# articles

feed_id: https://krebsonsecurity.com/?p=43654
title: T-Mobile Employee Made Unauthorized ‘SIM Swap’ to Steal Instagram Account
uri: T-Mobile-Employee-Made-Unauthorized-SIM-Swap-to-Steal-Instagram
url:
https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/

content:
<p><strong>T-Mobile</strong> is investigating a retail store employee who allegedly made unauthorized changes to a subscriber&#8217;s account in an elaborate scheme to steal the customer&#8217;s three-letter <strong>Instagram</strong> username. The modifications, which could have let the rogue employee empty bank accounts associated with the targeted T-Mobile subscriber, were made even though the victim customer already had taken steps recommended by the mobile carrier to help minimize the risks of account takeover. Here&#8217;s what happened, and some tips on how you can protect yourself from a similar fate.</p>
<p>Earlier this month, KrebsOnSecurity heard from <strong>Paul Rosenzweig</strong>, a 27-year-old T-Mobile customer from Boston who had his wireless account briefly hijacked. Rosenzweig had previously adopted <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">T-Mobile&#8217;s advice</a> to customers about blocking mobile number port-out scams, an increasingly common scheme in which identity thieves armed with a fake ID in the name of a targeted customer show up at a retail store run by a different wireless provider and ask that the number to be transferred to the competing mobile company&#8217;s network.</p>
<p><img class="aligncenter wp-image-40415" src="media/618d5447.phonefraudsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="596" height="301" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 596px) 100vw, 596px" /></p>
<p>So-called &#8220;port out&#8221; scams allow crooks to intercept your calls and messages while your phone goes dark. Porting a number to a new provider shuts off the phone of the original user, and forwards all calls to the new device. Once in control of the mobile number, thieves who have already stolen a target&#8217;s password(s) can request any second factor that is sent to the newly activated device, such as a one-time code sent via text message or or an automated call that reads the one-time code aloud.</p>
<p>In this case, however, the perpetrator didn&#8217;t try to port Rosenzweig&#8217;s phone number: Instead, the attacker called multiple T-Mobile retail stores within an hour&#8217;s drive of Rosenzweig&#8217;s home address until he succeeded in convincing a store employee to conduct what&#8217;s known as a &#8220;SIM swap.&#8221;</p>
<p>A SIM swap is a legitimate process by which a customer can request that a new SIM card (the tiny, removable chip in a mobile device that allows it to connect to the provider&#8217;s network) be added to the account. Customers can request a SIM swap when their existing SIM card has been damaged, or when they are switching to a different phone that requires a SIM card of another size.</p>
<p>However, thieves and other ne&#8217;er-do-wells can abuse this process by posing as a targeted mobile customer or technician and tricking employees at the mobile provider into swapping in a new SIM card for that customer on a device that they control. If successful, the SIM swap accomplishes more or less the same result as a number port out (at least in the short term) &#8212; effectively giving the attackers access to any text messages or phone calls that are sent to the target&#8217;s mobile account.</p>
<p>Rosenzweig said the first inkling he had that something wasn&#8217;t right with his phone was on the evening of May 2, 2018, when he spotted an automated email from <strong>Instagram</strong>. The message said the email address tied to the three-letter account he&#8217;d had on the social media platform for seven years &#8212; instagram.com/par &#8212; had been changed. He quickly logged in to his Instagram account, changed his password and then reverted the email on the account back to his original address.</p>
<p>By this time, the SIM swap conducted by the attacker had already been carried out, although Rosenzweig said he didn&#8217;t notice his phone displaying zero bars and no connection to T-Mobile at the time because he was at home and happily surfing the Web on his device using his own wireless network.</p>
<p>The following morning, Rosenzweig received another notice &#8212; this one from <strong>Snapchat</strong> &#8212; stating that the password for his account there (&#8220;p9r&#8221;) had been changed. He subsequently reset the Instagram password and then e<a href="https://support.snapchat.com/a/enable-login-verification" target="_blank" rel="noopener">nabled two factor authentication on his Snapchat account</a>.</p>
<p>&#8220;That was when I realized my phone had no bars,&#8221; he recalled. &#8220;My phone was dead. I couldn&#8217;t even call 611,&#8221; [the mobile short number that all major wireless providers make available to reach their customer service departments].&#8221;</p>
