-of-ddos-for-hire-sites/" target="_blank" rel="noopener">Operation Power Off,</a>&#8221; which seized four-dozen booter business domains responsible for more than 30 million DDoS attacks, and charged six U.S. men with computer crimes related to their alleged ownership of popular DDoS-for-hire services. In connection with that operation, the NCA also arrested an 18-year-old man suspected of running one of the sites.</p>
<p>According to U.S. federal prosecutors, the use of booter and stresser services to conduct attacks is punishable under both wire fraud laws and the Computer Fraud and Abuse Act (18 U.S.C. § 1030), and may result in arrest and prosecution, the seizure of computers or other electronics, as well as prison sentences and a penalty or fine.</p>
<p>The United Kingdom, which has been battling its fair share of domestic booter bosses, <a href="https://krebsonsecurity.com/2020/05/uk-ad-campaign-seeks-to-deter-cybercrime/" target="_blank" rel="noopener">started running online ads in 2020</a> aimed at young people who search the Web for booter services.</p>
<p>As part of last year&#8217;s mass booter site takedown, the FBI and the Netherlands Police joined the NCA in announcing they are running targeted placement ads to steer those searching for booter services toward <a href="https://www.fbi.gov/contact-us/field-offices/anchorage/fbi-intensify-efforts-to-combat-illegal-ddos-attacks" target="_blank" rel="noopener">a website detailing the potential legal risks of hiring an online attack</a>.</p>


feed_id: https://krebsonsecurity.com/?p=63189
title: German Police Raid DDoS-Friendly Host ‘FlyHosting’
uri: German-Police-Raid-DDoS-Friendly-Host-FlyHosting
url: https://krebsonsecurity.com/2023/03/german-police-raid-ddos-friendly-host-flyhosting/
content:
<p>Authorities in Germany this week seized Internet servers that powered <strong>FlyHosting</strong>, a dark web offering that catered to cybercriminals operating DDoS-for-hire services, KrebsOnSecurity has learned. FlyHosting first advertised on cybercrime forums in November 2022, saying it was a Germany-based hosting firm that was open for business to anyone looking for a reliable place to host malware, botnet controllers, or DDoS-for-hire infrastructure.</p>
<div id="attachment_63256" style="width: 1134px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63256" src="media/2d632b63.flyhostingseizure.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/flyhostingseizure.png" alt="" width="1124" height="621" class="size-full wp-image-63256" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/flyhostingseizure.png 1124w, https://krebsonsecurity.com/wp-content/uploads/2023/03/flyhostingseizure-768x424.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/03/flyhostingseizure-782x432.png 782w" sizes="(max-width: 1124px) 100vw, 1124px" /><p id="caption-attachment-63256" class="wp-caption-text">A seizure notice left on the FlyHosting domains.</p></div>
<p>A <a href="https://www.presseportal.de/blaulicht/pm/4356" rel="noopener" target="_blank">statement</a> released today by the German Federal Criminal Police Office says they served eight search warrants on March 30, and identified five individuals aged 16-24 suspected of operating &#8220;an internet service&#8221; since mid-2021. The German authorities did not name the suspects or the Internet service in question.</p>
<p>&#8220;Previously unknown perpetrators used the Internet service provided by the suspects in particular for so-called &#8216;DDoS attacks&#8217;, i.e. the simultaneous sending of a large number of data packets via the Internet for the purpose of disrupting other data processing systems,&#8221; the statement reads.</p>
<p>News of a raid on FlyHosting first surfaced Thursday in a <strong>Telegram</strong> chat channel that is frequented by people interested or involved in the DDoS-for-hire industry, where a user by the name Dstatcc broke the news to Fly Hosting customers:</p>
<p>&#8220;So Flyhosting made a &#8216;migration&#8217; with it[s] systems to new rooms of the police ;),&#8221; the warning read. &#8220;Police says: They support ddos attacks, C&#038;C/C2 and stresser a bit too much. We expect the police will take a deeper look into the files, payment logs and IP&#8217;s. If you had a server from them and they could find &#8216;bad things&#8217; connected with you (payed with private paypal) you may ask a lawyer.&#8221;</p>
<div id="attachment_63255" style="width: 784px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63255" loading="lazy" src="media/52b301d3.flyhosting.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/flyhosting.png" alt="" width="774" height="733" class="size-full wp-image-63255" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/flyhosting.png 774w, https://krebsonsecurity.com/wp-content/uploads/2023/03/flyhosting-768x727.png 768w" sizes="(max-width: 774px) 100vw, 774px" /><p id="caption-attachment-63255" class="wp-caption-text">An ad for FlyHosting posted by the the user &#8220;bnt&#8221; on the now-defunct cybercrime forum BreachForums. Image: Ke-la.com.</p></div>
<p>The German authorities said that as a result of the DDoS attacks facilitated by the defendants, the websites of various companies as well as those of the Hesse police have been overloaded in several cases since mid-2021, &#8220;so that they could only be operated to a limited extent or no longer at times.&#8221;</p>
<p>The statement says police seized mobile phones, laptops, tablets, storage media and handwritten notes from the unnamed defendants, and confiscated servers operated by the suspects in Germany, Finland and the Netherlands.</p>
<p>KrebsOnSecurity has asked the German police for more information about the target of their raids. This post will be updated in the event they respond.</p>
<p>The apparent raids on FlyHosting come amid a broader law enforcement crackdown on DDoS-for-hire services internationally. The U.K.&#8217;s National Crime Agency announced last week that it&#8217;s been busy <a href="https://krebsonsecurity.com/2023/03/uk-sets-up-fake-booter-sites-to-muddy-ddos-market/" rel="noopener" target="_blank">setting up phony DDoS-for-hire websites</a> that seek to collect information on users, remind them that launching DDoS attacks is illegal, and generally increase the level of paranoia for people looking to hire such services.</p>
<p>In mid-December 2022, the U.S. Department of Justice (DOJ) announced “<a href="https://krebsonsecurity.com/2022/12/six-charged-in-mass-takedown-of-ddos-for-hire-sites/" rel="noopener" target="_blank">Operation Power Off</a>,” which seized four-dozen DDoS-for-hire domains responsible for more than 30 million DDoS attacks, and charged six U.S. men with computer crimes related to their alleged ownership of popular DDoS-for-hire services. </p>


feed_id: https://krebsonsecurity.com/?p=63152
title: A Serial Tech Investment Scammer Takes Up Coding?
uri: A-Serial-Tech-Investment-Scammer-Takes-Up-Coding
url: https://krebsonsecurity.com/2023/04/a-serial-tech-investment-scammer-takes-up-coding/
content:
<p><strong>John Clifton Davies</strong>, a 60-year-old con man from the United Kingdom who fled the country in 2015 before being sentenced to 12 years in prison for fraud, has enjoyed a successful life abroad swindling technology startups by pretending to be a billionaire investor. Davies&#8217; newest invention appears to be &#8220;<strong>CodesToYou</strong>,&#8221; which purports to be a &#8220;full cycle software development company&#8221; based in the U.K.</p>
<div id="attachment_53032" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53032" decoding="async" class=" wp-image-53032" src="media/c95e44e6.Bernard-sbs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/Bernard-sbs.png" alt="" width="750" height="397" /><p id="caption-attachment-53032" class="wp-caption-text">The scam artist John Bernard a.k.a. Alan John Mykailov (left) in a recent Zoom call, and a mugshot of John Clifton Davies from nearly a decade earlier.</p></div>
<p>Several articles here have delved into the history of <strong>John Bernard</strong>, the pseudonym used by a fake billionaire technology investor who <a href="https://krebsonsecurity.com/2020/10/promising-infusions-of-cash-fake-investor-john-bernard-walked-away-with-30m/" target="_blank" rel="noopener">tricked dozens of startups into giving him tens of millions of dollars</a>.</p>
<p>John Bernard&#8217;s real name is John Clifton Davies, a convicted fraudster from the United Kingdom who is currently a fugitive from justice. For several years until reinventing himself again quite recently, Bernard pretended to be a billionaire Swiss investor who made his fortunes in the dot-com boom 20 years ago.</p>
<p>&#8220;<a href="https://web.archive.org/web/20200917102043/https://the-private-office.ch/" target="_blank" rel="noopener">The Private Office of John Bernard</a>&#8221; let it be known to investment brokers that he had tens of millions of dollars to invest in tech startups, and he attracted a stream of new victims by offering extraordinarily generous finder’s fees to brokers who helped him secure new clients. But those brokers would eventually get stiffed because Bernard’s company would never consummate a deal.</p>
<div id="attachment_53031" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-53031" decoding="async" loading="lazy" class=" wp-image-53031" src="media/62badb37.privateoffice.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2020/09/privateoffice.png" alt="" width="750" height="517" srcset="https://krebsonsecurity.com/wp-content/uploads/2020/09/privateoffice.png 853w, https://krebsonsecurity.com/wp-content/uploads/2020/09/privateoffice-768x529.png 768w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-53031" class="wp-caption-text">John Bernard&#8217;s former website, where he pretended to be a billionaire tech investor.</p></div>
<p>Bernard would promise to invest millions in tech startups, and then insist that companies <a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener">pay tens of thousands of dollars worth of due diligence fees up front</a>. However, the due diligence company he insisted on using — another Swiss firm called <strong>The Inside Knowledge GmbH</strong> — also was secretly owned by Bernard, who would invariably <a href="https://krebsonsecurity.com/2020/09/who-is-tech-investor-john-bernard/" target="_blank" rel="noopener">pull out of the deal after receiving the due diligence money</a>.</p>
<p>A variety of clues suggest Davies has recently adopted at least one other identity &#8212; <strong>Alan John Mykhailov</strong> &#8212; who is listed as chairman of a British concern called <strong>CodesToYou LTD</strong>, incorporated in May 2022. The CodesToYou website says the company employs talented coders in several countries, and that its programmers offer &#8220;your ultimate balance between speed, cost and quality.&#8221;</p>
<div id="attachment_63230" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63230" decoding="async" loading="lazy" class=" wp-image-63230" src="media/f5862c9c.codestoyouteam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/codestoyouteam.png" alt="" width="751" height="517" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/03/codestoyouteam.png 1131w, https://krebsonsecurity.com/wp-content/uploads/2023/03/codestoyouteam-768x529.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/03/codestoyouteam-782x539.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/03/codestoyouteam-100x70.png 100w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-63230" class="wp-caption-text">The team from CodesToYou.</p></div>
<p>In response to questions from KrebsOnSecurity, CodesToYou&#8217;s marketing manager &#8212; who gave their name only as &#8220;Zhena&#8221; &#8212; said the company was not affiliated with any John Bernard or John Clifton Davies, and maintained that CodesToYou is a legitimate enterprise.</p>
<p>But publicly available information about this company and its leadership suggests otherwise. Official <a href="https://find-and-update.company-information.service.gov.uk/company/12219758/officers" target="_blank" rel="noopener">incorporation documents</a> from the U.K.&#8217;s <strong>Companies House</strong> represent that CodesToYou is headed by an Alan John Mykhailov, a British citizen born in March 1958.</p>
<p>Companies House says Mykhailov is an officer in three other companies, including one called <strong>Blackstone Corporate Alliance Ltd</strong>. According to the Swiss business tracking service <a href="https://business-monitor.ch/en/companies/717576-the-inside-knowledge-gmbh-in-liquidation" target="_blank" rel="noopener">business-monitor.ch</a>, Blackstone Corporate Alliance Ltd. is currently the entity holding a decision-making role in John Bernard&#8217;s fake due diligence company &#8212; The Inside Knowledge GmbH &#8212; which is <a href="https://web.archive.org/web/20201208035644/https://the-private-office.ch/" target="_blank" rel="noopener">now in liquidation</a>.</p>
<div id="attachment_63282" style="width: 760px" class="wp-caption aligncenter"><a href="media/cb39c820.johnbernardarchive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/johnbernardarchive.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63282" decoding="async" loading="lazy" class="wp-image-63282" src="media/cb39c820.johnbernardarchive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/johnbernardarchive.png" alt="" width="750" height="426" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/johnbernardarchive.png 1242w, https://krebsonsecurity.com/wp-content/uploads/2023/04/johnbernardarchive-768x436.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/johnbernardarchive-782x444.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-63282" class="wp-caption-text">A screen shot of the stock photos and corporate-speak on John Bernard&#8217;s old website. Image: Archive.org</p></div>
<p>Also listed as a partner in Blackstone Corporate Alliance Limited is <strong>Igor Hubskyi</strong> (a.k.a. Igor Gubskyi), a Ukrainian man who was <a href="https://www.monetas.ch/de/684/Donn%C3%A9es-personnelles-Ihor-Hubskyi-UKRAINE-Kiew.htm?ident=1RVUi1vB%2B4o%2BKL0xwGXMWnSwCiE%2BX9D%2FstMCtwHkLBs%3D" target="_blank" rel="noopener">previously president of The Inside Knowledge GmbH</a>.</p>
<p>The CodesToYou website says the company&#8217;s marketing team lead is <strong>Maria Yakovleva</strong>, and the photo of this employee matches the profile for the <a href="https://www.linkedin.com/in/maria-y-84b58248/" target="_blank" rel="noopener">LinkedIn account name &#8220;Maria Y.&#8221;</a> That same LinkedIn profile and photo previously listed Maria by a different first and last name &#8212; <strong>Mariya Kulikova</strong>; back then, <a href="media/debf0dd1.m-kulikova.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/03/m-kulikova.png" target="_blank" rel="noopener">Ms. Kulikova&#8217;s LinkedIn profile</a> said she was an executive assistant in The Private Office of Mr. John Bernard.</p>
<p>Companies House lists Alan John Mykhailov as a current officer in two other companies, including <a href="https://find-and-update.company-information.service.gov.uk/company/13813302" target="_blank" rel="noopener">Frisor Limited</a>, and <a href="https://find-and-update.company-information.service.gov.uk/company/14191897" target="_blank" rel="noopener">Ardelis Solutions Limited</a>. <a href="https://web.archive.org/web/20210730143454/https://ardelissolutions.com/" target="_blank" rel="noopener">A cached copy of the now-defunct Ardelis Solutions website</a> says it was a private equity firm.</p>
<p>CodesToYou&#8217;s Maria also included Ardelis Solutions in the work history section of her LinkedIn resume. That is, until being contacted by this author on LinkedIn, after which Maria&#8217;s profile picture and any mention of Ardelis Solutions were deleted.<span id="more-63152"></span></p>
<p>Listed as head of business development at CodesToYou is <strong>David Bruno</strong>, a Canadian man whose <a href="https://www.linkedin.com/in/david-bruno-62864512/" target="_blank" rel="noopener">LinkedIn profile</a> says he is founder of an organization called &#8220;World Privacy Resource.&#8221; As KrebsOnSecurity reported in 2020, Bruno was at the time promoting himself as the co-CEO of a company called <strong>SafeSwiss Secure Communication AG</strong>, and the founder of another tech startup called <strong>Secure Swiss Data</strong>.</p>
<p>Secure Swiss Data&#8217;s domain &#8212; secureswissdata.com &#8212; is a Swiss concern that sells encrypted email and data services. According to <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a>, that website name was registered in 2015 by The Inside Knowledge GmbH. In February 2020, a press release announced that Secure Swiss Data was purchased in an &#8220;undisclosed multimillion buyout&#8221; by SafeSwiss Secure Communication AG.</p>
<div id="attachment_63283" style="width: 759px" class="wp-caption aligncenter"><a href="media/66e2ce02.ardelisarchive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/ardelisarchive.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63283" decoding="async" loading="lazy" class="wp-image-63283" src="media/66e2ce02.ardelisarchive.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/ardelisarchive.png" alt="" width="749" height="345" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/ardelisarchive.png 1450w, https://krebsonsecurity.com/wp-content/uploads/2023/04/ardelisarchive-768x354.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/ardelisarchive-782x360.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-63283" class="wp-caption-text">A cached copy of the Ardelis Solutions website, which said it was a private equity firm and included similar stock images as John Bernard&#8217;s investment website.</p></div>
<p>When reached in 2020 and asked about his relationship to Mr. Bernard, Mr. Bruno said the two were business partners and that he couldn&#8217;t imagine that Mr. Bernard would be involved in anything improper. To this day Mr. Bruno is the only person I&#8217;ve spoken to who has had <a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener">anything positive to say about Mr. Bernard</a>.</p>
<p>Mr. Bruno did not respond to requests for comment this time around, but his LinkedIn profile no longer makes any mention of Secure Swiss Data or SafeSwiss &#8212; both companies he claimed to run for many years. Nor does it mention CodesToYou. However, Mr. Bruno&#8217;s former company SafeSwiss <em>is</em> listed as one of the six &#8220;portfolio&#8221; companies whose services are promoted on the CodesToYou website.</p>
<p>In mid-2021, Bruno announced he was running for public office in Ontario.</p>
<p>&#8220;The Kenora resident is no stranger to the government as he contributed to Canada’s new Digital Charter, Bill C-11, which is a new Cyber Security policy,&#8221; <a href="https://www.drydennow.com/articles/david-bruno-announced-liberal-candidacy-for-kenora-riding" target="_blank" rel="noopener">reported Drydennow.com</a>, a news website that covers Northwestern Ontario. Drydennow says the next federal election is expected to be held on or before Oct. 16, 2023.</p>
<p>John Clifton Davies was <a href="https://www.heart.co.uk/fourcounties/news/local/mk-man-convicted-of-mass-fraud/" target="_blank" rel="noopener">convicted in 2015</a> of swindling businesses throughout the U.K. that were struggling financially and seeking to restructure their debt. For roughly six years, Davies ran a series of firms that pretended to offer insolvency services, but instead simply siphoned what little remaining money these companies had.</p>
<p>The very first entity mentioned in the technology portfolio advertised on the CodesToYou website is called &#8220;<strong>MySolve</strong>,&#8221; and it purports to offer a &#8220;multi-feature platform for insolvency practitioners.&#8221;</p>
<p>Mr. Davies&#8217; fourth wife, <strong>Iryna Davies</strong>, is listed as a director of one of the insolvency consulting businesses in the U.K. that was part of John Davies’ 2015 fraud conviction. Prior to his trial for fraud, Davies served 16 months in jail before <a href="https://www.bbc.com/news/uk-wales-21850549" target="_blank" rel="noopener">being cleared</a> of murdering his third wife on their honeymoon in India: <strong>Colette Davies</strong>, 39, died after falling 80 feet from a viewing point at a steep gorge in the Himachal Pradesh region of India.</p>
<p>Mr. Davies was charged with murder and fraud after he attempted to collect GBP 132,000 in her life insurance payout, but British prosecutors ultimately conceded they did not have enough evidence to convict him.</p>
<p>The scams favored by Davies and his alter egos are smart because he never approaches investors directly; rather, investors are incentivized to put his portfolio in front of tech firms seeking financial backing. And all the best cons begin as an idea or possibility planted in the target’s mind.</p>
<p>It&#8217;s also a reliable scam because companies bilked by small-time investment schemes rarely pursue legal action, mainly because the legal fees involved can quickly surpass the losses. On top of that, many victims will likely be too ashamed to admit their duping. Victims who do press their case in court and win then face the daunting challenge of collecting damages from a slew of ephemeral shell corporations.</p>
<p>The latest Bernard victim to speak publicly — a Norwegian company hoping to build a fleet of environmentally friendly shipping vessels — is now <a href="https://krebsonsecurity.com/2022/01/fake-investor-john-bernard-sinks-norwegian-green-shipping-dreams/" target="_blank" rel="noopener">embroiled in a lawsuit over a deal gone bad</a>. As part of that scam, Bernard falsely claimed to have secured $100 million from six other wealthy investors, including the founder of <strong>Uber</strong> and the artist <strong>Abel Makkonen Tesfaye</strong>, better known as <strong>The Weeknd</strong>.</p>
<div class="entry-content">
<p>If you liked this story, check out my previous reporting on John Bernard/Davies:</p>
<p><a href="https://krebsonsecurity.com/2020/09/due-diligence-that-money-cant-buy/" target="_blank" rel="noopener">Due Diligence That Money Can’t Buy</a></p>
<p><a href="https://krebsonsecurity.com/2020/09/who-is-tech-investor-john-bernard/" target="_blank" rel="noopener">Who is Tech Investor John Bernard?</a></p>
<p><a href="https://krebsonsecurity.com/2020/10/promising-infusions-of-cash-fake-investor-john-bernard-walked-away-with-30m/" target="_blank" rel="noopener">Promising Infusions of Cash, Fake Investor John Bernard Walked Away With $30 Million</a></p>
<p><a href="https://krebsonsecurity.com/2021/05/investment-scammer-john-davies-reinvents-himself/" target="_blank" rel="noopener">Investment Scammer John Davies Reinvents Himself?</a></p>
<p><a href="https://krebsonsecurity.com/2022/01/fake-investor-john-bernard-sinks-norwegian-green-shipping-dreams/" target="_blank" rel="noopener">Fake Investor John Bernard Sinks Norwegian Green Shipping Dreams</a></p>
</div>


feed_id: https://krebsonsecurity.com/?p=63148
title: FBI Seizes Bot Shop ‘Genesis Market’ Amid Arrests Targeting Operators, Suppliers
uri: FBI-Seizes-Bot-Shop-Genesis-Market-Amid-Arrests-Targeting-Operat
url:
https://krebsonsecurity.com/2023/04/fbi-seizes-bot-shop-genesis-market-amid-arrests-targeting-operators-suppliers/