<p>It appears that the perpetrator of the SIM swap abused not only internal knowledge of T-Mobile&#8217;s systems, but also a lax password reset process at Instagram. The social network allows users to enable notifications on their mobile phone when password resets or other changes are requested on the account.</p>
<p>But this isn&#8217;t exactly two-factor authentication because it also lets users reset their passwords via their mobile account by requesting a password reset link to be sent to their mobile device. Thus, if someone is in control of your mobile phone account, they can reset your Instagram password (and probably a bunch of other types of accounts).</p>
<p>Rosenzweig said even though he was able to reset his Instagram password and restore his old email address tied to the account, the damage was already done: All of his images and other content he&#8217;d shared on Instagram over the years was still tied to his account, but the attacker had succeeded in stealing his &#8220;par&#8221; username, leaving him with a slightly less sexy &#8220;par54384321,&#8221; (apparently chosen for him at random by either Instagram or the attacker).<span id="more-43654"></span></p>
<p>As <a href="https://krebsonsecurity.com/2015/11/talktalk-script-kids-the-quest-for-og/" target="_blank" rel="noopener">I wrote in November 2015</a>, short usernames are something of a prestige or status symbol for many youngsters, and some are willing to pay surprising sums of money for them. Known as “OG” (short for “original” and also “original gangster”) in certain circles online, these can be usernames for virtually any service, from email accounts at Webmail providers to social media services like <strong>Instagram</strong>, <strong>Snapchat</strong>, <strong>Twitter</strong> and <strong>Youtube</strong>.</p>
<p>People who traffic in OG accounts prize them because they can make the account holder appear to have been a savvy, early adopter of the service before it became popular and before all of the short usernames were taken.</p>
<p>Rosenzweig said a friend helped him work with T-Mobile to regain control over his account and deactivate the rogue SIM card. He said he&#8217;s grateful the attackers who hijacked his phone for a few hours didn&#8217;t try to drain bank accounts that also rely on his mobile device for authentication.</p>
<p>&#8220;It definitely could have been a lot worse given the access they had,&#8221; he said.</p>
<p>But throughout all of this ordeal, it struck Rosenzweig as odd that he never once received an email from T-Mobile stating that his SIM card had been swapped.</p>
<p>&#8220;I&#8217;m a software engineer and I thought I had pretty good security habits to begin with,&#8221; he said. &#8220;I never re-use passwords, and it&#8217;s hard to see what I could have done differently here. The flaw here was with T-Mobile mostly, but also with Instagram. It seems like by having the ability to change one&#8217;s [Instagram] password by email <em>or</em> by mobile alone negates the second factor and it becomes either/or from the attackers point of view.&#8221;</p>
<p>Sources close to the investigation say T-Mobile is investigating a current or former employee as the likely culprit. The mobile company <em>also acknowledged that it does not currently send customers an email to the email address on file when SIM swaps take place</em>. A T-Mobile spokesperson said the company was considering changing the current policy, which sends the customer a text message to alert them about the SIM swap.</p>
<p>&#8220;We take our customers privacy and security very seriously and we regret that this happened,&#8221; the company said in a written statement. &#8220;We notify our customers immediately when SIM changes occur, but currently we do not send those notifications via email. We are actively looking at ways to improve our processes in this area.&#8221;</p>
<p><span class="pullquote pqright">In summary, when a SIM swap happens on a T-Mobile account, T-Mobile will send a text message to the phone equipped with the new SIM card. But obviously that does not help someone who is the target of a SIM swap scam.</span></p>
<p>As we can see, just taking T-Mobile&#8217;s advice to place a personal identification number (PIN) on your account to block number port out scams does nothing to flag one&#8217;s account to make it harder to conduct SIM swap scams.</p>
<p>Rather, T-Mobile says customers need to call in to the company&#8217;s customer support line and place a separate &#8220;SIM lock&#8221; on their account, which can only be removed if the customer shows up at a retail store with ID (or, presumably, anyone with a fake ID who also knows the target&#8217;s Social Security Number and date of birth).</p>