content:
<p>Several domain names tied to <strong>Genesis Market</strong>, a bustling cybercrime store that sold access to passwords and other data stolen from millions of computers infected with malicious software, were seized by the <strong>Federal Bureau of Investigation</strong> (FBI) today. Sources tell KrebsOnsecurity the domain seizures coincided with &#8220;dozens&#8221; of arrests in the United States and abroad targeting those who allegedly operated the service, as well as suppliers who continuously fed Genesis Market with freshly-stolen data.</p>
<div id="attachment_63290" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63290" decoding="async" class=" wp-image-63290" src="media/b41d543f.g3n3siss31z3d.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/g3n3siss31z3d.png" alt="" width="750" height="458" /><p id="caption-attachment-63290" class="wp-caption-text">Several websites tied to the cybercrime store Genesis Market had their homepages changed today to this seizure notice.</p></div>
<p>Active since 2018, Genesis Market&#8217;s slogan has long been, &#8220;Our store sells bots with logs, cookies, and their real fingerprints.&#8221; Customers could search for infected systems with a variety of options, including by Internet address or by specific domain names associated with stolen credentials.</p>
<p>But earlier today, multiple domains associated with Genesis had their homepages replaced with a seizure notice from the FBI, which said the domains were seized pursuant to a warrant issued by the <strong>U.S. District Court for the Eastern District of Wisconsin</strong>.</p>
<p>The U.S. Attorney&#8217;s Office for the Eastern District of Wisconsin did not respond to requests for comment. The FBI declined to comment.</p>
<p>But sources close to the investigation tell KrebsOnSecurity that law enforcement agencies in the United States, Canada and across Europe are currently serving arrest warrants on dozens of individuals thought to support Genesis, either by maintaining the site or selling the service bot logs from infected systems.</p>
<p>The seizure notice includes the seals of law enforcement entities from several countries, including Australia, Canada, Denmark, Germany, the Netherlands, Spain, Sweden and the United Kingdom.</p>
<p>When Genesis customers purchase a bot, they&#8217;re purchasing the ability to have all of the victim&#8217;s authentication cookies loaded into their browser, so that online accounts belonging to that victim can be accessed without the need of a password, and in some cases without multi-factor authentication.</p>
<p>&#8220;You can buy a bot with a real fingerprint, access to e-mail, social networks, bank accounts, payment systems!,&#8221; a cybercrime forum ad for Genesis enthused. &#8220;You also get all previous digital life (history) of the bot – most services won’t even ask for login and password and identify you as their returning customer. Purchasing a bot kit with the fingerprint, cookies and accesses, you become the unique user of all his or her services and other web-sites. The other use of our kit of real fingerprints is to cover-up the traces of your real internet activity.&#8221;</p>
<div id="attachment_63291" style="width: 683px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63291" decoding="async" loading="lazy" class="size-full wp-image-63291" src="media/106248ba.genesis3-21.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/genesis3-21.png" alt="" width="673" height="784" /><p id="caption-attachment-63291" class="wp-caption-text">The Genesis Store had more than 450,000 bots for sale as of Mar. 21, 2023. Image: KrebsOnSecurity.</p></div>
<p>The pricing for Genesis bots ranged quite a bit, but in general bots with large amounts of passwords and authentication cookies &#8212; or those with access to specific financial websites such as <strong>PayPal</strong> and <strong>Coinbase</strong> &#8212; tended to fetch far higher prices.</p>
<p>New York based cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> says that in addition to containing a large number of resources, the most expensive bots overwhelmingly seem to have access to accounts that are easy to monetize.</p>
<p>&#8220;The high incidence of Google and Facebook is expected, as they are such widely used platforms,&#8221; Flashpoint noted in an analysis of Genesis Market, observing that all ten of the ten most expensive bots at the time included Coinbase credentials.</p>
<p>Genesis Market has introduced a number of cybercriminal innovations over its existence. Probably the best example is <strong>Genesis Security</strong>, which is a custom Web browser plugin which can load a Genesis bot profile so that the browser mimics virtually every important aspect of the victim&#8217;s device, from screen size and refresh rate to the unique user agent string tied to the victim&#8217;s web browser.<span id="more-63148"></span></p>
<p>Flashpoint said the administrators of Genesis Market claim they are a team of specialists with &#8220;extensive experience in the field of systems metrics.&#8221; They say they developed the Genesis Security software by analyzing the top forty-seven browser fingerprinting and tracking systems, as well as those utilized by 283 different banking and payment systems.</p>
<p>Cybersecurity experts say Genesis and a handful of other bot shops are also popular among cybercriminals who work to identify and purchase bots inside corporate networks, and then turn around and resell that access to ransomware gangs.</p>
<p><strong>Michael Debolt</strong>, chief intelligence officer for <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471,</a> said so-called &#8220;network access brokers&#8221; will scour automated bot shops for high value targets, and then resell them for a bigger profit.</p>
<p>&#8220;From &#8216;used&#8217; or &#8216;processed&#8217; logs — it is actually quite common for the same log to be used by multiple different actors who are all using it for different purposes &#8211; for instance, some actors are only interested in crypto wallet or banking credentials so they bypass credentials that network access brokers are interested in,&#8221; Debolt said. &#8220;These network access brokers buy these &#8216;used&#8217; logs for very cheap (or sometimes for free) and search for big fish targets from there.&#8221;</p>
<p>In June 2021, hackers who broke into and stole a wealth of source code and game data from the computer gaming giant EA <a href="https://www.vice.com/en/article/n7b3jm/genesis-market-buy-cookies-slack" target="_blank" rel="noopener">told Motherboard</a> they gained access by purchasing a $10 bot from Genesis Market that let them log into a company Slack account.</p>
<p>One feature of Genesis that sets it apart from other bot shops is that customers can retain access to infected systems in real-time, so that if the rightful owner of an infected system creates a new account online, those new credentials will get stolen and displayed in the web-based panel of the Genesis customer who purchased that bot.</p>
<p>&#8220;While some infostealers are designed to remove themselves after execution, others create persistent access,&#8221; reads a March 2023 report from cybersecurity firm <strong>SpyCloud</strong>. &#8220;That means bad actors have access to the current data for as long as the device remains infected, even if the user changes passwords.</p>
<p>SpyCloud says Genesis even advertises its commitment to keep the stolen data and the compromised systems’ fingerprints up to date.</p>
<p>&#8220;According to our research, Genesis Market had more than 430,000 stolen identities for sale as of early last year – and there are many other marketplaces like this one,&#8221; the SpyCloud report concludes.</p>
<p>This is a developing story. Any updates will be added with notice and timestamp here.</p>


feed_id: https://krebsonsecurity.com/?p=63336
title: Microsoft (& Apple) Patch Tuesday, April 2023 Edition
uri: Microsoft-(-Apple)-Patch-Tuesday-April-2023-Edition
url: https://krebsonsecurity.com/2023/04/microsoft-apple-patch-tuesday-april-2023-edition/
content:
<p><strong>Microsoft</strong> today released software updates to plug 100 security holes in its <strong>Windows</strong> operating systems and other software, including a zero-day vulnerability that is already being used in active attacks. Not to be outdone, <strong>Apple</strong> has released a set of important updates addressing <em>two</em> zero-day vulnerabilities that are being used to attack <strong>iPhones</strong>, <strong>iPads</strong> and <strong>Macs</strong>.</p>
<p><img decoding="async" class="aligncenter size-full wp-image-56287" src="media/96fddb2c.windupate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png" alt="" width="841" height="592" srcset="https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate.png 841w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-768x541.png 768w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-782x550.png 782w, https://krebsonsecurity.com/wp-content/uploads/2021/07/windupate-100x70.png 100w" sizes="(max-width: 841px) 100vw, 841px" /></p>
<p>On April 7, Apple issued emergency security updates to fix two weaknesses that are being actively exploited, including <a href="https://support.apple.com/en-us/HT213723" target="_blank" rel="noopener">CVE-2023-28206</a>, which can be exploited by apps to seize control over a device. <a href="https://support.apple.com/en-us/HT213723" target="_blank" rel="noopener">CVE-2023-28205</a> can be used by a malicious or hacked website to install code.</p>
<p>Both vulnerabilities are addressed in <a href="https://support.apple.com/en-us/HT201222" target="_blank" rel="noopener">iOS/iPadOS 16.4.1, iOS 15.5.7, and macOS 12.6.5 and 11.7.6</a>. If you use Apple devices and you don&#8217;t have automatic updates enabled (they are on by default), you should probably take care of that soon as detailed instructions on how to attack CVE-2023-28206 <a href="https://www.idownloadblog.com/2023/04/10/linus-henze-poc-cve-2023-28206/" target="_blank" rel="noopener">are now public</a>.</p>
<p>Microsoft&#8217;s bevy of 100 security updates released today include <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28252" target="_blank" rel="noopener">CVE-2023-28252</a>, which is a weakness in Windows that Redmond says is under active attack. The vulnerability is in the <strong>Windows Common Log System File System</strong> (CLFS) driver, a core Windows component that was the source of <a href="https://krebsonsecurity.com/2023/02/microsoft-patch-tuesday-february-2023-edition/" target="_blank" rel="noopener">attacks targeting a different zero-day vulnerability in February 2023</a>.</p>
<p>&#8220;If it seems familiar, that&#8217;s because there was a similar 0-day patched in the same component just two months ago,&#8221; said <strong>Dustin Childs</strong> at the <strong>Trend Micro Zero Day Initiative</strong>. &#8220;To me, that implies the original fix was insufficient and attackers have found a method to bypass that fix. As in February, there is no information about how widespread these attacks may be. This type of exploit is typically paired with a code execution bug to spread malware or ransomware.&#8221;</p>
<p>According to the security firm <strong>Qualys</strong>, this vulnerability has been leveraged by cyber criminals to deploy <strong>Nokoyawa</strong> ransomware.</p>
<p>&#8220;This is a relatively new strain for which there is some open source intel to suggest that it is possibly related to Hive ransomware – one of the most notable ransomware families of 2021 and linked to breaches of over 300+ organizations in a matter of just few months,&#8221; said <strong>Bharat Jogi</strong>, director of vulnerability and threat research at Qualys.</p>
<p>Jogi said while it is still unclear which exact threat actor is targeting CVE-2023-28252, targets have been observed in South and North America, regions across Asia and at organizations in the Middle East.<span id="more-63336"></span></p>
<p><strong>Satnam Narang</strong> at <strong>Tenable</strong> notes that CVE-2023-28252 is also the second CLFS zero-day disclosed to Microsoft by researchers from <strong>Mandiant</strong> and <strong>DBAPPSecurity</strong> (<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37969" target="_blank" rel="noopener">CVE-2022-37969</a>), though it is unclear if both of these discoveries are related to the same attacker.</p>
<p>Seven of the 100 vulnerabilities Microsoft fixed today are rated &#8220;Critical,&#8221; meaning they can be used to install malicious code with no help from the user. Ninety of the flaws earned Redmond&#8217;s slightly less-dire &#8220;Important&#8221; label, which refers to weaknesses that can be used to undermine the security of the system but which may require some amount of user interaction.</p>
<p>Narang said Microsoft has rated nearly 90% of this month&#8217;s vulnerabilities as &#8220;Exploitation Less Likely,&#8221; while just 9.3% of flaws were rated as &#8220;Exploitation More Likely.&#8221; <strong>Kevin Breen</strong> at <strong>Immersive Labs</strong> zeroed in on several notable flaws in that 9.3%, including <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28231" target="_blank" rel="noopener">CVE-2023-28231</a>, a remote code execution vulnerability in a core Windows network process (DHCP) with a CVSS score of 8.8.</p>
<p>&#8220;&#8216;Exploitation more likely&#8217; means it&#8217;s not being actively exploited but adversaries may look to try and weaponize this one,&#8221; Breen said. &#8220;Micorosft does note that successful exploitation requires an attacker to have already gained initial access to the network. This could be via social engineering, spear phishing attacks, or exploitation of other services.&#8221;</p>
<p>Breen also called attention to <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28220" target="_blank" rel="noopener">CVE-2023-28220</a> and <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28219" target="_blank" rel="noopener">CVE-2023-28219</a> &#8212; a pair of remote code execution vulnerabilities affecting <strong>Windows Remote Access Servers</strong> (RAS) that also earned Microsoft&#8217;s &#8220;exploitation more likely&#8221; label.</p>
<p>&#8220;An attacker can exploit this vulnerability by sending a specially crafted connection request to a RAS server, which could lead to remote code execution,&#8221; Breen said. While not standard in all organizations, RAS servers typically have direct access from the Internet where most users and services are connected. This makes it extremely enticing for attackers as they don’t need to socially engineer their way into an organization. They can simply scan the internet for RAS servers and automate the exploitation of vulnerable devices.&#8221;</p>
<p>For more details on the updates released today, see the <a href="https://isc.sans.edu/diary/Microsoft%20April%202023%20Patch%20Tuesday/29736" target="_blank" rel="noopener">SANS Internet Storm Center roundup</a>. If today’s updates cause any stability or usability issues in Windows, <a href="https://www.askwoody.com/2023/march-madness-here-we-come/" target="_blank" rel="noopener">AskWoody.com</a> will likely have the lowdown on that.</p>
<p>Please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any problems as a result of these patches.</p>


feed_id: https://krebsonsecurity.com/?p=63369
title: Why is ‘Juice Jacking’ Suddenly Back in the News?
uri: Why-is-Juice-Jacking-Suddenly-Back-in-the-News
url: https://krebsonsecurity.com/2023/04/why-is-juice-jacking-suddenly-back-in-the-news/
content:
<p><img decoding="async" class="aligncenter wp-image-63375" src="media/1f784d84.publiccharger.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/publiccharger.png" alt="" width="750" height="440" /></p>
<p>KrebsOnSecurity received a nice bump in traffic this week thanks to tweets from the <strong>Federal Bureau of Investigation</strong> (FBI) and the <strong>Federal Communications Commission</strong> (FCC) about &#8220;<strong>juice jacking</strong>,&#8221; a term first coined here in 2011 to describe a potential threat of data theft when one plugs their mobile device into a public charging kiosk. It remains unclear what may have prompted the alerts, but the good news is that there are some fairly basic things you can do to avoid having to worry about juice jacking.</p>
<p>On April 6, 2023, the FBI&#8217;s Denver office issued a warning about juice jacking in <a href="https://twitter.com/FBIDenver/status/1643947117650538498" target="_blank" rel="noopener">a tweet</a>.</p>
<p>&#8220;Avoid using free charging stations in airports, hotels or shopping centers,&#8221; the FBI&#8217;s Denver office warned. &#8220;Bad actors have figured out ways to use public USB ports to introduce malware and monitoring software onto devices. Carry your own charger and USB cord and use an electrical outlet instead.&#8221;</p>
<p>Five days later, the <strong>Federal Communications Commission </strong>(FCC) issued a similar warning. &#8220;Think twice before using public charging stations,&#8221; the FCC <a href="https://twitter.com/FCC/status/1645849934728511494" target="_blank" rel="noopener">tweeted</a>. &#8220;Hackers could be waiting to gain access to your personal information by installing malware and monitoring software to your devices. This scam is referred to as juice jacking.&#8221;</p>
<p>The FCC tweet also provided a link to <a href="https://www.fcc.gov/juice-jacking-dangers-public-usb-charging-stations" target="_blank" rel="noopener">the agency&#8217;s awareness page on juice jacking</a>, which was originally published in advance of the Thanksgiving Holiday in 2019 but was updated in 2021 and then again shortly after the FBI&#8217;s tweet was picked up by the news media. The alerts were so broadly and breathlessly covered in the press that a mention of juice jacking even made it into this week&#8217;s <a href="https://www.youtube.com/watch?v=_EqxubCCrB8" target="_blank" rel="noopener">Late Late Show with James Corden</a>.</p>
<p>The term juice jacking crept into the collective paranoia of gadget geeks in the summer of 2011, thanks to the headline for <a href="https://krebsonsecurity.com/2011/08/beware-of-juice-jacking/" target="_blank" rel="noopener">a story here</a> about researchers at the <strong>DEFCON</strong> hacker convention in Vegas who&#8217;d set up a mobile charging station designed to educate the unwary to the reality that many mobile devices were set up to connect to a computer and immediately sync data by default.</p>
<p>Since then, Apple, Google and other mobile device makers have changed the way their hardware and software works so that their devices no longer automatically sync data when one plugs them into a computer with a USB charging cable. Instead, users are presented with a prompt asking if they wish to trust a connected computer before any data transfer can take place.</p>
<p>On the other hand, the technology needed to conduct a sneaky juice jacking attack has become far more miniaturized, accessible and cheap. And there are now several products anyone can buy that are custom-built to enable juice jacking attacks.</p>
<p>Probably the best known example is <a href="https://shop.hak5.org/products/omg-cable" target="_blank" rel="noopener">the OMG cable</a>, a $180 hacking device made for professional penetration testers that looks more or less like an Apple or generic USB charging cable. But inside the OMG cable is a tiny memory chip and a Wi-Fi transmitter that creates a Wi-Fi hotspot, to which the attacker can remotely connect using a smartphone app and run commands on the device.</p>
<div id="attachment_63373" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63373" decoding="async" loading="lazy" class=" wp-image-63373" src="media/0e72dff1.omgcable.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/omgcable.png" alt="" width="748" height="579" /><p id="caption-attachment-63373" class="wp-caption-text">The $180 &#8220;OMG cable.&#8221; Image: hak5.org.</p></div>
<p><strong>Brian Markus</strong> is co-founder of <a href="https://www.ariessecurity.com/company/" target="_blank" rel="noopener">Aries Security</a>, and one of the researchers who originally showcased the threat from juice jacking at the 2011 DEFCON. Markus said he isn&#8217;t aware of any public accounts of juice jacking kiosks being found in the wild, and said he&#8217;s unsure what prompted the recent FBI alert.</p>
<p>But Markus said juice jacking is still a risk because it is far easier and cheaper these days for would-be attackers to source and build the necessary equipment.</p>
<p>&#8220;Since then, the technology and components have become much smaller and very easy to build, which puts this in the hands of less sophisticated threat actors,&#8221; Markus said. &#8220;Also, you can now buy all this stuff over the counter. I think the risk is possibly higher now than it was a decade ago, because a much larger population of people can now pull this off easily.&#8221;<span id="more-63369"></span></p>
<p>How seriously should we take the recent FBI warning? An investigation by the myth-busting site <strong>Snopes</strong> suggests the FBI tweet was just a public service announcement based on a dated advisory. Snopes reached out to both the FBI and the FCC to request data about how widespread the threat of juice jacking is in 2023.</p>
<p>&#8220;The FBI replied that its tweet was a &#8216;standard PSA-type post&#8217; that stemmed from the FCC warning,&#8221; Snopes <a href="https://www.snopes.com/fact-check/serious-threat-of-juice-jacking/" target="_blank" rel="noopener">reported</a>. &#8220;An FCC spokesperson told Snopes that the commission wanted to make sure that their advisory on &#8220;juice-jacking,&#8221; first issued in 2019 and later updated in 2021, was up-to-date so as to ensure &#8216;the consumers have the most up-to-date information.&#8217; The official, who requested anonymity, added that they had not seen any rise in instances of consumer complaints about juice-jacking.&#8221;</p>
<p>What can you do to avoid juice jacking? Bring your own gear. A general rule of thumb in security is that if an adversary has physical access to your device, you can no longer trust the security or integrity of that device. This also goes for things that plug into your devices.</p>
<p><a href="https://en.wikipedia.org/wiki/Juice_jacking" target="_blank" rel="noopener">Juice jacking</a> isn&#8217;t possible if a device is charged via a trusted AC adapter, battery backup device, or through a USB cable with only power wires and no data wires present. If you lack these things in a bind and still need to use a public charging kiosk or random computer, at least power your device off before plugging it in.</p>