<p>I checked with the other carriers to see if they support locking the customer&#8217;s current SIM to the account on file. I suspect they do, and will update this piece when/if I hear back from them. In the meantime, it might be best just to phone up your carrier and ask.</p>
<p><em>Please note that a SIM lock on your mobile account is separate from a SIM PIN that you can set via your mobile phone&#8217;s operating system.</em> A SIM PIN is essentially an additional layer of physical security that locks the current SIM to your device, requiring you to input a special PIN when the device is powered on in order to call, text or access your data plan on your phone. This feature can help block thieves from using your phone or accessing your data if you lose your phone, but it won&#8217;t stop thieves from physically swapping in their own SIM card.</p>
<p>iPhone users can follow <a href="https://support.apple.com/en-us/HT201529" target="_blank" rel="noopener">these instructions</a> to set or change a device&#8217;s SIM PIN. Android users can <a href="https://www.digitalcitizen.life/how-change-or-remove-sim-pin-android-2-steps" target="_blank" rel="noopener">see this page</a>. You may need to enter a carrier-specific default PIN before being able to change it. By default, the SIM PIN for all Verizon and AT&amp;T phones is &#8220;1111;&#8221; for T-Mobile and Sprint it should default to &#8220;1234.&#8221;</p>
<p><strong>Be advised, however, that if you forget your SIM PIN and enter the wrong PIN too many times, you may end up having to contact your wireless carrier to obtain a special &#8220;personal unlocking key&#8221; (PUK).</strong></p>
<p>At the very least, if you haven&#8217;t already done so please take a moment to place a port block PIN on your account. <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">This story</a> explains exactly how to do that.</p>
<p>Also, consider reviewing <a href="https://twofactorauth.org/" target="_blank" rel="noopener">twofactorauth.org</a> to see whether you are taking full advantage of any multi-factor authentication offerings so that your various accounts can&#8217;t be trivially hijacked if an attacker happens to guess, steal, phish or otherwise know your password.</p>
<p>One-time login codes produced by mobile apps such as <a href="https://authy.com/" target="_blank" rel="noopener">Authy,</a> <a href="https://duo.com/" target="_blank" rel="noopener">Duo</a> or <a href="https://support.google.com/accounts/answer/1066447?co=GENIE.Platform%3DAndroid&amp;hl=en" target="_blank" rel="noopener">Google Authenticator</a> are more secure than one-time codes sent via automated phone call or text &#8212; mainly because crooks can&#8217;t steal these codes if they succeed in porting your mobile number to another service or by executing a SIM swap on your mobile account [full disclosure: Duo is an advertiser on this blog].</p>


feed_id: https://krebsonsecurity.com/?p=43895
title: Mobile Giants: Please Don’t Share the Where
uri: Mobile-Giants-Please-Don-t-Share-the-Where
url: https://krebsonsecurity.com/2018/05/mobile-giants-please-dont-share-the-where/
content:
<p>Your mobile phone is giving away your approximate location all day long. This isn&#8217;t exactly a secret: It <em>has</em> to share this data with your mobile provider constantly to provide better call quality and to route any emergency 911 calls straight to your location. But now, the major mobile providers in the United States &#8212; <strong>AT&amp;T</strong>, <strong>Sprint</strong>, <strong>T-Mobile</strong> and <strong>Verizon</strong> &#8212; are selling this location information to third party companies &#8212; in real time &#8212; without your consent or a court order, and with apparently zero accountability for how this data will be used, stored, shared or protected.</p>
<p>Think about what&#8217;s at stake in a world where <em>anyone</em> can track your location at any time and in real-time. Right now, to be free of constant tracking the only thing you can do is remove the <a href="https://en.wikipedia.org/wiki/Subscriber_identity_module" target="_blank" rel="noopener">SIM card</a> from your mobile device never put it back in unless you <em>want</em> people to know where you are.</p>
<p><img class="aligncenter wp-image-43917" src="media/56f75d99.donthare.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/donthare.png" alt="" width="598" height="103" />It may be tough to put a price on one&#8217;s location privacy, but here&#8217;s something of which you can be sure: The mobile carriers are selling data about where you are at any time, without your consent, to third-parties for probably far less than you might be willing to pay to secure it.</p>
<p>The problem is that as long as anyone but the phone companies and law enforcement agencies with a valid court order can access this data, it is always going to be at extremely high risk of being hacked, stolen and misused.</p>