feed_id: https://krebsonsecurity.com/?p=63330
title: Giving a Face to the Malware Proxy Service ‘Faceless’
uri: Giving-a-Face-to-the-Malware-Proxy-Service-Faceless
url: https://krebsonsecurity.com/2023/04/giving-a-face-to-the-malware-proxy-service-faceless/
content:
<p>For the past seven years, a malware-based proxy service known as &#8220;<strong>Faceless</strong>&#8221; has sold anonymity to countless cybercriminals. For less than a dollar per day, Faceless customers can route their malicious traffic through tens of thousands of compromised systems advertised on the service. In this post we&#8217;ll examine clues left behind over the past decade by the proprietor of Faceless, including some that may help put a face to the name.</p>
<div id="attachment_63408" style="width: 760px" class="wp-caption aligncenter"><a href="media/a0aa5f37.faceless-geo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless-geo.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63408" decoding="async" class="wp-image-63408" src="media/a0aa5f37.faceless-geo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless-geo.png" alt="" width="750" height="462" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless-geo.png 1345w, https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless-geo-768x473.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless-geo-782x481.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-63408" class="wp-caption-text">The proxy lookup page inside the malware-based anonymity service Faceless. Image: spur.us.</p></div>
<p><strong>Riley Kilmer</strong> is co-founder of <a href="https://www.spur.us" target="_blank" rel="noopener">Spur.us</a>, a company that tracks thousands of VPN and proxy networks, and helps customers identify traffic coming through these anonymity services. Kilmer said Faceless has emerged as one of the underground&#8217;s most reliable malware-based proxy services, mainly because its proxy network has traditionally included a great many compromised &#8220;Internet of Things&#8221; devices &#8212; such as media sharing servers &#8212; that are seldom included on malware or spam block lists.</p>
<p>Kilmer said when Spur first started looking into Faceless, they noticed almost every Internet address that Faceless advertised for rent also showed up in the IoT search engine <a href="https://www.shodan.io" target="_blank" rel="noopener">Shodan.io</a> as a media sharing device on a local network that was somehow exposed to the Internet.</p>
<p>&#8220;We could reliably look up the [fingerprint] for these media sharing devices in Shodan and find those same systems for sale on Faceless,&#8221; Kilmer said.</p>
<p>In January 2023, the Faceless service website said it was willing to pay for information about previously undocumented security vulnerabilities in IoT devices. Those with IoT zero-days could expect payment if their exploit involved at least 5,000 systems that could be identified through Shodan.</p>
<div id="attachment_63410" style="width: 759px" class="wp-caption aligncenter"><a href="media/96e2e9c1.faceless0day.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless0day.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63410" decoding="async" loading="lazy" class="wp-image-63410" src="media/96e2e9c1.faceless0day.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless0day.png" alt="" width="749" height="450" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless0day.png 1300w, https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless0day-768x461.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/faceless0day-782x470.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-63410" class="wp-caption-text">Notices posted for Faceless users, advertising an email flooding service and soliciting zero-day vulnerabilities in Internet of Things devices.</p></div>
<p>Recently, Faceless has shown ambitions beyond just selling access to poorly-secured IoT devices. In February, Faceless re-launched a service that lets users drop an email bomb on someone &#8212; causing the target&#8217;s inbox to be filled with tens of thousands of junk messages.</p>
<p>And in March 2023, Faceless started marketing a service for looking up Social Security Numbers (SSNs) that claims to provide access to &#8220;the largest SSN database on the market with a very high hit rate.&#8221;</p>
<p>Kilmer said Faceless wants to become a one-stop-fraud-shop for cybercriminals who are seeking stolen or <a href="https://www.pewtrusts.org/en/research-and-analysis/blogs/stateline/2022/04/07/thieves-hit-on-a-new-scam-synthetic-identity-fraud" target="_blank" rel="noopener">synthetic</a> identities from which to transact online, and a temporary proxy that is geographically close to the identity being sold. Faceless currently sells this bundled product for $9 &#8212; $8 for the identity and $1 for the proxy.</p>
<p>&#8220;They&#8217;re trying to be this one-stop shop for anonymity and personas,&#8221; Kilmer said. &#8220;The service basically says &#8216;here&#8217;s an SSN and proxy connection that should correspond to that user&#8217;s location and make sense to different websites.'&#8221;</p>
<h2>MRMURZA</h2>
<p>Faceless is a project from <strong>MrMurza</strong>, a particularly talkative member of more than a dozen Russian-language cybercrime forums over the past decade. According to cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, MrMurza has been active in the Russian underground since at least September 2012. Flashpoint said MrMurza appears to be extensively involved in botnet activity and &#8220;drops&#8221; &#8212; fraudulent bank accounts created using stolen identity data that are often used in money laundering and cash-out schemes.</p>
<p>Faceless grew out of a popular anonymity service called <strong>iSocks</strong>, which was launched in 2014 and advertised on multiple Russian crime forums as a proxy service that customers could use to route their malicious Web traffic through compromised computers.</p>
<p>Flashpoint says that in the months before iSocks went online, MrMurza posted on the Russian language crime forum <strong>Verified</strong> asking for a serious partner to assist in opening a proxy service, noting they had a botnet that was powered by malware that collected proxies with a 70 percent infection rate.</p>
<div id="attachment_63422" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63422" decoding="async" loading="lazy" class=" wp-image-63422" src="media/219c5a76.mrmurza.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/mrmurza.png" alt="" width="751" height="318" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/mrmurza.png 1006w, https://krebsonsecurity.com/wp-content/uploads/2023/04/mrmurza-768x325.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/mrmurza-782x331.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-63422" class="wp-caption-text">MrMurza&#8217;s Faceless advertised on the Russian-language cybercrime forum ProCrd. Image: Darkbeast/Ke-la.com.</p></div>
<p>In September 2016, MrMurza sent a message to all iSocks users saying the service would soon be phased out in favor of Faceless, and that existing iSocks users could register at Faceless for free if they did so quickly &#8212; before Faceless began charging new users registration fees between $50 and $100.</p>
<p>Verified and other Russian language crime forums where MrMurza had a presence have been hacked over the years, with contact details and private messages leaked online. In a 2014 private message to the administrator of Verified explaining his bona fides, MrMurza said he received years of positive feedback as a seller of stolen Italian credit cards and a vendor of drops services.</p>
<p>MrMurza told the Verified admin that he used the nickname <strong>AccessApproved</strong> on multiple other forums over the years. MrMurza also told the admin that his account number at the now-defunct virtual currency <a href="https://en.wikipedia.org/wiki/Liberty_Reserve" target="_blank" rel="noopener">Liberty Reserve</a> was <strong>U1018928</strong>.</p>
<p>According to cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, the user AccessApproved joined the Russian crime forum <strong>Zloy</strong> in Jan. 2012, from an Internet address in <a href="https://en.wikipedia.org/wiki/Magnitogorsk" target="_blank" rel="noopener">Magnitogorsk, RU</a>. In a 2012 private message where AccessApproved was arguing with another cybercriminal over a deal gone bad, AccessApproved asked to be paid at the Liberty Reserve address U1018928.</p>
<p>In 2013, <a href="https://krebsonsecurity.com/2013/05/u-s-government-seizes-libertyreserve-com/" target="_blank" rel="noopener">U.S. federal investigators seized Liberty Reserve</a> and charged its founders with facilitating billions of dollars in money laundering tied to cybercrime. The Liberty Reserve case was prosecuted out of the Southern District of New York, which in 2016 published <a href="https://www.plainsite.org/dockets/download.html?id=235650120&amp;a=76&amp;z=06edfcb0" target="_blank" rel="noopener">a list of account information</a> (PDF) tied to thousands of Liberty Reserve addresses the government asserts were involved in money laundering.</p>
<p>That document indicates the Liberty Reserve account claimed by MrMurza/AccessApproved &#8212; U1018928 &#8212; was assigned in 2011 to a &#8220;<strong>Vadim Panov</strong>&#8221; who used the email address <strong>lesstroy@mgn.ru</strong>.<span id="more-63330"></span></p>
<h2>PANOV</h2>
<p><a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a threat intelligence firm that tracks breached databases, says lesstroy@mgn.ru was used for an account &#8220;Hackerok&#8221; at the accounting service klerk.ru that was created from an Internet address in Magnitogorsk. The password chosen by this user was &#8220;<strong>1232</strong>.&#8221;</p>
<p>In addition to selling access to hacked computers and bank accounts, both MrMurza and AccessApproved ran side hustles on the crime forums selling clothing from popular retailers that refused to ship directly to Russia.</p>
<p>On one cybercrime forum where AccessApproved had clothing customers, denizens of the forum created a lengthy discussion thread to help users identify incoming emails associated with various reshipping services advertised within their community. Reshippers tend to rely on a large number of people in the United States and Europe helping to forward packages overseas, but in many cases the notifications about purchases and shipping details would be forwarded to reshipping service customers from a consistent email account.</p>
<p>That thread said AccessApproved&#8217;s clothing reshipping service forwarded confirmation emails from the address <strong>panov-v@mail.ru</strong>. This address is associated with accounts on two Russian cybercrime forums registered from Magnitogorsk in 2010 using the handle &#8220;<strong>Omega^gg4u</strong>.&#8221;</p>
<p>This Omega^gg4u identity sold software that can rapidly check the validity of large batches of stolen credit cards. Interestingly, both Omega^gg4u and AccessApproved also had another niche: Reselling heavily controlled substances &#8212; such as human growth hormone and anabolic steroids &#8212; from chemical suppliers in China.</p>
<p>A search in Constella on the address panov-v@mail.ru and many variations on that address shows these accounts cycled through the same passwords, including <strong>055752403k</strong>, <strong>asus666</strong>, <strong>01091987h</strong>, and the relatively weak password <strong>1232</strong> (recall that 1232 was picked by whoever registered the lesstroy@mgn.ru account at Klerk.ru).</p>
<p>Constella says the email address <strong>asus666@yandex.ru</strong> relied on the passwords asus666 and 01091987h. The 01091987h password also was used by <strong>asus666@mail.ru</strong>, which also favored the password <strong>24587256</strong>.</p>
<p>Constella further reports that whoever owned the much shorter address <strong>asus@mail.ru </strong>also used the password 24587256. In addition, it found the password <strong>2318922479</strong> was tied to both asus666@mail.ru and asus@mail.ru.</p>
<p>The email addresses asus@mail.ru, <strong>asus2504@mail.ru</strong>, and <strong>zaxar2504@rambler.ru</strong> were all used to register Vkontakte social media accounts for a <strong>Denis ***@VIP*** Pankov</strong>. There are a number of other Vkontakte accounts registered to asus@mail.ru and many variations of this address under a different name. But none of those other profiles appear tied to real-life identities.</p>
<div id="attachment_63417" style="width: 759px" class="wp-caption aligncenter"><a href="media/b3abc85d.facelessmm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/facelessmm.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63417" decoding="async" loading="lazy" class="wp-image-63417" src="media/b3abc85d.facelessmm.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/facelessmm.png" alt="" width="749" height="346" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/facelessmm.png 1853w, https://krebsonsecurity.com/wp-content/uploads/2023/04/facelessmm-768x354.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/facelessmm-1536x709.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/04/facelessmm-782x361.png 782w" sizes="(max-width: 749px) 100vw, 749px" /></a><p id="caption-attachment-63417" class="wp-caption-text">A mind map simplifying the research detailed here.</p></div>
<h2>PANKOV</h2>
<p>Constella&#8217;s data shows the email addresses <strong>asus2504@mail.ru</strong> and <strong>zaxar2504@rambler.ru</strong> used the rather unique password <strong>denis250485</strong>, which was also used by the email address <strong>denispankov@yandex.ru</strong> and almost a dozen variations at other Russian-language email providers.</p>
<p>Russian vehicle registration records from 2016 show the email address denispankov@yandex.ru belongs to <strong>Denis Viktorovich Pankov</strong>, born on April 25, 1985. That explains the &#8220;250485&#8221; portion of Pankov&#8217;s favored password. The registration records further indicate that in 2016 Pankov&#8217;s vehicle was registered in a suburb of Moscow.</p>
<p>Russian incorporation records show that denispankov@yandex.com is tied to <strong>IP Pankov Denis Viktorovich</strong>, a now-defunct transportation company in the Volograd Oblast, a region in southern Russia that shares a long border with western Kazazkhstan.</p>
<p>More recent records for IP Pankov Denis Viktorovich show a microenterprise with this name in Omsk that described its main activity as &#8220;retail sale by mail or via the Internet.&#8221; Russian corporate records indicate this entity was liquidated in 2021.</p>
<p>A reverse password search on &#8220;denis250485&#8221; via Constella shows this password was used by <em>more than 75 email addresses</em>, most of which are some variation of <strong>gaihnik@mail.ru</strong> &#8212; such as gaihnik25@mail.ru, or gaihnik2504@rambler.ru.</p>
<p>In 2012, someone posted answers to a questionnaire on behalf of Denis Viktorovich Pankov to a Russian-language discussion forum on Chinese crested dog breeds. The message said Pankov was seeking a puppy of a specific breed and was a resident of Krasnogorsk, a city that is adjacent to the northwestern boundary of Moscow.</p>
<p>The message said Pankov was a then 27-year-old manager in an advertising company, and could be reached at the email address gaihnik@mail.ru.</p>
<h2>GAIHNIK</h2>
<p>Constella Intelligence shows gaihnik@mail.ru registered at the now-defunct email marketing service <strong>Smart Responder </strong>from an address in Gagarin, which is about 115 miles west of Moscow.</p>
<p>Back in 2015, the user <strong>Gaihnik25</strong> was <a href="https://wot-news.com/track/post/ru/Darth_Abaddon/1446648382" target="_blank" rel="noopener">banned</a> from the online game <strong>World of Tanks</strong> for violating the game&#8217;s terms that prohibit &#8220;bot farming,&#8221; or the automated use of large numbers of player accounts to win some advantage that is usually related to cashing out game accounts or inventory.</p>
<p>For the past few years, someone using the nickname Gaihnik25 has been posting messages to the Russian-language hacking forum <strong>Gerki[.]pw</strong>, on discussion threads regarding software designed to &#8220;brute force&#8221; or mass-check online accounts for weak or compromised passwords.</p>
<p>A new member of the Russian hacking forum <strong>Nohide[.]Space</strong> using the handle Gaihnik has been commenting recently about proxy services, credential checking software, and the sale of hacked mailing lists. Gaihnik&#8217;s first post on the forum concerned private software for checking World of Tanks accounts.</p>
<p>The address gaihnik@mail.ru shows how so many email addresses tied to Pankov were also connected to apparently misleading identities on Vkontakte and elsewhere. Constella found this address was tied to a Vkontakte account for a <strong>Dmitriy Zakarov</strong>.</p>
<p>Microsoft&#8217;s <a href="https://www.bing.com/search?q=gaihnik%40mail.ru&amp;qs=n&amp;form=QBRE&amp;sp=-1&amp;lq=0&amp;pq=gaih&amp;sc=10-4&amp;sk=&amp;cvid=2FED2FE4A9554AD1968AFBA7EBCDB5CE&amp;ghsh=0&amp;ghacc=0&amp;ghpl=" target="_blank" rel="noopener">Bing search engine says</a> gaihnik@mail.ru belongs to 37-year-old Denis Pankov, yet clicking the Mail.ru profile for that user brings up a profile for a much older man by the name <strong>Gavril Zakarov</strong>. However, when you log in to a Mail.ru account and view that profile, it shows that most of the account&#8217;s profile photos are of a much younger man.</p>
<p>Many of those same photos show up in an <a href="https://dating.ru/gaihnik/" target="_blank" rel="noopener">online dating profile at dating.ru for the user Gaihnik</a>, a.k.a &#8220;Denchik,&#8221; who says he is a 37-year-old Taurus from Gagarin who enjoys going for walks in nature, staying up late, and being on the Internet.</p>
<p>Mr. Pankov did not respond to multiple requests for comment sent to all of the email addresses mentioned in this story. However, some of those addresses produced detailed error responses; Mail.ru reported that the users panov-v@mail.ru, asus666@mail.ru, and asus2504@mail.ru were terminated, and that gaihnik25@mail.ru is now disabled.</p>
<p>Messages sent to many other email addresses connected via passwords to Pankov and using some variation of asus####@mail.ru also returned similar account termination messages.</p>


feed_id: https://krebsonsecurity.com/?p=63451
title: 3CX Breach Was a Double Supply Chain Compromise
uri: 3CX-Breach-Was-a-Double-Supply-Chain-Compromise
url: https://krebsonsecurity.com/2023/04/3cx-breach-was-a-double-supply-chain-compromise/
content:
<p>We learned some remarkable new details this week about the recent supply-chain attack on VoIP software provider <strong>3CX</strong>, a complex, lengthy intrusion that has the makings of a cyberpunk spy novel: North Korean hackers using legions of fake executive accounts on <strong>LinkedIn</strong> to lure people into opening malware disguised as a job offer; malware targeting <strong>Mac</strong> and <strong>Linux</strong> users working at defense and cryptocurrency firms; and software supply-chain attacks nested within earlier supply chain attacks.</p>
<div id="attachment_63457" style="width: 817px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63457" decoding="async" class="size-full wp-image-63457" src="media/e4702aab.hsbc-job.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/hsbc-job.png" alt="" width="807" height="762" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/hsbc-job.png 807w, https://krebsonsecurity.com/wp-content/uploads/2023/04/hsbc-job-768x725.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/hsbc-job-782x738.png 782w" sizes="(max-width: 807px) 100vw, 807px" /><p id="caption-attachment-63457" class="wp-caption-text">Researchers at ESET say this job offer from a phony HSBC recruiter on LinkedIn was North Korean malware masquerading as a PDF file.</p></div>
<p>In late March 2023, 3CX disclosed that its desktop applications for both <strong>Windows</strong> and <strong>macOS</strong> were compromised with malicious code that gave attackers the ability to download and run code on all machines where the app was installed. 3CX says it has more than 600,000 customers and 12 million users in a broad range of industries, including aerospace, healthcare and hospitality.</p>
<p>3CX hired incident response firm <strong>Mandiant</strong>, which released a report on Wednesday that said the compromise began in 2022 when a 3CX employee installed a malware-laced software package distributed via an earlier software supply chain compromise that began with a tampered installer for <strong>X_TRADER</strong>, a software package provided by <strong>Trading Technologies</strong>.</p>
<p>&#8220;This is the first time Mandiant has seen a software supply chain attack lead to another software supply chain attack,&#8221; reads <a href="https://www.mandiant.com/resources/blog/3cx-software-supply-chain-compromise" target="_blank" rel="noopener">the April 20 Mandiant report</a>.</p>
<p>Mandiant found the earliest evidence of compromise uncovered within 3CX&#8217;s network was through the VPN using the employee&#8217;s corporate credentials, two days after the employee&#8217;s personal computer was compromised.</p>
<p>&#8220;Eventually, the threat actor was able to compromise both the Windows and macOS build environments,&#8221; 3CX said in <a href="https://www.3cx.com/blog/news/mandiant-security-update2/" target="_blank" rel="noopener">an April 20 update on their blog</a>.</p>
<p>Mandiant concluded that the 3CX attack was orchestrated by the North Korean state-sponsored hacking group known as <a href="https://en.wikipedia.org/wiki/Lazarus_Group" target="_blank" rel="noopener">Lazarus</a>, a determination that was independently reached earlier by researchers at <a href="https://securelist.com/gopuram-backdoor-deployed-through-3cx-supply-chain-attack/109344/" target="_blank" rel="noopener">Kaspersky Lab</a> and <a href="https://www.elastic.co/kr/security-labs/elastic-users-protected-from-suddenicon-supply-chain-attack" target="_blank" rel="noopener">Elastic Security</a>.</p>
<p>Mandiant found the compromised 3CX software would download malware that sought out new instructions by consulting encrypted icon files hosted on <strong>GitHub</strong>. The decrypted icon files revealed the location of the malware&#8217;s control server, which was then queried for a third stage of the malware compromise &#8212; a password stealing program dubbed ICONICSTEALER.</p>
<div id="attachment_63459" style="width: 695px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63459" decoding="async" loading="lazy" class=" wp-image-63459" src="media/c71974fa.mandiant-3cx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/mandiant-3cx.png" alt="" width="685" height="609" /><p id="caption-attachment-63459" class="wp-caption-text">The double supply chain compromise that led to malware being pushed out to some 3CX customers. Image: Mandiant.</p></div>
<p>Meanwhile, the security firm <strong>ESET</strong> today published research showing remarkable similarities between the malware used in the 3CX supply chain attack and Linux-based malware that was recently deployed via fake job offers from phony executive profiles on LinkedIn. The researchers said this was the first time Lazarus had been spotted deploying malware aimed at Linux users.</p>
<p>As <a href="https://krebsonsecurity.com/tag/linkedin-bots/" target="_blank" rel="noopener">reported in a recent series last summer here</a>, LinkedIn has been <a href="https://krebsonsecurity.com/2022/10/battle-with-bots-prompts-mass-purge-of-amazon-apple-employee-accounts-on-linkedin/" target="_blank" rel="noopener">inundated</a> this past year by fake executive profiles for people supposedly employed at a range of technology, defense, energy and financial companies. In many cases, the phony profiles <a href="https://krebsonsecurity.com/2022/09/fake-ciso-profiles-on-linkedin-target-fortune-500s/" target="_blank" rel="noopener">spoofed chief information security officers at major corporations</a>, and some attracted quite a few connections before their accounts were terminated.</p>
<p><a href="https://www.bloomberg.com/news/articles/2022-08-01/north-koreans-suspected-of-using-fake-resumes-to-steal-crypto?srnd=premium" target="_blank" rel="noopener">Mandiant</a>, <a href="https://www.proofpoint.com/us/blog/threat-insight/ta444-apt-startup-aimed-at-your-funds" target="_blank" rel="noopener">Proofpoint</a> and other experts say Lazarus has long used these bogus LinkedIn profiles to lure targets into opening a malware-laced document that is often disguised as a job offer. This ongoing North Korean espionage campaign using LinkedIn was <a href="https://www.clearskysec.com/operation-dream-job/" target="_blank" rel="noopener">first documented</a> in August 2020 by <strong>ClearSky Security</strong>, which said the Lazarus group operates dozens of researchers and intelligence personnel to maintain the campaign globally.</p>
<p><strong>Microsoft Corp.</strong>, which owns LinkedIn, said in September 2022 that it had detected <a href="https://www.microsoft.com/en-us/security/blog/2022/09/29/zinc-weaponizing-open-source-software/" target="_blank" rel="noopener">a wide range of social engineering campaigns</a> using a proliferation of phony LinkedIn accounts. Microsoft said the accounts were used to impersonate recruiters at technology, defense and media companies, and to entice people into opening a malicious file. Microsoft found the attackers often disguised their malware as legitimate open-source software like <strong>Sumatra PDF</strong> and the SSH client <strong>Putty</strong>.</p>
<p>Microsoft attributed those attacks to North Korea&#8217;s Lazarus hacking group, although they&#8217;ve traditionally referred to this group as &#8220;<strong>ZINC</strong>&#8220;. That is, until earlier this month, when Redmond <a href="https://www.microsoft.com/en-us/security/blog/2023/04/18/microsoft-shifts-to-a-new-threat-actor-naming-taxonomy/" target="_blank" rel="noopener">completely revamped the way it names threat groups</a>; Microsoft now references ZINC as &#8220;<strong>Diamond Sleet</strong>.&#8221;<span id="more-63451"></span></p>
<p>The ESET researchers said they found a new fake job lure tied to an ongoing Lazarus campaign on LinkedIn designed to compromise <strong>Linux</strong> operating systems. The malware was found inside of a document that offered an employment contract at the multinational bank HSBC.</p>
<p>&#8220;A few weeks ago, a native Linux payload was found on VirusTotal with an HSBC-themed PDF lure,&#8221; <a href="https://www.welivesecurity.com/2023/04/20/linux-malware-strengthens-links-lazarus-3cx-supply-chain-attack/" target="_blank" rel="noopener">wrote</a> ESET researchers <strong>Peter Kalnai</strong> and <strong>Marc-Etienne M.Leveille</strong>. &#8220;This completes Lazarus’s ability to target all major desktop operating systems. In this case, we were able to reconstruct the full chain, from the ZIP file that delivers a fake HSBC job offer as a decoy, up until the final payload.&#8221;</p>
<p>ESET said the malicious PDF file used in the scheme appeared to have a file extension of &#8220;.pdf,&#8221; but that this was a ruse. ESET discovered that the dot in the filename wasn&#8217;t a normal period but instead a Unicode character (U+2024) representing a &#8220;<a href="https://en.wikipedia.org/wiki/Leader_(typography)" target="_blank" rel="noopener">leader dot</a>,&#8221; which is often used in tables of contents to connect section headings with the page numbers on which those sections begin.</p>
<p>&#8220;The use of the leader dot in the filename was probably an attempt to trick the file manager into treating the file as an executable instead of a PDF,&#8221; the researchers continued. &#8220;This could cause the file to run when double-clicked instead of opening it with a PDF viewer.&#8221;</p>
<p>ESET said anyone who opened the file would see a decoy PDF with a job offer from HSBC, but in the background the executable file would download additional malware payloads. The ESET team also found the malware was able to manipulate the program icon displayed by the malicious PDF, possibly because fiddling with the file extension could cause the user&#8217;s system to display a blank icon for the malware lure.</p>
<p><strong>Kim Zetter</strong>, a veteran Wired.com reporter and now independent security journalist, interviewed Mandiant researchers who said they expect &#8220;many more victims&#8221; will be discovered among the customers of Trading Technologies and 3CX now that news of the compromised software programs is public.</p>
<p>&#8220;Mandiant informed Trading Technologies on April 11 that its X_Trader software had been compromised, but the software maker says it has not had time to investigate and verify Mandiant’s assertions,&#8221; Zetter wrote in <a href="https://zetter.substack.com/?utm_source=substack&amp;utm_medium=email&amp;utm_content=share" target="_blank" rel="noopener">her Zero Day newsletter on Substack</a>. For now, it remains unclear whether the compromised X_Trader software was downloaded by people at other software firms.</p>
<p>If there&#8217;s a silver lining here, the X_Trader software had been decommissioned in April 2020 &#8212; two years before the hackers allegedly embedded malware in it.</p>
<p>&#8220;The company hadn’t released new versions of the software since that time and had stopped providing support for the product, making it a less-than-ideal vector for the North Korean hackers to infect customers,&#8221; Zetter wrote.</p>