<p>Consider just two recent examples. Earlier this month <em>The New York Times</em> <a href="https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html" target="_blank" rel="noopener">reported</a> that a little-known data broker named Securus was selling local police forces around the country the ability to look up the precise location of any cell phone across all of the major U.S. mobile networks. Then it emerged that Securus had been hacked, its database of hundreds of law enforcement officer usernames and passwords plundered. We also found out that Securus&#8217; data was ultimately obtained from a California-based location tracking firm <a href="https://www.locationsmart.com" target="_blank" rel="noopener">LocationSmart</a>.</p>
<p>On May 17, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">broke the news</a> of research by <strong>Carnegie Mellon University</strong> PhD student <strong>Robert Xiao</strong>, who discovered that a LocastionSmart try-before-you-buy opt-in demo of the company&#8217;s technology was <em>wide open</em> &#8212; allowing real-time lookups from anyone on anyone&#8217;s mobile device &#8212; without any sort of authentication, consent or authorization.</p>
<p>Xiao said it took him all of about 15 minutes to discover that LocationSmart&#8217;s lookup tool could be used to track the location of virtually any mobile phone user in the United States.</p>
<p>Securus seems equally clueless about protecting the priceless data to which it was entrusted by LocationSmart. Over the weekend KrebsOnSecurity discovered that someone &#8212; almost certainly a security professional employed by Securus &#8212; has been <a href="https://www.virustotal.com/#/domain/securustech.net" target="_blank" rel="noopener">uploading dozens of emails, PDFs, password lists and other files</a> to <strong>Virustotal.com</strong> &#8212; a service owned by Google that can be used to scan any submitted file against dozens of commercial antivirus tools.</p>
<p>Antivirus companies willingly participate in Virustotal because it gives them early access to new, potentially malicious files being spewed by cybercriminals online. Virustotal users can submit suspicious files of all kind; in return they&#8217;ll see whether any of the 60+ antivirus tools think the file is bad or benign.</p>
<p>One basic rule that all Virustotal users need to understand is that <em>any</em> file submitted to Virustotal is also available to customers who purchase access to the service&#8217;s file repository. Nevertheless, for the past two years someone at Securus has been submitting a great deal of information about the company&#8217;s operations to Virustotal, including copies of internal emails and PDFs about visitation policies at a number of local and state prisons and jails that made up much of Securus&#8217; business.</p>
<div id="attachment_43906" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/600e9776.securusfiles-vt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/securusfiles-vt.png"><img class="wp-image-43906" src="media/600e9776.securusfiles-vt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/securusfiles-vt.png" alt="" width="597" height="611" /></a><p class="wp-caption-text">Some of the many, many files uploaded to Virustotal.com over the years by someone at Securus Technologies.</p></div>
<p>One of the files, submitted on April 27, 2018, is titled &#8220;38k user pass microsemi.com &#8211; joomla_production.mic_users_blockedData.txt&#8221;.  This file includes the names and what appear to be hashed/scrambled passwords of some 38,000 accounts &#8212; supposedly taken from <strong>Microsemi</strong>, a company that&#8217;s been called the largest U.S. commercial supplier of military and aerospace semiconductor equipment.</p>
<p>Many of the usernames in that file do map back to names of current and former employees at Microsemi. KrebsOnSecurity shared a copy of the database with Microsemi, but has not yet received a reply. Securus also has not responded to requests for comment.</p>
<p>These files that someone at Securus <a href="https://www.virustotal.com/#/domain/securustech.net" target="_blank" rel="noopener">apparently submitted regularly to Virustotal</a> also provide <a href="https://krebsonsecurity.com/wp-content/uploads/2018/05/securus-observedsubdomains.txt" target="_blank" rel="noopener">something of an internal roadmap of Securus&#8217; business dealings</a>, revealing the names and login pages for several police departments and jails across the country, such as the <a href="https://traviscountyxj.securustech.net/ArchonixXJailSites/" target="_blank" rel="noopener">Travis County Jail site&#8217;s Web page to access Securus&#8217; data</a>.</p>
<p>Check out the screen shot below. Notice that forgot password link there? Clicking that prompts the visitor to enter their username and to select a &#8220;security question&#8221; to answer. There are but three questions: &#8220;What is your pet&#8217;s name? What is your favorite color? And what town were you born in?&#8221; There don&#8217;t appear to be any limits on the number of times one can attempt to answer a secret question.</p>
<div id="attachment_43904" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/17438e41.travis-secretquestion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/travis-secretquestion.png"><img class="wp-image-43904" src="media/17438e41.travis-secretquestion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/travis-secretquestion.png" alt="" width="599" height="216" /></a><p class="wp-caption-text">Choose wisely and you, too, could gain the ability to look up anyone&#8217;s precise mobile location.</p></div>
<p>Given such robust, state-of-the-art security, how long do you think it would take for someone to figure out how to reset the password for any authorized user at Securus&#8217; Travis County Jail portal?</p>
<p>Yes, companies like Securus and Location Smart have been careless with securing our prized location data, but why should they care if their paying customers are happy and the real-time data feeds from the mobile industry keep flowing?</p>
<p>No, the real blame for this sorry state of affairs comes down to AT&amp;T, Sprint, T-Mobile and Verizon. T-Mobile was the only one of the four major providers that admitted providing Securus and LocationSmart with the ability to perform real-time location lookups on their customers. The other three carriers declined to confirm or deny that they did business with either company.<span id="more-43895"></span></p>
<p>As noted in my story last Thursday, LocationSmart included the logos of the four carriers on their home page &#8212; in addition to those of several other major firms (that information is no longer available on the company&#8217;s site, but it can still be viewed by visiting <a href="https://web.archive.org/web/20180516060611/https://www.locationsmart.com/" target="_blank" rel="noopener">this historic record of it</a> over at the Internet Archive).</p>
<p>Now, don&#8217;t think for a second that these two tiny companies are the only ones with permission from the mobile giants to look up such sensitive information on demand. At a minimum, each one of these companies can in theory resell (or leak) this information and access to others. On 15 May, <a title="ZDNet: US cell carriers are selling access to your real-time phone location data" href="https://www.zdnet.com/article/us-cell-carriers-selling-access-to-real-time-location-data/" rel="noreferrer" data-ss1526908420="1">ZDNet reported</a> that Securus was getting its data from the carriers by going through an intermediary: <strong>3Cinteractive</strong>, which was getting it from LocationSmart.</p>
<p>However, it is interesting that the first insight we got that the mobile firms were being so promiscuous with our private location data came in <a href="https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html" target="_blank" rel="noopener">the Times story</a> about law enforcement officials seeking the ability to access any mobile device&#8217;s location data in real time.</p>
<p>All technologies are double-edged swords, which means that each can be used both for good and malicious ends. As much as police officers may wish to avoid the hassle and time constraints of having to get a warrant to determine the precise location of anyone they please whenever they wish, those same law enforcement officers should remember that this technology works both ways: It also can just as easily be abused by criminals to track the real-time movements of police and their families, informants, jurors, witnesses and even judges.</p>
<p>Consider the damage that organized crime syndicates &#8212; human traffickers, drug smugglers and money launderers &#8212; could inflict armed with an app that displays the precise location of every uniformed officer from within 300 ft to across the country. All because they just happened to know the cell phone number tied to each law enforcement official.</p>
<p>Maybe you have children or grandchildren who &#8212; like many of their peers these days &#8212; carry a mobile device at all times for safety and for quick communication with parents or guardians. Now imagine that anyone in the world has the instant capability to track where your kid is at any time of day. All they&#8217;d need is your kid&#8217;s digits.</p>
<p>Maybe you&#8217;re the current or former target of a stalker, jilted ex-spouse, or vengeful co-worker. Perhaps you perform sensitive work for the government. All of the above-mentioned parties and many more are put at heightened personal risk by having their real-time location data exposed to commercial third parties.</p>
<p>Some people might never sell their location data for any price: I suspect most of us would like this information always to be private unless and until we change the defaults (either in a binary &#8220;on/off&#8221; way or app-specific). On the other end of the spectrum there are probably plenty of people who don&#8217;t care one way or another provided that sharing their location information brings them some real or perceived financial or commercial benefit.</p>