feed_id: https://krebsonsecurity.com/?p=63468
title: Many Public Salesforce Sites are Leaking Private Data
uri: Many-Public-Salesforce-Sites-are-Leaking-Private-Data
url: https://krebsonsecurity.com/2023/04/many-public-salesforce-sites-are-leaking-private-data/
content:
<p>A shocking number of organizations &#8212; including banks and healthcare providers &#8212; are leaking private and sensitive information from their public <strong>Salesforce Community</strong> websites, KrebsOnSecurity has learned. The data exposures all stem from a misconfiguration in Salesforce Community that allows an unauthenticated user to access records that should only be available after logging in.</p>
<div id="attachment_63474" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63474" decoding="async" class=" wp-image-63474" src="media/65c97d18.dchealth-sf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/dchealth-sf.png" alt="" width="750" height="453" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/dchealth-sf.png 1224w, https://krebsonsecurity.com/wp-content/uploads/2023/04/dchealth-sf-768x464.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/dchealth-sf-782x472.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-63474" class="wp-caption-text">A researcher found DC Health had five Salesforce Community sites exposing data.</p></div>
<p>Salesforce Community is a widely-used cloud-based software product that makes it easy for organizations to quickly create websites. Customers can access a Salesforce Community website in two ways: Authenticated access (requiring login), and guest user access (no login required). The guest access feature allows unauthenticated users to view specific content and resources without needing to log in.</p>
<p>However, sometimes Salesforce administrators mistakenly grant guest users access to internal resources, which can cause unauthorized users to access an organization&#8217;s private information and lead to potential data leaks.</p>
<p>Until being contacted by this reporter on Monday, the state of <strong>Vermont</strong> had at least five separate Salesforce Community sites that allowed guest access to sensitive data, including a Pandemic Unemployment Assistance program that exposed the applicant&#8217;s full name, Social Security number, address, phone number, email, and bank account number.</p>
<div id="attachment_63475" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63475" decoding="async" loading="lazy" class="wp-image-63475" src="media/23669ee0.vermont-salesforce.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/04/vermont-salesforce.png" alt="" width="749" height="526" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/04/vermont-salesforce.png 1074w, https://krebsonsecurity.com/wp-content/uploads/2023/04/vermont-salesforce-768x539.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/04/vermont-salesforce-782x549.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/04/vermont-salesforce-100x70.png 100w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-63475" class="wp-caption-text">This misconfigured Salesforce Community site from the state of Vermont was leaking pandemic assistance loan application data, including names, SSNs, email address and bank account information.</p></div>
<p>Vermont&#8217;s Chief Information Security Officer <a href="https://www.linkedin.com/in/scott-carbee-746243139/" target="_blank" rel="noopener">Scott Carbee</a> said his security teams have been conducting a full review of their Salesforce Community sites, and already found one additional Salesforce site operated by the state that was also misconfigured to allow guest access to sensitive information.</p>
<p>&#8220;My team is frustrated by the permissive nature of the platform,&#8221; Carbee said.</p>
<p>Carbee said the vulnerable sites were all created rapidly in response to the Coronavirus pandemic, and were not subjected to their normal security review process.</p>
<p>&#8220;During the pandemic, we were largely standing up tons of applications, and let&#8217;s just say a lot of them didn&#8217;t have the full benefit of our dev/ops process,&#8221; Carbee said. &#8220;In our case, we didn&#8217;t have any native Salesforce developers when we had to suddenly stand up all these sites.&#8221;</p>
<p>Earlier this week, KrebsOnSecurity notified Columbus, Ohio-based <strong>Huntington Bank</strong> that its recently acquired <strong>TCF Bank</strong> had a Salesforce Community website that was leaking documents related to commercial loans. The data fields in those loan applications included name, address, full Social Security number, title, federal ID, IP address, average monthly payroll, and loan amount.</p>
<p>Huntington Bank has disabled the leaky TCF Bank Salesforce website. <strong>Matthew Jennings</strong>, deputy chief information security officer at Huntington, said the company was still investigating how the misconfiguration occurred, how long it lasted, and how many records may have been exposed.<span id="more-63468"></span></p>
<p>KrebsOnSecurity learned of the leaks from security researcher <strong>Charan Akiri</strong>, who said he wrote a program that identified hundreds of other organizations running misconfigured Salesforce pages. But Akiri said he&#8217;s been wary of probing too far, and has had difficulty getting responses from most of the organizations he has notified to date.</p>
<p>&#8220;In January and February 2023, I contacted government organizations and several companies, but I did not receive any response from these organizations,&#8221; Akiri said. &#8220;To address the issue further, I reached out to several CISOs on LinkedIn and Twitter. As a result, five companies eventually fixed the problem. Unfortunately, I did not receive any responses from government organizations.&#8221;</p>
<p>The problem Akiri has been trying to raise awareness about came to the fore in August 2021, when security researcher <a href="https://hackerone.com/aaron_costello?type=user" target="_blank" rel="noopener">Aaron Costello</a> published a blog post explaining how misconfigurations in Salesforce Community sites could be exploited to reveal sensitive data (Costello subsequently published a follow-up post detailing <a href="https://web.archive.org/web/20210812053905/https://www.enumerated.de/index/salesforce" target="_blank" rel="noopener">how to lock down Salesforce Community sites</a>).</p>
<p>On Monday, KrebsOnSecurity used Akiri&#8217;s findings to notify <strong>Washington D.C.</strong> city administrators that at least five different public <strong>DC Health</strong> websites were leaking sensitive information. One DC Health Salesforce Community website designed for health professionals seeking to renew licenses with the city leaked documents that included the applicant&#8217;s full name, address, Social Security number, date of birth, license number and expiration, and more.</p>
<p>Akiri said he notified the Washington D.C. government in February about his findings, but received no response. Reached by KrebsOnSecurity, interim Chief Information Security Officer <strong>Mike Rupert</strong> initially said the District had hired a third party to investigate, and that the third party confirmed the District&#8217;s IT systems were <em>not</em> vulnerable to data loss from the reported Salesforce configuration issue.</p>
<p>But after being presented with a document including the Social Security number of a health professional in D.C. that was downloaded in real-time from the DC Health public Salesforce website, Rupert acknowledged his team had overlooked some configuration settings.</p>
<p>Washington, D.C. health administrators are still smarting from a data breach earlier this year at the health insurance exchange <strong>DC Health Link</strong>, which exposed personal information for more than 56,000 users, including many members of Congress.</p>
<p>That data later wound up for sale on a top cybercrime forum. The Associated Press <a href="https://apnews.com/article/congress-dc-data-breach-cyber-security-7505d83dfa5ddb06765e6ff4de9abfcc" target="_blank" rel="noopener">reports</a> that the DC Health Link breach was likewise the result of human error, and said an investigation revealed the cause was a DC Health Link server that was &#8220;misconfigured to allow access to the reports on the server without proper authentication.&#8221;</p>
<p>Salesforce says the data exposures are not the result of a vulnerability inherent to the Salesforce platform, but they can occur when customers&#8217; access control permissions are misconfigured.</p>
<p>&#8220;As previously communicated to all Experience Site and Sites customers, we recommend utilizing the <a href="https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FR6GaUAL" target="_blank" rel="noopener">Guest User Access Report Package</a> to assist in reviewing access control permissions for unauthenticated users,&#8221; reads a Salesforce <a href="https://help.salesforce.com/s/articleView?id=000390044&amp;type=1" target="_blank" rel="noopener">advisory from Sept. 2022</a>. &#8220;Additionally, we suggest reviewing the following <a href="https://help.salesforce.com/s/articleView?id=sf.networks_guest_profile_best_practices.htm&amp;type=5&amp;language=en_US" target="_blank" rel="noopener">Help article, Best Practices and Considerations When Configuring the Guest User Profile</a>.&#8221;</p>
<p>In a written statement, Salesforce said it is actively focused on data security for organizations with guest users, and that it continues to release &#8220;robust tools and guidance for our customers,&#8221; including:</p>
<p dir="ltr" role="presentation"><a href="https://appexchange.salesforce.com/appxListingDetail?listingId=a0N3A00000FR6GaUAL&amp;tab=e" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://appexchange.salesforce.com/appxListingDetail?listingId%3Da0N3A00000FR6GaUAL%26tab%3De&amp;source=gmail&amp;ust=1682623024330000&amp;usg=AOvVaw3czfAVX57PBb-qHltOkrST">Guest User Access Report </a></p>
<p dir="ltr" role="presentation"><a href="https://help.salesforce.com/s/articleView?id=sf.networks_user_sharing.htm&amp;type=5" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://help.salesforce.com/s/articleView?id%3Dsf.networks_user_sharing.htm%26type%3D5&amp;source=gmail&amp;ust=1682623024330000&amp;usg=AOvVaw2sCS-9VHuM2AxBn2hDcely">Control Which Users Experience Cloud Site Users Can See</a></p>
<p dir="ltr" role="presentation"><a href="https://help.salesforce.com/s/articleView?id=sf.networks_guest_profile_best_practices.htm&amp;type=5" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://help.salesforce.com/s/articleView?id%3Dsf.networks_guest_profile_best_practices.htm%26type%3D5&amp;source=gmail&amp;ust=1682623024330000&amp;usg=AOvVaw1TJfHyMj9g-wAvewJhEwIr">Best Practices and Considerations When Configuring the Guest User Profile</a></p>
<p dir="ltr">&#8220;We’ve also <a href="https://help.salesforce.com/s/articleView?id=sf.networks_guest_policies_timelines.htm&amp;type=5" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?q=https://help.salesforce.com/s/articleView?id%3Dsf.networks_guest_policies_timelines.htm%26type%3D5&amp;source=gmail&amp;ust=1682623024330000&amp;usg=AOvVaw3cFoh4zxZD5olvrn9qUtZ8">continued to update</a> our Guest User security policies, beginning with our Spring ‘21 release with more to come in Summer ‘23,&#8221; the statement reads. &#8220;Lastly, we continue to proactively communicate with customers to help them understand the capabilities available to them, and how they can best secure their instance of Salesforce to meet their security, contractual, and regulatory obligations.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=63506
title: Promising Jobs at the U.S. Postal Service, ‘US Job Services’ Leaks Customer Data
uri: Promising-Jobs-at-the-U-S-Postal-Service-US-Job-Services-Leaks
url:
https://krebsonsecurity.com/2023/05/promising-jobs-at-the-u-s-postal-service-us-job-services-leaks-customer-data/

content:
<p>A sprawling online company based in Georgia that has made tens of millions of dollars purporting to sell access to jobs at the <strong>United States Postal Service</strong> (USPS) has exposed its internal IT operations and database of nearly 900,000 customers. The leaked records indicate the network&#8217;s chief technology officer in Pakistan has been hacked for the past year, and that the entire operation was created by the principals of a Tennessee-based telemarketing firm that has promoted USPS employment websites since 2016.</p>
<div id="attachment_63510" style="width: 759px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63510" decoding="async" class=" wp-image-63510" src="media/9e4652e2.federaljobscenter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/federaljobscenter.png" alt="" width="749" height="413" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/federaljobscenter.png 1594w, https://krebsonsecurity.com/wp-content/uploads/2023/05/federaljobscenter-768x423.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/federaljobscenter-1536x846.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/05/federaljobscenter-782x431.png 782w" sizes="(max-width: 749px) 100vw, 749px" /><p id="caption-attachment-63510" class="wp-caption-text">The website FederalJobsCenter promises to get you a job at the USPS in 30 days or your money back.</p></div>
<p>KrebsOnSecurity was recently contacted by a security researcher who said he found a huge tranche of full credit card records exposed online, and that at first glance the domain names involved appeared to be affiliated with the USPS.</p>
<p>Further investigation revealed a long-running international operation that has been emailing and text messaging people for years to sign up at a slew of websites that all promise they can help visitors secure employment at the USPS.</p>
<p>Sites like <strong>FederalJobsCenter[.]com</strong> also show up prominently in Google search results for USPS employment, and steer applicants toward making credit card &#8220;registration deposits&#8221; to ensure that one&#8217;s application for employment is reviewed. These sites also sell training, supposedly to help ace an interview with USPS human resources.</p>
<p>FederalJobsCenter&#8217;s website is full of content that makes it appear the site is affiliated with the USPS, although its &#8220;terms and conditions&#8221; state that it is not. Rather, the terms state that FederalJobsCenter is affiliated with an entity called <strong>US Job Services</strong>, which says it is based in Lawrenceville, Ga.</p>
<p>&#8220;US Job Services provides guidance, coaching, and live assistance to postal job candidates to help them perform better in each of the steps,&#8221; the website explains.</p>
<p>The site says applicants need to make a credit card deposit to register, and that this amount is refundable if the applicant is not offered a USPS job within 30 days after the interview process.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-63524" src="media/3fab79d3.fjc-apply.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/fjc-apply.png" alt="" width="751" height="414" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/fjc-apply.png 1594w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fjc-apply-768x423.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fjc-apply-1536x846.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fjc-apply-782x431.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></p>
<p>But a review of the <a href="https://www.bbb.org/us/ga/atlanta/profile/government-employment-service/job-support-services-0443-27662017/complaints" target="_blank" rel="noopener">public feedback</a> on US Job Services and dozens of similar names connected to this entity over the years shows a pattern of activity: Applicants pay between $39.99 and $100 for USPS job coaching services, and receive little if anything in return. Some reported being charged the same amount monthly.</p>
<p>The <strong>U.S. Federal Trade Commission</strong> (FTC) has sued several times over the years to disrupt various schemes offering to help people get jobs at the Postal Service. Way back in 1998, the FTC and the USPS <a href="https://www.ftc.gov/news-events/news/press-releases/1998/01/ftc-us-postal-service-deliver-special-message-stamp-out-job-fraud" target="_blank" rel="noopener">took action</a> against several organizations that were selling test or interview preparation services for potential USPS employees.</p>
<p><span class="pullquote pqright">&#8220;Companies promising jobs with the U.S. Postal Service are breaking federal law,&#8221; the joint USPS-FTC statement said.</span></p>
<p>In that 1998 case, the defendants behind the scheme were taking out classified ads in newspapers. Ditto for <a href="https://www.ftc.gov/news-events/news/press-releases/2005/11/ftc-stops-bogus-post-office-job-offers" target="_blank" rel="noopener">a case the FTC brought in 2005</a>. By 2008, the USPS job exam preppers had shifted to advertising their schemes <a href="https://www.ftc.gov/news-events/news/press-releases/2008/11/ftc-charges-marketers-operating-postal-job-scheme-0" target="_blank" rel="noopener">mostly online</a>. And in 2013, the FTC won a <a href="https://www.ftc.gov/news-events/news/press-releases/2013/07/operators-postal-jobs-scheme-banned-selling-employment-services" target="_blank" rel="noopener">nearly $5 million</a> judgment against a Kentucky company purporting to offer such services.</p>
<p><strong>Tim McKinlay</strong> authored <a href="https://affiliateunguru.com/job-postal-com-review" target="_blank" rel="noopener">a report</a> last year at <strong>Affiliateunguru.com</strong> on whether the US Job Services website <strong>job-postal[.]com</strong> was legitimate or a scam. He concluded it was a scam based on several factors, including that the website listed multiple other names (suggesting it had recently switched names), and that he got nothing from the transaction with the job site.</p>
<p>&#8220;They openly admit they’re not affiliated with the US Postal Service, but claim to be experts in the field, and that, just by following the steps on their site, you easily pass the postal exams and get a job in no time,&#8221; McKinlay wrote. &#8220;But it’s really just a smoke and mirrors game. The site’s true purpose is to collect $46.95 from as many people as possible. And considering how popular this job is, they’re probably making a killing.&#8221;</p>
<h2>US JOB SERVICES</h2>
<p>KrebsOnSecurity was alerted to the data exposure by <strong>Patrick Barry</strong>, chief information officer at Charlotte, NC based <a href="https://rebycsecurity.com/" target="_blank" rel="noopener">Rebyc Security</a>. Barry said he found that not only was US Job Services leaking its customer payment records in real-time and going back to 2016, but <em>its website also leaked a log file from 2019 containing the site administrator&#8217;s contact information and credentials to the site&#8217;s back-end database</em>.</p>
<p>Barry shared screenshots of that back-end database, which show the email address for the administrator of US Job Services is<strong> tab.webcoder@gmail.com</strong>. According to cyber intelligence platform <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, that email address is tied to the <a href="https://www.linkedin.com/in/tabish-mirza-05121046/" target="_blank" rel="noopener">LinkedIn profile</a> for a developer in Karachi, Pakistan named <strong>Muhammed Tabish Mirza</strong>.</p>
<p>A search on tab.webcoder@gmail.com at <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> reveals that email address was used to register several USPS-themed domains, including <strong>postal2017[.]com</strong>, <strong>postaljobscenter[.]com</strong> and <strong>usps-jobs[.]com</strong>.</p>
<p>Mr. Mirza declined to respond to questions, but the exposed database information was removed from the Internet almost immediately after KrebsOnSecurity shared the offending links.</p>
<p>A &#8220;Campaigns&#8221; tab on that web panel listed several advertising initiatives tied to US Job Services websites, with names like &#8220;walmart drip campaign,&#8221; &#8220;hiring activity due to virus,&#8221; &#8220;opt-in job alert SMS,&#8221; and &#8220;postal job opening.&#8221;</p>
<p>Another page on the US Job Services panel included a script for upselling people who call in response to email and text message solicitations, with an add-on program that normally sells for $1,200 but is being &#8220;practically given away&#8221; for a limited time, for just $49.</p>
<div id="attachment_63513" style="width: 761px" class="wp-caption aligncenter"><a href="media/7ebaca1b.usjobs-script.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/usjobs-script.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63513" decoding="async" loading="lazy" class="wp-image-63513" src="media/7ebaca1b.usjobs-script.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/usjobs-script.png" alt="" width="751" height="425" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/usjobs-script.png 1127w, https://krebsonsecurity.com/wp-content/uploads/2023/05/usjobs-script-768x435.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/usjobs-script-782x443.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-63513" class="wp-caption-text">An upselling tutorial for call center employees.</p></div>
<p>&#8220;There&#8217;s something else we have you can take advantage of that can help you make more money,&#8221; the script volunteers. &#8220;It&#8217;s an easy to use 12-month career development plan and program to follow that will result in you getting any job you want, not just at the post office&#8230;.anywhere&#8230;and then getting promoted rapidly.&#8221;</p>
<p>It&#8217;s bad enough that US Job Services was leaking customer data: Constella Intelligence says the email address tied to Mr. Mirza shows up in more than a year&#8217;s worth of &#8220;bot logs&#8221; created by a malware infection from the <a href="https://securityboulevard.com/2023/02/redline-stealer-malware-the-complete-guide/" target="_blank" rel="noopener"><strong>Redline</strong> infostealer</a>.</p>
<p>Constella reports that for roughly a year between 2021 and 2022, a Microsoft Windows device regularly used by Mr. Mirza and his colleagues was actively uploading all of the device&#8217;s usernames, passwords and authentication cookies <a href="https://krebsonsecurity.com/2023/04/fbi-seizes-bot-shop-genesis-market-amid-arrests-targeting-operators-suppliers/" target="_blank" rel="noopener">to cybercriminals based in Russia</a>.</p>
<h2>NEXT LEVEL SUPPORT</h2>
<p>The web-based backend for US Job Services lists more than 160 people under its &#8220;Users &amp; Teams&#8221; tab. This page indicates that access to the consumer and payment data collected by US Job Services is currently granted to several other coders who work with Mr. Mirza in Pakistan, and to multiple executives, contractors and employees working for a call center in Murfreesboro, Tennessee.</p>
<p>The call center &#8212; which operates as <strong>Nextlevelsupportcenters[.]com</strong> and <strong>thenextlevelsupport[.]com</strong> &#8212; curiously has several key associates with a history of registering USPS jobs-related domain names.</p>
<div id="attachment_63543" style="width: 761px" class="wp-caption aligncenter"><a href="media/11ee6c50.nl-users.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/nl-users.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63543" decoding="async" loading="lazy" class="wp-image-63543" src="media/11ee6c50.nl-users.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/nl-users.png" alt="" width="751" height="373" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/nl-users.png 1574w, https://krebsonsecurity.com/wp-content/uploads/2023/05/nl-users-768x382.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/nl-users-1536x763.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/05/nl-users-782x389.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-63543" class="wp-caption-text">The US Job Services website has more than 160 users, including most of the employees at Next Level Support.</p></div>
<p>The website for NextLevelSupport says it was founded in 2017 by a <strong><a href="https://twitter.com/lakelure1960" target="_blank" rel="noopener">Gary Plott</a>, </strong>whose <a href="https://www.linkedin.com/in/gary-plott-7b5b434/" target="_blank" rel="noopener">LinkedIn profile</a> describes him as a seasoned telecommunications industry expert. The leaked backend database for US Job Services says Plott is a current administrator on the system, along with several other Nextlevel founders listed on the company&#8217;s site.</p>
<p>Reached via telephone, Plott initially said his company was merely a &#8220;white label&#8221; call center that multiple clients use to interact with customers, and that the content their call center is responsible for selling on behalf of US Job Services was not produced by NextLevelSupport.</p>
<p>&#8220;A few years ago, we started providing support for this postal product,&#8221; Plott said. &#8220;We didn&#8217;t develop the content but agreed we would support it.&#8221;</p>
<p>Interestingly, DomainTools says the Gmail address used by Plott in the US Jobs system was also used to register multiple USPS job-related domains, including <strong>postaljobssite[.]com</strong>, <strong>postalwebsite[.]com</strong>, <strong>usps-nlf[.]com</strong>, <strong>usps-nla[.]com</strong>.</p>
<p>Asked to reconcile this with his previous statement, Plott said he never did anything with those sites but acknowledged that his company did decide to focus on the US Postal jobs market from the very beginning.</p>
<p>Plott said his company never refuses to issue a money-back request from a customer, because doing so would result in costly chargebacks for NextLevel (and presumably for the many credit card merchant accounts apparently set up by Mr. Mirza).</p>
<p>&#8220;We&#8217;ve never been deceptive,&#8221; Plott said, noting that customers of the US Job Services product receive a digital download with tips on how to handle a USPS interview, as well as unlimited free telephone support if they need it.</p>
<p>&#8220;We&#8217;ve never told anyone we were the US Postal Service,&#8221; Plott continued. &#8220;We make sure people fully understand that they are not required to buy this product, but we think we can help you and we have testimonials from people we have helped. But ultimately you as the customer make that decision.&#8221;<span id="more-63506"></span></p>
<p>An email address in the US Job Services teams page for another user &#8212; <strong>Stephanie Dayton</strong> &#8212; was used to register the domains <strong>postalhiringreview[.]com</strong>, and <strong>postalhiringreviewboard[.]org</strong> back in 2014. Reached for comment, Ms. Dayton said she has provided assistance to Next Level Support Centers with their training and advertising, but never in the capacity as an employee.</p>
<p>Perhaps the most central NextLevel associate who had access to US Job Services was <strong>Russell Ramage</strong>, a telemarketer from Warner Robins, Georgia. Ramage is listed in South Carolina <a href="https://opengovus.com/georgia-business/2640382" target="_blank" rel="noopener">incorporation records</a> as the owner of a now-defunct call center service called <strong>Smart Logistics</strong>, a company whose name appears in the website registration records for several early and long-running US Job Services sites.</p>
<div id="attachment_63537" style="width: 761px" class="wp-caption aligncenter"><a href="media/5862392d.ramage-ga.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/ramage-ga.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63537" decoding="async" loading="lazy" class="wp-image-63537" src="media/5862392d.ramage-ga.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/ramage-ga.png" alt="" width="751" height="192" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/ramage-ga.png 1574w, https://krebsonsecurity.com/wp-content/uploads/2023/05/ramage-ga-768x197.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/ramage-ga-1536x393.png 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/05/ramage-ga-782x200.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-63537" class="wp-caption-text">According to the state of Georgia, Russell Ramage was the registered agent of several USPS job-themed companies.</p></div>
<p>The leaked records show the email address used by Ramage also registered multiple USPS jobs-related domains, including <strong>postalhiringcenter[.]com</strong>, <strong>postalhiringreviews[.]com</strong>, <strong>postaljobs-email[.]com</strong>, and <strong>postaljobssupport1[.]com</strong>.</p>
<p>A review of business incorporation records in Georgia indicate Ramage was the registered agent for at least three USPS-related companies over the years, including <strong>Postal Career Placement LLC</strong>, <strong>Postal Job Services Inc.</strong>, and <strong>Postal Operations Inc. </strong>All three companies were founded in 2015, and are now dissolved.</p>
<p>An obituary dated February 2023 says Russell Ramage recently <a href="https://www.byrdandflanigan.com/obituary/Russell-Ramage#tributewall" target="_blank" rel="noopener">passed away</a> at the age of 41. No cause of death was stated, but the obituary goes on to say that Russ &#8220;Rusty&#8221; Ramage was &#8220;preceded in death by his mother, Anita Lord Ramage, pets, Raine and Nola and close friends, Nicole Reeves and <strong>Ryan Rawls</strong>.&#8221;</p>
<p>In 2014, then 33-year-old Ryan &#8220;<a href="https://twitter.com/jootgatter/with_replies" target="_blank" rel="noopener">Jootgater</a>&#8221; Rawls of Alpharetta, Georgia <a href="https://www.reuters.com/article/us-usa-drugtrafficking-netherlands/dutch-national-pleads-guilty-in-u-s-to-running-online-narcotics-bazaar-idUKKBN0GZ0PG20140904" target="_blank" rel="noopener">pleaded guilty</a> to conspiring to distribute controlled substances. Rawls also grew up in Warner Robins, and was one of eight suspects charged with operating a secret darknet narcotics ring called the <strong>Farmer&#8217;s Market</strong>, which federal prosecutors said trafficked in millions of dollars worth of controlled substances.</p>
<p>Reuters reported that an eighth suspect in that case had died by the time of Rawls&#8217; 2014 guilty plea, although prosecutors declined to offer further details about that. According to <a href="https://heritagememorialfuneralhome.com/tribute/details/119495/Ryan-Rawls/obituary.html" target="_blank" rel="noopener">his obituary</a>, Ryan Christopher Rawls died at the age of 38 on Jan. 28, 2019.</p>
<p>In a comment on Ramage&#8217;s memorial wall, Stephanie Dayton said she began working with Ramage in 2006.</p>
<p>&#8220;Our friendship far surpassed a working one, we had a very close bond and became like brother and sister,&#8221; Dayton wrote. &#8220;I loved Russ deeply and he was like family. He was truly one of the best human beings I have ever known. He was kind and sweet and truly cared about others. Never met anyone like him. He will be truly missed. RIP brother.&#8221;</p>
<p>The FTC and USPS note that while applicants for many entry-level postal jobs are required to take a free postal exam, the tests are usually offered only every few years in any particular district, and there are no job placement guarantees based on score.</p>
<p>&#8220;If applicants pass the test by scoring at least 70 out of 100, they are placed on a register, ranked by their score,&#8221; the FTC explained. &#8220;When a position becomes open, the local post office looks to the applicable register for that geographic location and calls the top three applicants. The score is only one of many criteria taken into account for employment. The exams test general aptitude, something that cannot necessarily be increased by studying.&#8221;</p>
<p>The FTC says anyone interested in a job at the USPS should inquire at their local postal office, where applicants generally receive a free packet of information about required exams. More information about job opportunities at the postal service is available at <a href="https://about.usps.com/careers/" target="_blank" rel="noopener">the USPS&#8217;s careers website</a>.</p>
<p><strong>Michael Martel</strong>, spokesperson for the <strong>United States Postal Inspection Service</strong>, said in a written statement that the USPS has no affiliation with the websites or companies named in this story.</p>
<p>&#8220;To learn more about employment with USPS, visit USPS.com/careers,&#8221; Martel wrote. &#8220;If you are the victim of a crime online report it to the FBI’s Internet Crime Complaint Center (IC3) at <a href="https://www.ic3.gov" target="_blank" rel="noopener">www.ic3.gov</a>. To report fraud committed through or toward the USPS, its employees, or customers, report it to the United States Postal Inspection Service (USPIS) at <a href="https://www.uspis.gov/report" target="_blank" rel="noopener">www.uspis.gov/report</a>.&#8221;</p>
<p>According to the leaked back-end server for US Job Services, here is a list of the current sites selling this product:</p>
<p>usjobshelpcenter[.]com<br />
usjobhelpcenter[.]com<br />
job-postal[.]com<br />
localpostalhiring[.]com<br />
uspostalrecruitment[.]com<br />
postalworkerjob[.]com<br />
next-level-now[.]com<br />
postalhiringcenters[.]com<br />
postofficehiring[.]com<br />
postaljobsplacement[.]com<br />
postal-placement[.]com<br />
postofficejobopenings[.]com<br />
postalexamprep[.]com<br />
postaljobssite[.]com<br />
postalwebsite[.]com<br />
postalcareerscenters[.]com<br />
postal-hiring[.]com<br />
postal-careers[.]com<br />
postal-guide[.]com<br />
postal-hiring-guide[.]com<br />
postal-openings[.]com<br />
postal-placement[.]com<br />
postofficeplacements[.]com<br />
postalplacementservices[.]com<br />
postaljobs20[.]com<br />
postal-jobs-placement[.]com<br />
postaljobopenings[.]com<br />
postalemployment[.]com<br />
postaljobcenters[.]com<br />
postalmilitarycareers[.]com<br />
epostaljobs[.]com<br />
postal-job-center[.]com<br />
postalcareercenter[.]com<br />
postalhiringcenters[.]com<br />
postal-job-center[.]com<br />
postalcareercenter[.]com<br />
postalexamprep[.]com<br />
postalplacementcenters[.]com<br />
postalplacementservice[.]com<br />
postalemploymentservices[.]com<br />
uspostalhiring[.]com</p>


feed_id: https://krebsonsecurity.com/?p=63585
title: $10M Is Yours If You Can Get This Guy to Leave Russia
uri: 10M-Is-Yours-If-You-Can-Get-This-Guy-to-Leave-Russia
url: https://krebsonsecurity.com/2023/05/10m-is-yours-if-you-can-get-this-guy-to-leave-russia/
content:
<p>The U.S. government this week put a $10 million bounty on the head of a Russian man who for the past 18 years operated <strong>Try2Check</strong>, one of the cybercrime underground&#8217;s most trusted services for checking the validity of stolen credit card data. U.S. authorities say 43-year-old <strong>Denis Kulkov</strong>&#8216;s card-checking service made him at least $18 million, which he used to buy a Ferrari, Land Rover, and other luxury items.</p>
<div id="attachment_63589" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63589" decoding="async" class=" wp-image-63589" src="media/327f6493.kulkov-ferrari.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-ferrari.png" alt="" width="750" height="557" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-ferrari.png 969w, https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-ferrari-768x571.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-ferrari-782x581.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-63589" class="wp-caption-text">Denis Kulkov, a.k.a. &#8220;Nordex,&#8221; in his Ferrari. Image: USDOJ.</p></div>
<p>Launched in 2005, Try2Check soon was processing more than a million card-checking transactions per month &#8212; charging 20 cents per transaction. Cybercriminals turned to services like this after purchasing stolen credit card data from an underground shop, with an eye toward minimizing the number of cards that are inactive by the time they are put to criminal use.</p>
<p>Try2Check was so reliable that it eventually became the official card-checking service for some of the underground&#8217;s most bustling crime bazaars, including Vault Market, <a href="https://krebsonsecurity.com/?s=unicc" target="_blank" rel="noopener">Unicc</a>, and <a href="https://krebsonsecurity.com/tag/jokers-stash/" target="_blank" rel="noopener">Joker&#8217;s Stash</a>. Customers of these carding shops who chose to use the shop&#8217;s built-in (but a-la-carte) card checking service from Try2Check could expect automatic refunds on any cards that were found to be inactive or canceled at the time of purchase.</p>
<p>Many established stolen card shops will allow customers to request refunds on dead cards based on official reports from trusted third-party checking services. But in general, the bigger shops have steered customers toward using their own white-labeled version of the Try2Check service &#8212; primarily to help minimize disputes over canceled cards.</p>
<p>On Wednesday, May 3, Try2Check&#8217;s websites were replaced with a domain seizure notice from the <strong>U.S. Secret Service</strong> and <strong>U.S. Department of Justice</strong>, as prosecutors in the <a href="https://www.justice.gov/usao-edny/pr/cybercriminal-network-fueling-global-stolen-credit-card-trade-dismantled" target="_blank" rel="noopener">Eastern District of New York</a> unsealed an indictment and search warrant naming <strong>Denis Gennadievich Kulkov</strong> of Samara, Russia as the proprietor.</p>
<div id="attachment_63600" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63600" decoding="async" loading="lazy" class=" wp-image-63600" src="media/5fbc9952.try2seize.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/try2seize.png" alt="" width="750" height="419" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/try2seize.png 795w, https://krebsonsecurity.com/wp-content/uploads/2023/05/try2seize-768x429.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/try2seize-782x437.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-63600" class="wp-caption-text">Try2Check&#8217;s login pages have been replaced with a seizure notice from U.S. law enforcement.</p></div>
<p>At the same time, the <strong>U.S. Department of State</strong> <a href="http://state.gov/u-s-department-of-state-announces-reward-offers-for-information-leading-to-the-arrest-and-or-conviction-of-a-russian-cybercriminal-and-identification-of-key-leaders-of-a-transnational-organized-crime/" target="_blank" rel="noopener">issued a $10 million reward</a> for information leading to the arrest <em>or</em> conviction of Kulkov. In November 2021, the State Department began <a href="https://krebsonsecurity.com/2021/11/revil-ransom-arrest-6m-seizure-and-10m-reward/" target="_blank" rel="noopener">offering up to to $10 million</a> for the name or location of any key leaders of REvil, a major Russian ransomware gang.</p>
<p>As noted in the Secret Service&#8217;s <a href="media/f529fa11.Cardcheckers-Complaint-FINAL.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/Cardcheckers-Complaint-FINAL.pdf" target="_blank" rel="noopener">criminal complaint</a> (PDF), the Try2Check service was first advertised on the closely-guarded Russian cybercrime forum <strong>Mazafaka</strong>, by someone using the handle &#8220;<strong>KreenJo</strong>.&#8221; That handle used the same ICQ instant messenger account number (<strong>555724</strong>) as a Mazafaka denizen named &#8220;<strong>Nordex</strong>.&#8221;</p>
<p>In February 2005, Nordex posted to Mazafaka that he was in the market for hacked bank accounts, and offered 50 percent of the take. He asked interested partners to contact him at the ICQ number <strong>228427661</strong> or at the email address <strong>polkas@bk.ru</strong>. As the government noted in its search warrant, Nordex exchanged messages with forum users at the time identifying himself as a then-24-year-old &#8220;Denis&#8221; from Samara, RU.</p>
<p>In 2017, U.S. law enforcement <a href="https://www.justice.gov/usao-sdny/pr/us-attorney-announces-historic-336-billion-cryptocurrency-seizure-and-conviction" target="_blank" rel="noopener">seized the cryptocurrency exchange BTC-e</a>, and the Secret Service said those records show that a Denis Kulkov from Samara supplied the username &#8220;<strong>Nordexin</strong>,&#8221; email address nordexin@ya.ru, and an address in Samara.</p>
<p>Investigators had already found Instagram accounts where Kulkov posted pictures of his Ferrari and his family. Authorities were able to identify that Kulkov had an <strong>iCloud</strong> account tied to the address <strong>nordexin@icloud.com</strong>, and upon subpoenaing that found passport photos of Kulkov, and well as more photos of his family and pricey cars.</p>
<p>Like many other top cybercriminals based in Russia or in countries with favorable relations to the Kremlin, the proprietor of Try2Check was not particularly difficult to link to a real-life identity. In Kulkov&#8217;s case, it no doubt was critical to U.S. investigators that they had access to a wealth of personal information tied to a cryptocurrency exchange Kulkov had used.</p>
<p>However, the link between Kulkov and Try2Check can be made &#8212; ironically &#8212; based on records that have been plundered by hackers and published online over the years &#8212; including Russian email services, Russian government records, and hacked cybercrime forums.<span id="more-63585"></span></p>
<h2>NORDEX</h2>
<div id="attachment_63591" style="width: 310px" class="wp-caption alignright"><img aria-describedby="caption-attachment-63591" decoding="async" loading="lazy" class=" wp-image-63591" src="media/c5f2fc44.kulkovpassport.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkovpassport.png" alt="" width="300" height="382" /><p id="caption-attachment-63591" class="wp-caption-text">Kulkov posing with his passport, in a photo authorities obtained by subpoenaing his iCloud account.</p></div>
<p>According to cybersecurity firm <a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, the address polkas@bk.ru was used to register an account with the username &#8220;Nordex&#8221; at <a href="https://web.archive.org/web/20120228150736/http://bankir.ru/" target="_blank" rel="noopener"><strong>bankir[.]com</strong></a>, a now defunct news website that was almost standard reading for Russian speakers interested in news about various Russian financial markets.</p>
<p>Nordex appears to have been a finance nerd. In his early days on the forums, Nordex posted several long threads on his views about the Russian stock market and mutual fund investments.</p>
<p>That Bankir account was registered from the Internet address <strong>193.27.237.66</strong> in Samara, Russia, and included Nordex&#8217;s date of birth as <strong>April 8, 1980</strong>, as well as their ICQ number (<strong>228427661</strong>).</p>
<p>Cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a> found that Internet address also was used to register the account &#8220;Nordex&#8221; on the Russian hacking forum <strong>Exploit</strong> back in 2006.</p>
<p>Constella tracked another Bankir[.]com account created from that same Internet address under the username &#8220;Polkas.&#8221; This account had the same date of birth as Nordex, but a different email address: <strong>nordia@yandex.ru</strong>. This and other &#8220;nordia@&#8221; emails shared a password: &#8220;<strong>anna59</strong>.&#8221;</p>
<h2>NORDIA</h2>
<p>Nordia@yandex.ru shares several passwords with <strong>nordia@list.ru</strong>, which Constella says was used to create an account at a religious website for an <strong>Anna Kulikova</strong> from Samara. At the Russian home furnishing store Westwing.ru, Ms. Kulikova listed her full name as <strong>Anna Vnrhoturkina Kulikova</strong>, and her address as 29 Kommunistrecheskya St., Apt. 110.</p>
<p>A search on that address in Constella brings up a record for an <strong>Anna Denis Vnrhoturkina Kulkov</strong>, and the phone number <strong>879608229389</strong>.</p>
<p>Russian vehicle registration records have also been hacked and leaked online over the years. Those records show that Anna&#8217;s Apt 110 address is tied to a Denis Gennadyvich Kulkov, born April 8, 1980.</p>
<p>The vehicle Kolkov registered in 2015 at that address was a 2010 <strong>Ferrari Italia</strong>, with the license plate number <strong>K022YB190</strong>. The phone number associated with this record &#8212; <strong>79608229389</strong> &#8212; is exactly like Anna&#8217;s, only minus the (mis?)leading &#8220;8&#8221;. That number also is tied to a now-defunct Facebook account, and to the email addresses nordexin@ya.ru and nordexin@icloud.com.</p>
<p>Kulkov&#8217;s Ferrari has been photographed numerous times over the years by <a href="https://migalki.net/image.php?id=613020" target="_blank" rel="noopener">Russian car aficionados</a>, including this one with the driver&#8217;s face redacted by the photographer:</p>
<div id="attachment_63590" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63590" decoding="async" loading="lazy" class=" wp-image-63590" src="media/18530a00.kulkov-roadf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-roadf.png" alt="" width="751" height="403" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-roadf.png 1441w, https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-roadf-768x412.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-roadf-782x419.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/05/kulkov-roadf-370x200.png 370w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-63590" class="wp-caption-text">The Ferrari owned by Denis Kulkov, spotted in Moscow in 2016. Image: Migalki.net.</p></div>
<p>As the title of this story suggests, the hard part for Western law enforcement isn&#8217;t identifying the Russian cybercriminals who are major players in the scene. Rather, it&#8217;s finding creative ways to capture high-value suspects if and when they do leave the protection that Russia generally extends to domestic cybercriminals within its borders who do not also harm Russian companies or consumers, or interfere with state interests.</p>
<p>But Russia&#8217;s war against Ukraine has caused major fault lines to appear in the cybercrime underground: Cybercriminal syndicates that previously straddled Russia and Ukraine with ease were forced to reevaluate many comrades who were suddenly working for The Other Side.</p>
<p>Many cybercriminals who operated with impunity from Russia and Ukraine prior to the war chose to flee those countries following the invasion, presenting international law enforcement agencies with rare opportunities to catch most-wanted cybercrooks. One of those was <strong>Mark Sokolovsky</strong>, a 26-year-old Ukrainian man who operated the popular “<strong>Raccoon</strong>” malware-as-a-service offering; Sokolovsky was <a href="https://krebsonsecurity.com/2022/10/accused-raccoon-malware-developer-fled-ukraine-after-russian-invasion/" target="_blank" rel="noopener">apprehended in March 2022 after fleeing Ukraine’s mandatory military service orders</a>.</p>
<p>Also nabbed on the lam last year was <strong>Vyacheslav “Tank” Penchukov</strong>, a senior Ukrainian member of a transnational cybercrime group that <a href="https://krebsonsecurity.com/2022/11/top-zeus-botnet-suspect-tank-arrested-in-geneva/" target="_blank" rel="noopener">stole tens of millions of dollars over nearly a decade from countless hacked businesses</a>. Penchukov was arrested after leaving Ukraine to meet up with his wife in Switzerland.</p>


feed_id: https://krebsonsecurity.com/?p=63633
title: Feds Take Down 13 More DDoS-for-Hire Services
uri: Feds-Take-Down-13-More-DDoS-for-Hire-Services
url: https://krebsonsecurity.com/2023/05/feds-take-down-13-more-ddos-for-hire-services/
content:
<p><img decoding="async" class="aligncenter wp-image-36825" src="media/984aee55.ddosbomb-580x357.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb-580x357.png" alt="" width="749" height="461" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb-580x357.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/ddosbomb.png 699w" sizes="(max-width: 749px) 100vw, 749px" /></p>
<p>The <strong>U.S. Federal Bureau of Investigation</strong> (FBI) this week seized 13 domain names connected to &#8220;<strong>booter</strong>&#8221; services that let paying customers launch crippling distributed denial-of-service (DDoS) attacks. Ten of the domains are reincarnations of DDoS-for-hire services the FBI seized in December 2022, when it charged six U.S. men with computer crimes for allegedly operating booters.</p>
<p>Booter services are advertised through a variety of methods, including Dark Web forums, chat platforms and even youtube.com. They accept payment via PayPal, Google Wallet, and/or cryptocurrencies, and subscriptions can range in price from just a few dollars to several hundred per month. The services are generally priced according to the volume of traffic to be hurled at the target, the duration of each attack, and the number of concurrent attacks allowed.</p>
<p>The websites that saw their homepages replaced with seizure notices from the FBI this week include booter services like <strong>cyberstress[.]org</strong> and <strong>exoticbooter[.]com</strong>, which the feds say were used to launch millions of attacks against millions of victims.</p>
<p>&#8220;School districts, universities, financial institutions and government websites are among the victims who have been targeted in attacks launched by booter services,&#8221; federal prosecutors in Los Angeles said in a statement.</p>
<p>Purveyors of booters or &#8220;stressers&#8221; claim they are not responsible for how customers use their services, and that they aren’t breaking the law because — like most security tools — these services can be used for good or bad purposes. Most booter sites employ wordy “terms of use” agreements that require customers to agree they will only stress-test their own networks — and that they won’t use the service to attack others.</p>
<p>But the DOJ says these disclaimers usually ignore the fact that most booter services are heavily reliant on constantly scanning the Internet to commandeer misconfigured devices that are critical for maximizing the size and impact of DDoS attacks. What&#8217;s more, none of the services seized by the government required users to demonstrate that they own the Internet addresses being stress-tested, something a legitimate testing service would insist upon.</p>
<p>This is the third in a series of U.S. and international law enforcement actions targeting booter services. In December 2022, the feds <a href="https://krebsonsecurity.com/2022/12/six-charged-in-mass-takedown-of-ddos-for-hire-sites/" target="_blank" rel="noopener">seized four-dozen booter domains and charged six U.S. men with computer crimes</a> related to their alleged ownership of the popular DDoS-for-hire services. In December 2018, the feds <a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" target="_blank" rel="noopener">targeted 15 booter sites, and three booter store defendants</a> who later pleaded guilty.</p>
<p>While the FBI&#8217;s repeated seizing of booter domains may seem like an endless game of virtual Whac-a-Mole, continuously taking these services offline imposes high enough costs for the operators that some of them will quit the business altogether, says <strong>Richard Clayton</strong>, director of <a href="https://www.cambridgecybercrime.uk/" target="_blank" rel="noopener">Cambridge University&#8217;s Cybercrime Centre</a>.</p>
<p>In 2020, Clayton and others published &#8220;<a href="https://krebsonsecurity.com/2020/05/career-choice-tip-cybercrime-is-mostly-boring" target="_blank" rel="noopener">Cybercrime is Mostly Boring</a>,&#8221; an academic study on the quality and types of work needed to build, maintain and defend illicit enterprises that make up a large portion of the cybercrime-as-a-service market. The study found that operating a booter service effectively requires a mind-numbing amount of constant, tedious work that tends to produce high burnout rates for booter service operators &#8212; even when the service is operating efficiently and profitably.</p>
<p>For example, running an effective booter service requires a substantial amount of administrative work and maintenance, much of which involves constantly scanning for, commandeering and managing large collections of remote systems that can be used to amplify online attacks, Clayton said. On top of that, building brand recognition and customer loyalty takes time.</p>
<p>&#8220;If you&#8217;re running a booter and someone keeps taking your domain or hosting away, you have to then go through doing the same boring work all over again,&#8221; Clayton told KrebsOnSecurity. &#8220;One of the guys the FBI arrested in December [2022] spent six months moaning that he lost his servers, and could people please lend him some money to get it started again.&#8221;<span id="more-63633"></span></p>
<p>In a statement released Wednesday, prosecutors in Los Angeles said four of the six men charged last year for running booter services have since pleaded guilty. However, at least one of the defendants from the 2022 booter bust-up &#8212; <strong>John M. Dobbs</strong>, 32, of Honolulu, HI &#8212; has pleaded not guilty and is signaling he intends to take his case to trial.</p>
<div id="attachment_63643" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63643" decoding="async" loading="lazy" class="wp-image-63643" src="media/fbf14e2e.seizepage.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/seizepage.jpg" alt="" width="750" height="421" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/seizepage.jpg 2312w, https://krebsonsecurity.com/wp-content/uploads/2023/05/seizepage-768x431.jpg 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/seizepage-1536x862.jpg 1536w, https://krebsonsecurity.com/wp-content/uploads/2023/05/seizepage-2048x1150.jpg 2048w, https://krebsonsecurity.com/wp-content/uploads/2023/05/seizepage-782x439.jpg 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-63643" class="wp-caption-text">The FBI seizure notice that replaced the homepages of several booter services this week.</p></div>
<p>Dobbs is a computer science graduate student who for the past decade openly ran <strong>IPStresser[.]com</strong>, a popular and powerful attack-for-hire service that he <a href="https://krebsonsecurity.com/2023/01/thinking-of-hiring-or-running-a-booter-service-think-again/" target="_blank" rel="noopener">registered with the state of Hawaii using his real name and address</a>. Likewise, the domain was registered in Dobbs’s name and hometown in Pennsylvania. Prosecutors say Dobbs&#8217; service attracted more than two million registered users, and was responsible for launching <em>a staggering 30 million distinct DDoS attacks</em>.</p>
<p>Many accused stresser site operators have pleaded guilty over the years after being hit with federal criminal charges. But the government’s core claim — that operating a booter site is a violation of U.S. computer crime laws — wasn’t properly tested in the courts until September 2021.</p>
<p><a href="https://krebsonsecurity.com/2018/12/feds-charge-three-in-mass-seizure-of-attack-for-hire-services/" target="_blank" rel="noopener">That was when a jury handed down </a><a href="https://krebsonsecurity.com/2021/09/trial-ends-in-guilty-verdict-for-ddos-for-hire-boss/" target="_blank" rel="noopener">a guilty verdict against <strong>Matthew Gatrel</strong></a>, a then 32-year-old St. Charles, Ill. man charged in the government’s first 2018 mass booter bust-up. Despite admitting to FBI agents that he ran two booter services (and turning over plenty of incriminating evidence in the process), Gatrel opted to take his case to trial, defended the entire time by court-appointed attorneys.</p>
<p>Gatrel was convicted on all three charges of violating the Computer Fraud and Abuse Act, including conspiracy to commit unauthorized impairment of a protected computer, conspiracy to commit wire fraud, and unauthorized impairment of a protected computer. He was sentenced to two years in prison.</p>
<p>A copy of the FBI&#8217;s booter seizure warrant is <a href="media/0f82823c.Booter-seizure-warrant-Tucows.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/Booter-seizure-warrant-Tucows.pdf" target="_blank" rel="noopener">here</a> (PDF). According to the DOJ, the defendants who pleaded guilty to operating booter sites include:</p>
<p>&#8211;<strong>Jeremiah Sam Evans Miller</strong>, aka &#8220;John The Dev,&#8221; 23, of San Antonio, Texas, who pleaded guilty on April 6 to conspiracy and violating the computer fraud and abuse act related to the operation of a booter service named RoyalStresser[.]com (formerly known as Supremesecurityteam[.]com);</p>
<p>&#8211;<strong>Angel Manuel Colon Jr.</strong>, aka &#8220;Anonghost720&#8221; and &#8220;Anonghost1337,&#8221; 37, of Belleview, Florida, who pleaded guilty on February 13 to conspiracy and violating the computer fraud and abuse act related to the operation of a booter service named SecurityTeam[.]io;</p>
<p>&#8211;<strong>Shamar Shattock</strong>, 19, of Margate, Florida, who pleaded guilty on March 22 to conspiracy to violate the computer fraud and abuse act related to the operation of a booter service known as Astrostress[.]com;</p>
<p>&#8211;<strong>Cory Anthony Palmer</strong>, 23, of Lauderhill, Florida, who pleaded guilty on February 16 to conspiracy to violate the computer fraud and abuse act related to the operation of a booter service known as Booter[.]sx.</p>
<p>All four defendants are scheduled to be sentenced this summer.</p>
<p>The <a href="media/0db3163a.Booter_Seizure_List_May_2023.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/Booter_Seizure_List_May_2023.pdf" target="_blank" rel="noopener">booter domains</a> seized by the FBI this week include:</p>
<p>cyberstress[.]org<br />
exoticbooter[.]com<br />
layerstress[.]net<br />
orbitalstress[.]xyz<br />
redstresser[.]io<br />
silentstress[.]wtf<br />
sunstresser[.]net<br />
silent[.]to<br />
mythicalstress[.]net<br />
dreams-stresser[.]org<br />
stresserbest[.]io<br />
stresserus[.]io<br />
quantum-stress[.]org</p>


feed_id: https://krebsonsecurity.com/?p=63652
title: Microsoft Patch Tuesday, May 2023 Edition
uri: Microsoft-Patch-Tuesday-May-2023-Edition
url: https://krebsonsecurity.com/2023/05/microsoft-patch-tuesday-may-2023-edition/
content:
<p><strong>Microsoft</strong> today released software updates to fix at least four dozen security holes in its<strong> Windows</strong> operating systems and other software, including patches for two zero-day vulnerabilities that are already being exploited in active attacks. </p>
<p><img decoding="async" src="media/f9a52a5f.winupdatedate.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png" alt="" width="923" height="611" class="aligncenter size-full wp-image-60331" srcset="https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate.png 923w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2022/07/winupdatedate-782x518.png 782w" sizes="(max-width: 923px) 100vw, 923px" /></p>
<p>First up in May&#8217;s zero-day flaws is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29336" rel="noopener" target="_blank">CVE-2023-29336</a>, which is an &#8220;elevation of privilege&#8221; weakness in Windows which has a low attack complexity, requires low privileges, and no user interaction. However, as the <strong>SANS Internet Storm Center</strong> <a href="https://isc.sans.edu/diary/Microsoft%20May%202023%20Patch%20Tuesday/29826" rel="noopener" target="_blank">points out</a>, the attack vector for this bug is local.</p>
<p>&#8220;Local Privilege escalation vulnerabilities are a key part of attackers’ objectives,&#8221; said <strong>Kevin Breen</strong>, director of cyber threat research at <strong>Immersive Labs</strong>. &#8220;Once they gain initial access they will seek administrative or SYSTEM-level permissions. This can allow the attacker to disable security tooling and deploy more attacker tools like Mimikatz that lets them move across the network and gain persistence.&#8221; </p>
<p>The zero-day patch that has received the most attention so far is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24932" rel="noopener" target="_blank">CVE-2023-24932</a>, which is a <strong>Secure Boot Security Feature Bypass</strong> flaw that is being actively exploited by &#8220;bootkit&#8221; malware known as &#8220;<a href="https://www.bleepingcomputer.com/news/security/blacklotus-bootkit-bypasses-uefi-secure-boot-on-patched-windows-11/" rel="noopener" target="_blank">BlackLotus</a>.&#8221; A bootkit is dangerous because it allows the attacker to load malicious software before the operating system even starts up.<span id="more-63652"></span></p>
<p>According to Microsoft&#8217;s advisory, an attacker would need physical access or administrative rights to a target device, and could then install an affected boot policy. Microsoft gives this flaw a CVSS score of just 6.7, rating it as &#8220;Important.&#8221;</p>
<p><strong>Adam Barnett</strong>, lead software engineer at <strong>Rapid7</strong>, said CVE-2023-24932 deserves a considerably higher threat score. </p>
<p>&#8220;Microsoft warns that an attacker who already has Administrator access to an unpatched asset could exploit CVE-2023-24932 without necessarily having physical access,&#8221; Barnett said. &#8220;Therefore, the relatively low CVSSv3 base score of 6.7 isn’t necessarily a reliable metric in this case.&#8221;</p>
<p>Barnett said Microsoft has provided <a href="https://www.microsoft.com/en-us/security/blog/2023/04/11/guidance-for-investigating-attacks-using-cve-2022-21894-the-blacklotus-campaign/" rel="noopener" target="_blank">a supplementary guidance article</a> specifically calling out the threat posed by BlackLotus malware, which loads ahead of the operating system on compromised assets, and provides attackers with an array of powerful evasion, persistence, and Command &#038; Control (C2) techniques, including deploying malicious kernel drivers, and disabling Microsoft Defender or Bitlocker. </p>
<p>&#8220;Administrators should be aware that additional actions are required beyond simply applying the patches,&#8221; Barnett advised. &#8220;The patch enables the configuration options necessary for protection, but administrators must apply changes to UEFI config after patching. The attack surface is not limited to physical assets, either; Windows assets running on some VMs, including Azure assets with Secure Boot enabled, also require these extra remediation steps for protection. Rapid7 has noted in the past that enabling Secure Boot is a foundational protection against driver-based attacks. Defenders ignore this vulnerability at their peril.&#8221;</p>
<p>In addition to the two zero-days fixed this month, Microsoft also patched five remote code execution (RCE) flaws in Windows, two of which have notably high CVSS scores. </p>
<p><a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24941" rel="noopener" target="_blank">CVE-2023-24941</a> affects the Windows Network File System, and can be exploited over the network by making an unauthenticated, specially crafted request. Microsoft&#8217;s advisory also includes mitigation advice. The CVSS for this vulnerability is 9.8 – the highest of all the flaws addressed this month.</p>
<p>Meanwhile, <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-28283" rel="noopener" target="_blank">CVE-2023-28283</a> is a critical bug in the Windows Lightweight Directory Access Protocol (LDAP) that allows an unauthenticated attacker to execute malicious code on the vulnerable device. The CVSS for this vulnerability is 8.1, but Microsoft says exploiting the flaw may be tricky and unreliable for attackers.</p>
<p>Another vulnerability patched this month that was disclosed publicly before today (but not yet seen exploited in the wild) is <a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-29325" rel="noopener" target="_blank">CVE-2023-29325</a>, a weakness in <strong>Microsoft Outlook</strong> and <strong>Explorer</strong> that can be exploited by attackers to remotely install malware. Microsoft says this vulnerability can be exploited merely by viewing a specially-crafted email in the Outlook Preview Pane.</p>
<p>&#8220;To help protect against this vulnerability, we recommend users read email messages in plain text format,&#8221; Microsoft&#8217;s writeup on CVE-2023-29325 advises.</p>
<p>&#8220;If an attacker were able to exploit this vulnerability, they would gain remote access to the victim&#8217;s account, where they could deploy additional malware,&#8221; Immersive&#8217;s Breen said. &#8220;This kind of exploit will be highly sought after by e-crime and ransomware groups where, if successfully weaponized, could be used to target hundreds of organizations with very little effort.&#8221; </p>
<p>For more details on the updates released today, check out roundups by <a href="https://www.action1.com/patch-tuesday-may-2023/?vyj" rel="noopener" target="_blank">Action1</a>, <a href="https://www.automox.com/blog/patch-tuesday-may-2023" rel="noopener" target="_blank">Automox</a> and <a href="https://blog.qualys.com/vulnerabilities-threat-research/patch-tuesday/2023/05/09/microsoft-patch-tuesday-may-2023-security-update-review" rel="noopener" target="_blank">Qualys</a>,  If today’s updates cause any stability or usability issues in Windows, <a href="https://www.askwoody.com" rel="noopener" target="_blank">AskWoody.com</a> will likely have the lowdown on that.</p>
<p>Please consider backing up your data and/or imaging your system before applying any updates. And feel free to sound off in the comments if you experience any problems as a result of these patches.</p>


feed_id: https://krebsonsecurity.com/?p=63660
title: Re-Victimization from Police-Auctioned Cell Phones
uri: Re-Victimization-from-Police-Auctioned-Cell-Phones
url: https://krebsonsecurity.com/2023/05/re-victimization-from-police-auctioned-cell-phones/
content:
<p><img decoding="async" src="media/9fedfa12.policephone.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/policephone.png" alt="" width="708" height="476" class="aligncenter size-full wp-image-63671" /></p>
<p>Countless smartphones seized in arrests and searches by police forces across the United States are being auctioned online without first having the data on them erased, a practice that can lead to crime victims being re-victimized, a new study found. In response, the largest online marketplace for items seized in U.S. law enforcement investigations says it now ensures that all phones sold through its platform will be data-wiped prior to auction.</p>
<p>Researchers at the <strong>University of Maryland</strong> last year purchased 228 smartphones sold &#8220;as-is&#8221; from <strong>PropertyRoom.com</strong>, which bills itself as the largest auction house for police departments in the United States. Of phones they won at auction (at an average of $18 per phone), the researchers found 49 had no PIN or passcode; they were able to guess an additional 11 of the PINs by using the top-40 most popular PIN or swipe patterns.</p>
<p>Phones may end up in police custody for any number of reasons &#8212; such as its owner was involved in identity theft &#8212; and in these cases the phone itself was used as a tool to commit the crime.</p>
<p>&#8220;We initially expected that police would never auction these phones, as they would enable the buyer to recommit the same crimes as the previous owner,&#8221; the researchers explained in a paper released this month. &#8220;Unfortunately, that expectation has proven false in practice.&#8221;</p>
<p>The researchers said while they could have employed more aggressive technological measures to work out more of the PINs for the remaining phones they bought, they concluded based on the sample that a great many of the devices they won at auction had probably not been data-wiped and were protected only by a PIN.</p>
<p>Beyond what you would expect from unwiped second hand phones &#8212; every text message, picture, email, browser history, location history, etc. &#8212; the 61 phones they were able to access also contained significant amounts of data pertaining to crime &#8212; including victims&#8217; data &#8212; the researchers found.</p>
<p>Some readers may be wondering at this point, &#8220;Why should we care about what happens to a criminal&#8217;s phone?&#8221; First off, it&#8217;s not entirely clear how these phones ended up for sale on PropertyRoom. </p>
<p>&#8220;Some folks are like, &#8216;Yeah, whatever, these are criminal phones,&#8217; but are they?&#8221; said <strong>Dave Levin</strong>, an assistant professor of computer science at University of Maryland. </p>
<p>&#8220;We started looking at state laws around what they&#8217;re supposed to do with lost or stolen property, and we found that most of it ends up going the same route as civil asset forfeiture,&#8221; Levin continued. &#8220;Meaning, if they can&#8217;t find out who owns something, it eventually becomes the property of the state and gets shipped out to these resellers.&#8221;</p>
<p>Also, the researchers found that many of the phones clearly had personal information on them regarding previous or intended targets of crime: A dozen of the phones had photographs of government-issued IDs. Three of those were on phones that apparently belonged to sex workers; their phones contained communications with clients.<span id="more-63660"></span></p>
<div id="attachment_63674" style="width: 518px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63674" decoding="async" loading="lazy" src="media/41f836f3.phonedatatypes.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/phonedatatypes.png" alt="" width="508" height="411" class="size-full wp-image-63674" /><p id="caption-attachment-63674" class="wp-caption-text">An overview of the phone functionality and data accessibility for phones purchased by the researchers.</p></div>
<p>One phone had full credit files for eight different people on it. On another device they found a screenshot including 11 stolen credit cards that were apparently purchased from an online carding shop. On yet another, the former owner had apparently been active in a Telegram group chat that sold tutorials on how to run identity theft scams.</p>
<p>The most interesting phone from the batches they bought at auction was one with a sticky note attached that included the device&#8217;s PIN and the notation &#8220;<strong>Gry Keyed</strong>,&#8221; no doubt a reference to the <strong>Graykey</strong> software that is often used by law enforcement agencies <a href="https://appleinsider.com/articles/21/06/22/iphone-hacking-tool-graykey-techniques-outlined-in-leaked-instructions" rel="noopener" target="_blank">to brute-force a mobile device PIN</a>.</p>
<p>&#8220;That one had the PIN on the back,&#8221; Levin said. &#8220;The message chain on that phone had 24 Experian and TransUnion credit histories&#8221;.</p>
<p>The University of Maryland team said they took care in their research not to further the victimization of people whose information was on the devices they purchased from PropertyRoom.com. That involved ensuring that none of the devices could connect to the Internet when powered on, and scanning all images on the devices against known hashes for child sexual abuse material. </p>
<p>It is common to find phones and other electronics for sale on auction platforms like eBay that have not been wiped of sensitive data, but in those cases eBay doesn&#8217;t possess the items being sold. In contrast, platforms like PropertyRoom obtain devices and resell them at auction directly.</p>
<p>PropertyRoom did not respond to multiple requests for comment. But the researchers said sometime in the past few months PropertyRoom began posting a notice stating that all mobile devices would be wiped of their data before being sold at auction. </p>
<p>&#8220;We informed them of our research in October 2022, and they responded that they would review our findings internally,&#8221; Levin said. &#8220;They stopped selling them for a while, but then it slowly came back, and then we made sure we won every auction. And all of the ones we got from that were indeed wiped, except there were four devices that had external SD [storage] cards in them that weren&#8217;t wiped.&#8221;</p>
<p>A copy of the University of Maryland study is <a href="media/75a6937d.police-auction.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/police-auction.pdf" rel="noopener" target="_blank">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=63682
title: Russian Hacker “Wazawaka” Indicted for Ransomware
uri: Russian-Hacker-Wazawaka-Indicted-for-Ransomware
url: https://krebsonsecurity.com/2023/05/russian-hacker-wazawaka-indicted-for-ransomware/
content:
<p>A Russian man identified by KrebsOnSecurity in January 2022 as a prolific and vocal member of several top ransomware groups was the subject of two indictments unsealed by the <strong>Justice Department</strong> today. U.S. prosecutors say <strong>Mikhail Pavolovich Matveev</strong>, a.k.a. &#8220;<strong>Wazawaka</strong>&#8221; and &#8220;<strong>Boriselcin</strong>&#8221; worked with three different ransomware gangs that extorted hundreds of millions of dollars from companies, schools, hospitals and government agencies.</p>
<div id="attachment_63686" style="width: 760px" class="wp-caption aligncenter"><a href="media/5c483978.fbiwanted-matveev.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63686" decoding="async" class="wp-image-63686" src="media/5c483978.fbiwanted-matveev.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev.png" alt="" width="750" height="736" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev.png 804w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev-768x754.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/fbiwanted-matveev-782x767.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-63686" class="wp-caption-text">An FBI wanted poster for Matveev.</p></div>
<p>Indictments returned in New Jersey and the District of Columbia allege that Matveev was involved in a conspiracy to distribute ransomware from three different strains or affiliate groups, including <strong>Babuk</strong>, <strong>Hive</strong> and <strong>LockBit</strong>.</p>
<p>The indictments allege that on June 25, 2020, Matveev and his LockBit co-conspirators deployed LockBit ransomware against a law enforcement agency in Passaic County, New Jersey. Prosecutors say that on May 27, 2022, Matveev conspired with Hive to ransom a nonprofit behavioral healthcare organization headquartered in Mercer County, New Jersey. And on April 26, 2021, Matveev and his Babuk gang allegedly deployed ransomware against the Metropolitan Police Department in Washington, D.C.</p>
<p>Meanwhile, the <strong>U.S. Department of Treasury</strong> has <a href="https://ofac.treasury.gov/recent-actions/20230516" target="_blank" rel="noopener">added Matveev</a> to its list of persons with whom it is illegal to transact financially. Also, the <b>U.S. State Department</b><strong> </strong>is offering <a href="https://www.state.gov/the-department-of-state-announces-reward-offer-against-russian-ransomware-actor/" target="_blank" rel="noopener">a $10 million reward</a> for the capture and/or prosecution of Matveev, although he is unlikely to face either as long as he continues to reside in Russia.</p>
<p>In a January 2021 discussion on a top Russian cybercrime forum, Matveev&#8217;s alleged alter ego Wazawaka said he had no plans to leave the protection of &#8220;Mother Russia,&#8221; and that traveling abroad was not an option for him.</p>
<p>&#8220;Mother Russia will help you,&#8221; Wazawaka concluded. &#8220;Love your country, and you will always get away with everything.&#8221;</p>
<p>In January 2022, KrebsOnSecurity published <a href="https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/" target="_blank" rel="noopener">Who is the Network Access Broker &#8216;Wazawaka,&#8217;</a> which followed clues from Wazawaka&#8217;s many pseudonyms and contact details on the Russian-language cybercrime forums back to a 33-year-old Mikhail Matveev from Abaza, RU (the FBI <a href="media/600d06dd.download.pdf" data-original-source="https://www.fbi.gov/wanted/cyber/mikhail-pavlovich-matveev/@@download.pdf" target="_blank" rel="noopener">says</a> his date of birth is Aug. 17, 1992).</p>
<p>A month after that story ran, a man who appeared identical to the social media photos for Matveev began posting on Twitter <a href="https://krebsonsecurity.com/2022/02/wazawaka-goes-waka-waka/" target="_blank" rel="noopener">a series of bizarre selfie videos</a> in which he lashed out at security journalists and researchers (including this author), while using the same Twitter account to drop exploit code for a widely-used virtual private networking (VPN) appliance.</p>
<p>&#8220;Hello Brian Krebs! You did a really great job actually, really well, fucking great — it&#8217;s great that journalism works so well in the US,&#8221; Matveev said in one of the videos. &#8220;By the way, it is my voice in the background, I just love myself a lot.&#8221;</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/G1LclbndLaM" width="750" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>Prosecutors allege Matveev used a dizzying stream of monikers on the cybercrime forums, including &#8220;<strong>Boriselcin</strong>,&#8221; a talkative and brash personality who was simultaneously the public persona of Babuk, a ransomware affiliate program that surfaced on New Year’s Eve 2020.<span id="more-63682"></span></p>
<p>Previous reporting here revealed that Matveev&#8217;s alter egos included &#8220;<strong>Orange,</strong>&#8221; the founder of the <strong>RAMP</strong> ransomware forum. RAMP stands for &#8220;Ransom Anon Market Place, and analysts at the security firm Flashpoint say the forum was created &#8220;directly in response to several large Dark Web forums banning ransomware collectives on their site following <a href="https://krebsonsecurity.com/2021/05/a-closer-look-at-the-darkside-ransomware-gang/" target="_blank" rel="noopener">the Colonial Pipeline attack</a> by ransomware group ‘<a href="https://krebsonsecurity.com/?s=darkside" target="_blank" rel="noopener">DarkSide</a>.”</p>
<p>As noted in last year&#8217;s investigations into Matveev, his alleged cybercriminal handles all were driven by a uniquely communitarian view that when organizations being held for ransom decline to cooperate or pay up, any data stolen from the victim should be published on the Russian cybercrime forums for all to plunder — not privately sold to the highest bidder.</p>
<p>In thread after thread on the crime forum <strong>XSS</strong>, Matveev&#8217;s alleged alias “<strong>Uhodiransomwar</strong>” could be seen posting download links to databases from companies that have refused to negotiate after five days.</p>
<p>Matveev is charged with conspiring to transmit ransom demands, conspiring to damage protected computers, and intentionally damaging protected computers. If convicted, he faces more than 20 years in prison.</p>
<p>Further reading:</p>
<p><a href="https://krebsonsecurity.com/2022/01/who-is-the-network-access-broker-wazawaka/" target="_blank" rel="noopener">Who is the Network Access Broker &#8220;Wazawaka?&#8221;</a></p>
<p><a href="https://krebsonsecurity.com/2022/02/wazawaka-goes-waka-waka/" target="_blank" rel="noopener">Wazawaka Goes Waka Waka</a></p>
<p>The <a href="media/9751a1e1.Matveev.Indictment.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/Matveev.Indictment.pdf" target="_blank" rel="noopener">New Jersey indictment against Matveev</a> (PDF)</p>
<p>The <a href="https://www.justice.gov/usao-dc/press-release/file/1583786/download" target="_blank" rel="noopener">indictment from the U.S. attorney&#8217;s office in Washington, D.C.</a> (PDF)</p>


feed_id: https://krebsonsecurity.com/?p=63701
title: Interview With a Crypto Scam Investment Spammer
uri: Interview-With-a-Crypto-Scam-Investment-Spammer
url: https://krebsonsecurity.com/2023/05/interview-with-a-crypto-scam-investment-spammer/
content:
<p>Social networks are constantly battling inauthentic bot accounts that send direct messages to users promoting scam cryptocurrency investment platforms. What follows is an interview with a Russian hacker responsible for a series of aggressive crypto spam campaigns that recently prompted several large <strong>Mastodon</strong> communities to temporarily halt new registrations. According to the hacker, their spam software has been in private use until the last few weeks, when it was released as open source code.</p>
<p><img decoding="async" class=" wp-image-59331 aligncenter" src="media/f28497bb.cryptopeople.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2022/04/cryptopeople.png" alt="" width="701" height="458" /></p>
<p><a href="https://infosec.exchange/@renchap@oisaur.com" target="_blank" rel="noopener">Renaud Chaput</a> is a freelance programmer working on modernizing and scaling the Mastodon project infrastructure &#8212; including <strong>joinmastodon.org</strong>, <strong>mastodon.online</strong>, and <strong>mastodon.social</strong>. Chaput said that on May 4, 2023, someone unleashed a spam torrent targeting users on these Mastodon communities via &#8220;private mentions,&#8221; a kind of direct messaging on the platform.</p>
<p>The messages said recipients had earned an investment credit at a cryptocurrency trading platform called <strong>moonxtrade[.]com</strong>. Chaput said the spammers used more than 1,500 Internet addresses across 400 providers to register new accounts, which then followed popular accounts on Mastodon and sent private mentions to the followers of those accounts.</p>
<p>Since then, the same spammers have used this method to advertise more than 100 different crypto investment-themed domains. Chaput said that at one point last week the volume of bot accounts being registered for the crypto spam campaign started overwhelming the servers that handle new signups at Mastodon.social.</p>
<p>&#8220;We suddenly went from like three registrations per minute to 900 a minute,&#8221; Chaput said. &#8220;There was nothing in the Mastodon software to detect that activity, and the protocol is not designed to handle this.&#8221;</p>
<div id="attachment_63714" style="width: 672px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63714" decoding="async" loading="lazy" class="size-full wp-image-63714" src="media/8df41ad3.mastocryptospam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/mastocryptospam.png" alt="" width="662" height="330" /><p id="caption-attachment-63714" class="wp-caption-text">One of the crypto investment scam messages promoted in the spam campaigns on Mastodon this month.</p></div>
<p>Seeking to gain a temporary handle on the spam wave, Chaput said he briefly disabled new account registrations on mastodon.social and mastondon.online. Shortly after that, those same servers came under a sustained distributed denial-of-service (DDoS) attack.</p>
<p>Chaput said whoever was behind the DDoS was definitely <em>not</em> using point-and-click DDoS tools, like <a href="https://krebsonsecurity.com/tag/booter/" target="_blank" rel="noopener">a booter or stresser service</a>.</p>
<p>&#8220;This was three hours non-stop, 200,000 to 400,000 requests per second,&#8221; Chaput said of the DDoS. &#8220;At first, they were targeting one path, and when we blocked that they started to randomize things. Over three hours the attack evolved several times.&#8221;</p>
<p>Chaput says the spam waves have died down since they retrofitted mastodon.social with a CAPTCHA, those squiggly letter and number combinations designed to stymie automated account creation tools. But he&#8217;s worried that other Mastodon instances may not be as well-staffed and might be easy prey for these spammers.</p>
<p>&#8220;We don&#8217;t know if this is the work of one person, or if this is [related to] software or services being sold to others,&#8221; Chaput told KrebsOnSecurity. &#8220;We&#8217;re really impressed by the scale of it &#8212; using hundreds of domains and thousands of Microsoft email addresses.&#8221;</p>
<p>Chaput said a review of their logs indicates many of the newly registered Mastodon spam accounts were registered using the same 0auth credentials, and that a domain common to those credentials was <strong>quot[.]pw.</strong></p>
<h2>A DIRECT QUOT</h2>
<p>The domain quot[.]pw has been registered and abandoned by several parties since 2014, but the most recent registration data available through <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> shows it was registered in March 2020 to someone in Krasnodar, Russia with the email address <strong>edgard011012@gmail.com</strong>.</p>
<p>This email address is also connected to accounts on several Russian cybercrime forums, including &#8220;<strong>__edman__</strong>,&#8221; who had a history of selling &#8220;logs&#8221; &#8212; large amounts of data stolen from many bot-infected computers &#8212; as well as giving away access to hacked Internet of Things (IoT) devices.</p>
<p>In September 2018, a user by the name &#8220;<strong>ципа</strong>&#8221; (phonetically &#8220;<strong>Zipper</strong>&#8221; in Russian) registered on the Russian hacking forum <strong>Lolzteam</strong> using the edgard0111012@gmail.com address. In May 2020, Zipper told another Lolzteam member that quot[.]pw was their domain. That user advertised a service called &#8220;<strong>Quot Project</strong>&#8221; which said they could be hired to write programming scripts in Python and C++.</p>
<p>&#8220;I make Telegram bots and other rubbish cheaply,&#8221; reads one February 2020 sales thread from Zipper.</p>
<div id="attachment_63733" style="width: 761px" class="wp-caption aligncenter"><a href="media/21116ed5.zelenkaquot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/zelenkaquot.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63733" decoding="async" loading="lazy" class="wp-image-63733" src="media/21116ed5.zelenkaquot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/zelenkaquot.png" alt="" width="751" height="394" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/zelenkaquot.png 1082w, https://krebsonsecurity.com/wp-content/uploads/2023/05/zelenkaquot-768x403.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/zelenkaquot-782x411.png 782w, https://krebsonsecurity.com/wp-content/uploads/2023/05/zelenkaquot-267x140.png 267w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-63733" class="wp-caption-text">Quotpw/Ahick/Edgard/ципа advertising his coding services in this Google-translated forum posting.</p></div>
<p>Clicking the &#8220;open chat in Telegram&#8221; button on Zipper&#8217;s Lolzteam profile page launched a Telegram instant message chat window where the user Quotpw responded almost immediately. Asked if they were aware their domain was being used to manage a spam botnet that was pelting Mastodon instances with crypto scam spam, Quotpw confirmed the spam was powered by their software.</p>
<p>&#8220;It was made for a limited circle of people,&#8221; Quotpw said, noting that they recently released the bot software as open source on GitHub.</p>
<p>Quotpw went on to say the spam botnet was powered by well more than the hundreds of IP addresses tracked by Chaput, and that these systems were mostly <a href="https://krebsonsecurity.com/tag/residential-proxy/" target="_blank" rel="noopener">residential proxies</a>. A residential proxy generally refers to a computer or mobile device running some type of software that enables the system to be used as a pass-through for Internet traffic from others.</p>
<p>Very often, this proxy software is installed surreptitiously, such as through a &#8220;Free VPN&#8221; service or mobile app. Residential proxies also can refer to households protected by compromised home routers running factory-default credentials or outdated firmware.</p>
<p>Quotpw maintains they have earned more than $2,000 sending roughly 100,000 private mentions to users of different Mastodon communities over the past few weeks. Quotpw said their conversion rate for the same bot-powered direct message spam on <strong>Twitter</strong> is usually much higher and more profitable, although they conceded that recent adjustments to Twitter&#8217;s anti-bot CAPTCHA have put a crimp in their Twitter earnings.</p>
<p>&#8220;My partners (I&#8217;m programmer) lost time and money while <strong>ArkoseLabs</strong> (funcaptcha) introduced new precautions on Twitter,&#8221; Quotpw wrote in a Telegram reply. &#8220;On Twitter, more spam and crypto scam.&#8221;</p>
<p>Asked whether they felt at all conflicted about spamming people with invitations to cryptocurrency scams, Quotpw said in their hometown &#8220;they pay more for such work than in &#8216;white&#8217; jobs&#8221; &#8212; referring to legitimate programming jobs that don&#8217;t involve malware, botnets, spams and scams.</p>
<p>&#8220;Consider salaries in Russia,&#8221; Quotpw said. &#8220;Any spam is made for profit and brings illegal money to spammers.&#8221;<span id="more-63701"></span></p>
<h2>THE VIENNA CONNECTION</h2>
<p>Shortly after edgard011012@gmail.com registered quot[.]pw, the WHOIS registration records for the domain were changed again, to <strong>msr-sergey2015@yandex.ru</strong>, and to a phone number in Austria: <strong>+43.6607003748</strong>.</p>
<p><a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a company that tracks breached data, finds that the address <strong>msr-sergey2015@yandex.ru</strong> has been associated with accounts at the mobile app site <strong>aptoide.com</strong> (user: CoolappsforAndroid) and <strong>vimeworld.ru</strong> that were created from different Internet addresses in Vienna, Austria.</p>
<p>A search in <strong>Skype</strong> on that Austrian phone number shows it belongs to a <strong>Sergey Proshutinskiy</strong> who lists his location as Vienna, Austria. The very first result that comes up when one searches that unusual name in Google is <a href="https://www.linkedin.com/in/proshutinskiy-sergey/" target="_blank" rel="noopener">a LinkedIn profile for a Sergey Proshutinskiy</a> from Vienna, Austria.</p>
<p>Proshutinskiy&#8217;s LinkedIn profile says he is a Class of 2024 student at <strong>TGM</strong>, which is a Christian mission school in Austria. His resume also says he is a data science intern at <strong>Mondi Group</strong>, an Austrian manufacturer of sustainable packaging and paper.</p>
<p>Mr. Proshutinskiy did not respond to requests for comment.</p>
<p>Quotpw denied being Sergey, and said Sergey was a friend who registered the domain as a birthday present and favor last year.</p>
<p>&#8220;Initially, I bought it for 300 rubles,&#8221; Quotpw explained. &#8220;The extension cost 1300 rubles (expensive). I waited until it expired and forgot to buy it. After that, a friend (Sergey) bought [the] domain and transferred access rights to me.&#8221;</p>
<p>&#8220;He&#8217;s not even an information security specialist,&#8221; Quotpw said of Sergey. &#8220;My friends do not belong to this field. None of my friends are engaged in scams or other black [hat] activities.&#8221;</p>
<p>It may seem unlikely that someone would go to all this trouble to spam Mastodon users over several weeks using an impressive number of resources &#8212; all for just $2,000 in profit. But it is likely that whoever is actually running the various crypto scam platforms advertised by Quotpw&#8217;s spam messages pays handsomely for any investments generated by their spam.</p>
<p>According to the <strong>FBI</strong>, financial losses from cryptocurrency investment scams <a href="https://www.fbi.gov/contact-us/field-offices/springfield/news/internet-crime-complaint-center-releases-2022-statistics" target="_blank" rel="noopener">dwarfed losses for all other types of cybercrime in 2022</a>, rising from $907 million in 2021 to $2.57 billion last year.</p>


feed_id: https://krebsonsecurity.com/?p=63769
title: Phishing Domains Tanked After Meta Sued Freenom
uri: Phishing-Domains-Tanked-After-Meta-Sued-Freenom
url: https://krebsonsecurity.com/2023/05/phishing-domains-tanked-after-meta-sued-freenom/
content:
<p>The number of phishing websites tied to domain name registrar <strong>Freenom</strong> dropped precipitously in the months surrounding a recent lawsuit from social networking giant <strong>Meta</strong>, which alleged the free domain name provider has a long history of ignoring abuse complaints about phishing websites while monetizing traffic to those abusive domains.</p>
<div id="attachment_63778" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63778" decoding="async" class=" wp-image-63778" src="media/2bf89b59.cctldphishing1122-0423.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/cctldphishing1122-0423.png" alt="" width="750" height="462" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/cctldphishing1122-0423.png 1008w, https://krebsonsecurity.com/wp-content/uploads/2023/05/cctldphishing1122-0423-768x473.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/cctldphishing1122-0423-782x482.png 782w" sizes="(max-width: 750px) 100vw, 750px" /><p id="caption-attachment-63778" class="wp-caption-text">The volume of phishing websites registered through Freenom dropped considerably since the registrar was sued by Meta. Image: Interisle Consulting.</p></div>
<p>Freenom is the domain name registry service provider for five so-called “country code top level domains” (ccTLDs), including .cf for the Central African Republic; .ga for Gabon; .gq for Equatorial Guinea; .ml for Mali; and .tk for Tokelau.</p>
<p>Freenom has always waived the registration fees for domains in these country-code domains, but the registrar also reserves the right to take back free domains at any time, and to divert traffic to other sites &#8212; including adult websites. And there are countless reports from Freenom users who&#8217;ve seen free domains removed from their control and forwarded to other websites.</p>
<p>By the time Meta <a href="https://krebsonsecurity.com/2023/03/sued-by-meta-freenom-halts-domain-registrations/" target="_blank" rel="noopener">initially filed its lawsuit in December 2022</a>, Freenom was the source of well more than half of all new phishing domains coming from country-code top-level domains. Meta initially asked a court to seal its case against Freenom, but that request was denied. Meta withdrew its December 2022 lawsuit and re-filed it in March 2023.</p>
<p>&#8220;The five ccTLDs to which Freenom provides its services are the TLDs of choice for cybercriminals because Freenom provides free domain name registration services and shields its customers’ identity, even after being presented with evidence that the domain names are being used for illegal purposes,&#8221; Meta&#8217;s complaint charged. &#8220;Even after receiving notices of infringement or phishing by its customers, Freenom continues to license new infringing domain names to those same customers.&#8221;</p>
<p>Meta pointed to research from <strong>Interisle Consulting Group</strong>, which discovered in 2021 and again last year that the five ccTLDs operated by Freenom made up half of the Top Ten TLDs most abused by phishers.</p>
<p>Interisle partner <strong>Dave Piscitello</strong> said something remarkable has happened in the months since the Meta lawsuit.</p>
<p>&#8220;We’ve observed a significant decline in phishing domains reported in the Freenom commercialized ccTLDs in months surrounding the lawsuit,&#8221; Piscitello wrote <a href="https://infosec.exchange/@securityskeptic/110413286074743512" target="_blank" rel="noopener">on Mastodon</a>. &#8220;Responsible for over 60% of phishing domains reported in November 2022, Freenom’s percentage has dropped to under 15%.&#8221;</p>
<p>Interisle collects data from 12 major blocklists for spam, malware, and phishing, and it receives phishing-specific data from <a href="https://www.spamhaus.org" target="_blank" rel="noopener">Spamhaus</a>, <a href="https://www.phishtank.com" target="_blank" rel="noopener">Phishtank</a>, <a href="https://openphish.com/" target="_blank" rel="noopener">OpenPhish</a> and the <a href="https://apwg.org/ecx/" target="_blank" rel="noopener">APWG Ecrime Exchange</a>. The company publishes historical data sets quarterly, both on <a href="https://cybercrimeinfocenter.org/malware-activity" target="_blank" rel="noopener">malware</a> and <a href="https://cybercrimeinfocenter.org/phishing-activity" target="_blank" rel="noopener">phishing</a>.</p>
<p>Piscitello said it&#8217;s too soon to tell the full impact of the Freenom lawsuit, noting that Interisle&#8217;s sources of spam and phishing data all have different policies about when domains are removed from their block lists.</p>
<p>&#8220;One of the things we don&#8217;t have visibility into is how each of the blocklists determine to remove a URL from their lists,&#8221; he said. &#8220;Some of them time out [listed domains] after 14 days, some do it after 30, and some keep them forever.&#8221;</p>
<p>Freenom did not respond to requests for comment.</p>
<p>This is the second time in as many years that a lawsuit by Meta against a domain registrar has disrupted the phishing industry. In March 2020, Meta sued domain registrar giant <strong>Namecheap</strong>, alleging cybersquatting and trademark infringement.</p>
<p>The two parties <a href="https://domainnamewire.com/2022/04/25/meta-platforms-drops-lawsuit-against-namecheap-after-settlement/" target="_blank" rel="noopener">settled the matter in April 2022</a>. While the terms of that settlement have not been disclosed, new phishing domains registered through Namecheap declined more than 50 percent the following quarter, Interisle found.</p>
<div id="attachment_63779" style="width: 761px" class="wp-caption aligncenter"><a href="media/cf623ec4.namecheapphishingtrends.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/namecheapphishingtrends.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63779" decoding="async" loading="lazy" class="wp-image-63779" src="media/cf623ec4.namecheapphishingtrends.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/namecheapphishingtrends.png" alt="" width="751" height="469" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/namecheapphishingtrends.png 890w, https://krebsonsecurity.com/wp-content/uploads/2023/05/namecheapphishingtrends-768x480.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/namecheapphishingtrends-782x489.png 782w" sizes="(max-width: 751px) 100vw, 751px" /></a><p id="caption-attachment-63779" class="wp-caption-text">Phishing attacks using websites registered through Namecheap, before and after the registrar settled a lawsuit with Meta. Image: Interisle Consulting.</p></div>
<p><span id="more-63769"></span>Unfortunately, the lawsuits have had little effect on the overall number of phishing attacks and phishing-related domains, which have steadily increased in volume over the years.  Piscitello said the phishers tend to gravitate toward registrars that offer the least resistance and lowest price per domain. And with <a href="https://www.wired.com/story/google-zip-mov-domains-phishing-risks/" target="_blank" rel="noopener">new top-level domains constantly being introduced</a>, there is rarely a shortage of super low-priced domains.</p>
<p>&#8220;The abuse of a new top-level domain is largely the result of one registrar&#8217;s portfolio,&#8221; Piscitello told KrebsOnSecurity. &#8220;Alibaba or Namecheap or another registrar will run a promotion for a cheap domain, and then we&#8217;ll see flocking and migration of the phishers to that TLD. It&#8217;s like strip mining, where they&#8217;ll buy hundreds or thousands of domains, use those in a campaign, exhaust that TLD and then move on to another provider.&#8221;</p>
<p>Piscitello said despite the steep drop in phishing domains coming out of Freenom, the alternatives available to phishers are many. After all, there are more than 2,000 accredited domain registrars, not to mention dozens of services that let anyone set up a website for free without even owning a domain.</p>
<p>&#8220;There is no evidence that the trend line is even going to level off,&#8221; he said. &#8220;I think what the Meta lawsuit tells us is that litigation is like giving someone a <a href="https://en.wikipedia.org/wiki/Standing_eight_count" target="_blank" rel="noopener">standing eight count</a>. It temporarily disrupts a process. And in that sense, litigation appears to be working.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=63767
title: Discord Admins Hacked by Malicious Bookmarks
uri: Discord-Admins-Hacked-by-Malicious-Bookmarks
url: https://krebsonsecurity.com/2023/05/discord-admins-hacked-by-malicious-bookmarks/
content:
<p>A number of <strong>Discord</strong> communities focused on cryptocurrency have been hacked this past month after their administrators were tricked into running malicious Javascript code disguised as a Web browser bookmark.</p>
<div id="attachment_63823" style="width: 764px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63823" decoding="async" class=" wp-image-63823" src="media/00dea10e.dragmediscord.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/dragmediscord.png" alt="" width="754" height="365" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/dragmediscord.png 1006w, https://krebsonsecurity.com/wp-content/uploads/2023/05/dragmediscord-768x372.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/dragmediscord-782x379.png 782w" sizes="(max-width: 754px) 100vw, 754px" /><p id="caption-attachment-63823" class="wp-caption-text">This attack involves malicious Javascript that is added to one&#8217;s browser by dragging a component from a web page to one&#8217;s browser bookmarks.</p></div>
<p>According to interviews with victims, several of the attacks began with an interview request from someone posing as a reporter for a crypto-focused news outlet online. Those who take the bait are sent a link to a Discord server that appears to be the official Discord of the crypto news site, where they are asked to complete a verification step to validate their identity.</p>
<p>As shown in <a href="https://www.youtube.com/watch?v=J6-yihOT7w0" target="_blank" rel="noopener">this Youtube video</a>, the verification process involves dragging a button from the phony crypto news Discord server to the bookmarks bar in one&#8217;s Web browser. From there, the visitor is instructed to go back to discord.com and then click the new bookmark to complete the verification process.</p>
<p>However, the bookmark is actually a clever snippet of Javascript that quietly grabs the user&#8217;s Discord token and sends it to the scammer&#8217;s website. The attacker then loads the stolen token into their own browser session and (usually late at night after the admins are asleep) posts an announcement in the targeted Discord about an exclusive &#8220;airdrop,&#8221; &#8220;NFT mint event&#8221; or some other potential money making opportunity for the Discord members.</p>
<div style="text-align: center;"><iframe loading="lazy" title="YouTube video player" src="https://www.youtube.com/embed/J6-yihOT7w0" width="750" height="415" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>The unsuspecting Discord members click the link provided by the compromised administrator account, and are asked to connect their crypto wallet to the scammer&#8217;s site, where it asks for unlimited spend approvals on their tokens, and subsequently drains the balance of any valuable accounts.</p>
<p>Meanwhile, anyone in the compromised Discord channel who notices the scam and replies is banned, and their messages are deleted by the compromised admin account.</p>
<p><strong>Nicholas Scavuzzo</strong> is an associate at <a href="https://oceanprotocol.com/" target="_blank" rel="noopener">Ocean Protocol</a>, which describes itself as an &#8220;open-source protocol that aims to allow businesses and individuals to exchange and monetize data and data-based services.&#8221; On May 22, an administrator for Ocean Protocol&#8217;s Discord server clicked a link in a direct message from a community member that prompted them to prove their identity by dragging a link to their bookmarks.</p>
<p>Scavuzzo, who is based in Maine, said the attackers waited until around midnight in his timezone time before using the administrator&#8217;s account to send out an unauthorized message about a new Ocean airdrop.</p>
<p>Scavuzzo said the administrator&#8217;s account was hijacked even though she had multi-factor authentication turned on.</p>
<p>&#8220;A CAPTCHA bot that allows Discord cookies to be accessed by the person hosting the CAPTCHA,&#8221; was how Scavuzzo described the attack. &#8220;I&#8217;ve seen all kinds of crypto scams, but I&#8217;ve never seen one like this.&#8221;</p>
<div id="attachment_63820" style="width: 678px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63820" decoding="async" loading="lazy" class="wp-image-63820 size-full" src="media/8825815e.oceanairdropscam.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/oceanairdropscam.png" alt="" width="668" height="579" /><p id="caption-attachment-63820" class="wp-caption-text">In this conversation, &#8220;Ana | Ocean&#8221; is a compromised Discord server administrator account promoting a phony airdrop.</p></div>
<p>Importantly, the stolen token only works for the attackers as long as its rightful owner doesn&#8217;t log out and back in, or else change their credentials.</p>
<p>Assuming the administrator can log in, that is. In Ocean&#8217;s case, one of the first things the intruders did once they swiped the administrator&#8217;s token was change the server&#8217;s access controls and remove all core Ocean team members from the server.</p>
<p>Fortunately for Ocean, Scavuzzo was able to reach the operator of the server that hosts the Discord channel, and have the channel&#8217;s settings reverted back to normal.</p>
<p>&#8220;Thankfully, we are a globally distributed team, so we have people awake at all hours,&#8221; Scavuzzo said, noting that Ocean is not aware of any Discord community members who fell for the phony airdrop offer, which was live for about 30 minutes. &#8220;This could have been a lot worse.&#8221;</p>
<p>On May 26, <strong>Aura Network</strong> <a href="https://twitter.com/AuraNetworkHQ/status/1662322323691806720" target="_blank" rel="noopener">reported on Twitter</a> that its Discord server was compromised in a phishing attack that resulted in the deletion of Discord channels and the dissemination of fake Aura Network Airdrop Campaign links.</p>
<p>On May 27, <strong>Nahmii</strong> &#8212; a cryptocurrency technology based on the Ethereum blockchain &#8212; <a href="https://twitter.com/Nahmii_io/status/1662413968839946241" target="_blank" rel="noopener">warned</a> on Twitter that one of its community moderators on Discord was compromised and posting fake airdrop details.</p>
<p><img decoding="async" loading="lazy" class="aligncenter wp-image-63819" src="media/d7f9e800.nahmii.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/nahmii.png" alt="" width="735" height="331" /></p>
<p>On May 9, <strong>MetrixCoin</strong> <a href="https://twitter.com/MetrixCoin/status/1656065789580005378" target="_blank" rel="noopener">reported</a> that its Discord server was hacked, with fake airdrop details pushed to all users.<span id="more-63767"></span></p>
<p>KrebsOnSecurity recently heard from a trusted source in the cybersecurity industry who dealt firsthand with one of these attacks and asked to remain anonymous.</p>
<p>&#8220;I do pro bono Discord security work for a few Discords, and I was approached by one of these fake journalists,&#8221; the source said. &#8220;I played along and got the link to their Discord, where they were pretending to be journalists from the Cryptonews website using several accounts.&#8221;</p>
<p>The source took note of all the Discord IDs of the admins of the fake Cryptonews Discord, so that he could ensure they were blocked from the Discords he helps to secure.</p>
<p>&#8220;Since I&#8217;ve been doing this for a while now, I&#8217;ve built up a substantial database of Discord users and messages, so often I can see these scammers&#8217; history on Discord,&#8221; the source said.</p>
<p>In this case, he noticed a user with the &#8220;CEO&#8221; role in the fake Cryptonews Discord had been seen previously under another username &#8212; &#8220;<strong>Levatax</strong>.&#8221; Searching on that Discord ID and username revealed a young Turkish coder named <strong>Berk Yilmaz</strong> whose <a href="https://github.com/Levatax/" target="_blank" rel="noopener">Github page</a> linked to the very <a href="https://discord.com/users/774718136532205578" target="_blank" rel="noopener">same Discord ID as the scammer CEO</a>.</p>
<p>Reached via instant message on <strong>Telegram</strong>, Levatax said he&#8217;s had no involvement in such schemes, and that he hasn&#8217;t been on Discord since his <strong>Microsoft Outlook</strong> account was hacked months ago.</p>
<p>&#8220;The interesting thing [is] that I didn&#8217;t use Discord since few months or even social media because of the political status of Turkey,&#8221; Levatax explained, referring to the recent election in his country. &#8220;The only thing I confirm is losing my Outlook account which connected to my Discord, and I&#8217;m already in touch with Microsoft to recover it.&#8221;</p>
<p>The verification method used in the above scam involves a type of bookmark called a &#8220;<a href="https://en.wikipedia.org/wiki/Bookmarklet" target="_blank" rel="noopener">bookmarklet</a>&#8221; that stores Javascript code as a clickable link in the bookmarks bar at the top of one&#8217;s browser.</p>
<p>While bookmarklets can be useful and harmless, malicious Javascript that is executed in the browser by the user is especially dangerous. So please avoid adding (or dragging) any bookmarks or bookmarklets to your browser unless it was your idea in the first place.</p>


feed_id: https://krebsonsecurity.com/?p=63801
title: Ask Fitis, the Bear: Real Crooks Sign Their Malware
uri: Ask-Fitis-the-Bear-Real-Crooks-Sign-Their-Malware
url: https://krebsonsecurity.com/2023/06/ask-fitis-the-bear-real-crooks-sign-their-malware/
content:
<p>Code-signing certificates are supposed to help authenticate the identity of software publishers, and provide cryptographic assurance that a signed piece of software has not been altered or tampered with. Both of these qualities make stolen or ill-gotten code-signing certificates attractive to cybercriminal groups, who prize their ability to add stealth and longevity to malicious software. This post is a deep dive on &#8220;<strong>Megatraffer</strong>,&#8221; a veteran Russian hacker who has practically cornered the underground market for malware focused code-signing certificates since 2015.</p>
<div id="attachment_63846" style="width: 760px" class="wp-caption aligncenter"><a href="media/158e8614.megatraffer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/megatraffer.png" target="_blank" rel="noopener"><img aria-describedby="caption-attachment-63846" decoding="async" class="wp-image-63846" src="media/158e8614.megatraffer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/megatraffer.png" alt="" width="750" height="430" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/05/megatraffer.png 846w, https://krebsonsecurity.com/wp-content/uploads/2023/05/megatraffer-768x440.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/05/megatraffer-782x448.png 782w" sizes="(max-width: 750px) 100vw, 750px" /></a><p id="caption-attachment-63846" class="wp-caption-text">One of Megatraffer&#8217;s ads on an English-language cybercrime forum.</p></div>
<p>A review of Megatraffer&#8217;s posts on Russian crime forums shows this user began peddling individual stolen code-signing certs in 2015 on the Russian-language forum <strong>Exploit</strong>, and soon expanded to selling certificates for cryptographically signing applications and files designed to run in <strong>Microsoft Windows</strong>, <strong>Java</strong>, <strong>Adobe AIR</strong>, <strong>Mac</strong> and <strong>Microsoft Office</strong>.</p>
<p>Megatraffer explained that malware purveyors need a certificate because many antivirus products will be far more interested in unsigned software, and because signed files downloaded from the Internet don&#8217;t tend to get blocked by security features built into modern web browsers. Additionally, newer versions of Microsoft Windows will complain with a bright yellow or red alert message if users try to install a program that is not signed.</p>
<p>&#8220;Why do I need a certificate?&#8221; Megatraffer asked rhetorically in their Jan. 2016 sales thread on Exploit. &#8220;Antivirus software trusts signed programs more. For some types of software, a digital signature is mandatory.&#8221;</p>
<p>At the time, Megatraffer was selling unique code-signing certificates for $700 apiece, and charging more than twice that amount ($1,900) for an &#8220;extended validation&#8221; or EV code-signing cert, which is supposed to only come with additional identity vetting of the certificate holder. According to Megatraffer, EV certificates were a &#8220;must-have&#8221; if you wanted to sign malicious software or hardware drivers that would reliably work in newer Windows operating systems.</p>
<div id="attachment_63853" style="width: 758px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63853" decoding="async" loading="lazy" class=" wp-image-63853" src="media/bb23e0dd.mega-codesigned.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/mega-codesigned.png" alt="" width="748" height="254" /><p id="caption-attachment-63853" class="wp-caption-text">Part of Megatraffer&#8217;s ad. Image: Ke-la.com.</p></div>
<p>Megatraffer has continued to offer their code-signing services across more than a half-dozen other Russian-language cybercrime forums, mostly in the form of sporadically available EV and non-EV code-signing certificates from major vendors like <strong>Thawte</strong> and <strong>Comodo</strong>.</p>
<p>More recently, it appears Megatraffer has been working with ransomware groups to help improve the stealth of their malware. Shortly after Russia invaded Ukraine in February 2022, someone <a href="https://krebsonsecurity.com/2022/03/conti-ransomware-group-diaries-part-i-evasion/" target="_blank" rel="noopener">leaked several years of internal chat logs from the Conti ransomware gang</a>, and those logs show Megatraffer was working with the group to help code-sign their malware between July and October 2020.<span id="more-63801"></span></p>
<h2>WHO IS MEGATRAFFER?</h2>
<p>According to cyber intelligence firm <a href="https://www.intel471.com" target="_blank" rel="noopener">Intel 471</a>, Megatraffer has been active on more than a half-dozen crime forums from September 2009 to the present day. And on most of these identities, Megatraffer has used the email address <strong>774748@gmail.com</strong>. That same email address also is tied to two forum accounts for a user with the handle &#8220;<strong>O.R.Z</strong>.&#8221;</p>
<p><a href="https://www.constellaintelligence.com" target="_blank" rel="noopener">Constella Intelligence</a>, a company that tracks exposed databases, finds that 774748@gmail.com was used in connection with just a handful of passwords, but most frequently the password &#8220;<strong>featar24</strong>&#8220;. Pivoting off of that password reveals a handful of email addresses, including <strong>akafitis@gmail.com</strong>.</p>
<p>Intel 471 shows akafitis@gmail.com was used to register another O.R.Z. user account &#8212; this one on Verified[.]ru in 2008. Prior to that, akafitis@gmail.com was used as the email address for the account &#8220;<strong>Fitis</strong>,&#8221; which was active on Exploit between September 2006 and May 2007. Constella found the password &#8220;featar24&#8221; also was used in conjunction with the email address <strong>spampage@yandex.ru</strong>, which is tied to yet another O.R.Z. account on Carder[.]su from 2008.</p>
<p>The email address akafitis@gmail.com was used to create <a href="https://fitis.livejournal.com/" target="_blank" rel="noopener">a Livejournal blog profile named Fitis</a> that has a large bear as its avatar. In November 2009, Fitis wrote, &#8220;I am the perfect criminal. My fingerprints change beyond recognition every few days. At least my laptop is sure of it.&#8221;</p>
<div id="attachment_63858" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63858" decoding="async" loading="lazy" class=" wp-image-63858" src="media/9e5d26b7.fitislj.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/fitislj.png" alt="" width="751" height="382" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/fitislj.png 1364w, https://krebsonsecurity.com/wp-content/uploads/2023/06/fitislj-768x391.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/fitislj-782x398.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-63858" class="wp-caption-text">Fitis&#8217;s Livejournal account. Image: Archive.org.</p></div>
<p>Fitis&#8217;s real-life identity was exposed in 2010 after two of the biggest sponsors of pharmaceutical spam went to war with each other, and large volumes of internal documents, emails and chat records seized from both spam empires <a href="https://krebsonsecurity.com/2011/02/spamit-glavmed-pharmacy-networks-exposed/" target="_blank" rel="noopener">were leaked to this author</a>. That protracted and public conflict formed the backdrop of my 2014 book &#8212; &#8220;<a href="https://www.amazon.com/Spam-Nation-Organized-Cybercrime-Epidemic-ebook/dp/B00L5QGBL0/ref=dp_kinw_strp_1" target="_blank" rel="noopener"><em>Spam Nation: The Inside Story of Organized Cybercrime, from Global Epidemic to Your Front Door.</em></a>&#8221;</p>
<p>One of the leaked documents included a Microsoft Excel spreadsheet containing the real names, addresses, phone numbers, emails, street addresses and <a href="https://en.wikipedia.org/wiki/WebMoney" target="_blank" rel="noopener">WebMoney</a> addresses for dozens of top earners in <strong>Spamit</strong> &#8212; at the time the most successful pharmaceutical spam affiliate program in the Russian hacking scene and one that <a href="https://krebsonsecurity.com/2012/01/pharma-wars-google-the-cutwail-botmaster/" target="_blank" rel="noopener">employed</a> <a href="https://krebsonsecurity.com/2012/08/harvesting-data-on-the-xarvester-botmaster/" target="_blank" rel="noopener">most</a> <a href="https://krebsonsecurity.com/2012/06/who-is-the-festi-botmaster/" target="_blank" rel="noopener">of</a> <a href="https://krebsonsecurity.com/2012/01/pharma-wars-mr-srizbi-vs-mr-cutwail/" target="_blank" rel="noopener">the</a> <a href="https://krebsonsecurity.com/2011/06/rustock-botnet-suspect-sought-job-at-google/" target="_blank" rel="noopener">top</a> <a href="https://krebsonsecurity.com/2021/07/spam-kingpin-peter-levashov-gets-time-served/" target="_blank" rel="noopener">Russian</a> <a href="https://krebsonsecurity.com/2011/12/chats-with-accused-mega-d-botnet-owner/" target="_blank" rel="noopener">botmasters</a>.</p>
<p>That document shows Fitis was one of Spamit&#8217;s most prolific recruiters, bringing more than 75 affiliates to the Spamit program over several years prior to <a href="https://krebsonsecurity.com/2010/09/spam-affialite-program-spamit-com-to-close/" target="_blank" rel="noopener">its implosion in 2010</a> (and earning commissions on any future sales from all 75 affiliates).</p>
<p>The document also says Fitis got paid using a WebMoney account that was created when its owner presented a valid Russian passport for a <strong>Konstantin Evgenievich Fetisov</strong>, born Nov. 16, 1982 and residing in Moscow. Russian motor vehicle records show two different vehicles are registered to this person at the same Moscow address.</p>
<p>The most interesting domain name registered to the email address spampage@yahoo.com, fittingly enough, is <strong>fitis[.]ru</strong>, which <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools.com</a> says was registered in 2005 to a <strong>Konstantin E. Fetisov</strong> from Moscow.</p>
<p>The Wayback Machine at archive.org has a handful of mostly blank pages indexed for fitis[.]ru in its early years, but for <a href="https://web.archive.org/web/20060813045609/http://fitis.ru:80/" target="_blank" rel="noopener">a brief period in 2007</a> it appears this website was <a href="https://web.archive.org/web/*/http://fitis.ru*" target="_blank" rel="noopener">inadvertently exposing all of its file directories to the Internet</a>.</p>
<p>One of the exposed files &#8212; <a href="https://web.archive.org/web/20081010185056/http://www.fitis.ru:80/glavmed.html" target="_blank" rel="noopener"><strong>Glavmed.html</strong></a> &#8212; is a general invitation to the infamous Glavmed pharmacy affiliate program, a now-defunct scheme that paid tens of millions of dollars to affiliates who advertised online pill shops mainly by hacking websites and manipulating search engine results. Glavmed was operated by <a href="https://www.nytimes.com/2010/10/27/business/27spam.html" target="_blank" rel="noopener">the same Russian cybercriminals who ran the Spamit program</a>.</p>
<div id="attachment_63841" style="width: 760px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63841" decoding="async" loading="lazy" class=" wp-image-63841" src="media/02bce981.glavmed-fitis.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/05/glavmed-fitis.png" alt="" width="750" height="938" /><p id="caption-attachment-63841" class="wp-caption-text">A Google translated ad circa 2007 recruiting for the pharmacy affiliate program Glavmed, which told interested applicants to contact the ICQ number used by Fitis, a.k.a. MegaTraffer. Image: Archive.org.</p></div>
<p>Archive.org shows the fitis[.]ru webpage with the Glavmed invitation was continuously updated with new invite codes. In their message to would-be Glavmed affiliates, the program administrator asked applicants to contact them at the <strong>ICQ number</strong> <strong>165540027</strong>, which Intel 471 found was an instant messenger address previously used by Fitis on Exploit.</p>
<p>The exposed files in the archived version of fitis[.]ru include source code for malicious software, lists of compromised websites used for pharmacy spam, and a handful of what are apparently personal files and photos. Among the photos is a 2007 image labeled merely &#8220;<a href="media/13b5abdf.fitis.jpg" data-original-source="https://web.archive.org/web/20070117021011/http://fitis.ru:80/fitis.jpg" target="_blank" rel="noopener">fitis.jpg</a>,&#8221; which shows a bespectacled, bearded young man with a ponytail standing next to what appears to be a newly-married couple at a wedding ceremony.</p>
<p>Mr. Fetisov did not respond to requests for comment.</p>
<p>As a veteran organizer of affiliate programs, Fitis did not waste much time building a new moneymaking collective after Spamit closed up shop. New York City-based cyber intelligence firm <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a> found that Megatraffer&#8217;s ICQ was the contact number for <strong>Himba[.]ru</strong>, a cost-per-acquisition (CPA) program launched in 2012 that paid handsomely for completed application forms tied to a variety of financial instruments, including consumer credit cards, insurance policies, and loans.</p>
<p>&#8220;Megatraffer&#8217;s entrenched presence on cybercrime forums strongly suggests that malicious means are used to source at least a portion of traffic delivered to HIMBA&#8217;s advertisers,&#8221; Flashpoint observed in a threat report on the actor.</p>
<p>Intel 471 finds that Himba was an active affiliate program until around May 2019, when it stopping paying its associates.</p>
<div id="attachment_63876" style="width: 761px" class="wp-caption aligncenter"><img aria-describedby="caption-attachment-63876" decoding="async" loading="lazy" class=" wp-image-63876" src="media/6f6ffcd2.himba-ru.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2023/06/himba-ru.png" alt="" width="751" height="457" srcset="https://krebsonsecurity.com/wp-content/uploads/2023/06/himba-ru.png 1312w, https://krebsonsecurity.com/wp-content/uploads/2023/06/himba-ru-768x468.png 768w, https://krebsonsecurity.com/wp-content/uploads/2023/06/himba-ru-782x476.png 782w" sizes="(max-width: 751px) 100vw, 751px" /><p id="caption-attachment-63876" class="wp-caption-text">Fitis&#8217;s Himba affiliate program, circa February 2014. Image: Archive.org.</p></div>
<p>Flashpoint notes that in September 2015, Megatraffer posted a job ad on Exploit seeking experienced coders to work on browser plugins, installers and &#8220;loaders&#8221; &#8212; basically remote access trojans (RATs) that establish communication between the attacker and a compromised system.</p>
<p>&#8220;The actor specified that he is looking for full-time, onsite help either in his Moscow or Kiev locations,&#8221; Flashpoint wrote.</p>