<p><span class="pullquote pqright">The point is, for many of us location privacy is priceless because, without it, almost everything else we&#8217;re doing to safeguard our privacy goes out the window.</span></p>
<p>And this sad reality will persist until the mobile providers state <em>unequivocally</em> that they will no longer sell or share customer location data without having received and validated some kind of legal obligation &#8212; such as a court-ordered subpoena.</p>
<p>But even that won&#8217;t be enough, because companies can and do change their policies all the time without warning or recourse (witness the current reality). It won&#8217;t be enough until lawmakers <em>in this Congress</em> step up and do their jobs &#8212; to prevent the mobile providers from selling our last remaining bastion of privacy in the free world to third party companies who simply can&#8217;t or won&#8217;t keep it secure.</p>
<p>The next post in this series will examine how we got here, and what Congress and federal regulators have done and might do to rectify the situation.</p>


feed_id: https://krebsonsecurity.com/?p=43950
title: 3 Charged In Fatal Kansas ‘Swatting’ Attack
uri: 3-Charged-In-Fatal-Kansas-Swatting-Attack
url: https://krebsonsecurity.com/2018/05/3-charged-in-fatal-kansas-swatting-attack/
content:
<p>Federal prosecutors have charged three men with carrying out a deadly hoax known as &#8220;swatting,&#8221; in which perpetrators call or message a target&#8217;s local 911 operators claiming a fake hostage situation or a bomb threat in progress at the target&#8217;s address &#8212; with the expectation that local police may respond to the scene with deadly force. While only one of the three men is accused of making the phony call to police that got an innocent man shot and killed, investigators say the other two men&#8217;s efforts to taunt and deceive one another ultimately helped point the gun.</p>
<div id="attachment_43954" style="width: 288px" class="wp-caption alignright"><img class=" wp-image-43954" src="media/2d8d56db.barriss.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/barriss.png" alt="" width="278" height="276" /><p class="wp-caption-text">Tyler &#8220;SWAuTistic&#8221; Barriss. Photo: AP</p></div>
<p>According to prosecutors, the tragic hoax started with a dispute over a match in the online game &#8220;<a href="https://en.wikipedia.org/wiki/Call_of_Duty" target="_blank" rel="noopener">Call of Duty</a>.&#8221; The indictment says <strong>Shane M. Gaskill</strong>, a 19-year-old Wichita, Kansas resident, and <strong>Casey S. Viner</strong>, 18, had a falling out over a $1.50 game wager.</p>
<p>Viner allegedly wanted to get back at Gaskill, and so enlisted the help of another man &#8212; <strong>Tyler R. Barriss</strong> &#8212; a serial swatter known by the alias &#8220;SWAuTistic&#8221; who&#8217;d <a href="https://krebsonsecurity.com/2018/01/serial-swatter-swautistic-bragged-he-hit-100-schools-10-homes/" target="_blank" rel="noopener">bragged of &#8220;swatting&#8221; hundreds of schools and dozens of private residences.</a></p>
<p>The federal indictment references transcripts of alleged online chats among the three men. In an exchange on Dec. 28, 2017, Gaskill taunts Barriss on Twitter after noticing that Barriss&#8217;s Twitter account (@swattingaccount) had suddenly started following him.</p>
<p>Viner and Barriss both allegedly say if Gaskill isn&#8217;t scared of getting swatted, he should give up his home address. But the address that Gaskill gave Viner to pass on to Barriss no longer belonged to him and was occupied by a new tenant.</p>
<p>Barriss allegedly then called the emergency 911 operators in Wichita and said he was at the address provided by Viner, that he&#8217;d just shot his father in the head, was holding his mom and sister at gunpoint, and was thinking about burning down the home with everyone inside.</p>
<p>Wichita police quickly responded to the fake hostage report and surrounded the address given by Gaskill. Seconds later, 28-year-old <strong>Andrew Finch</strong> exited his mom&#8217;s home and was killed by a single shot from a Wichita police officer. Finch, a father of two, had no party to the gamers&#8217; dispute and was simply in the wrong place at the wrong time.</p>
<p>Just minutes after the fatal shooting, Barriss &#8212; who is in Los Angeles  &#8212; is allegedly anxious to learn if his Kansas swat attempt was successful. Someone has just sent Barriss a screenshot of a conversation between Viner and Gaskill mentioning police at Gaskill&#8217;s home and someone getting killed. So Barriss allegedly then starts needling Gaskill via instant message:</p>
<blockquote><p>Defendant BARRISS: Yo answer me this<br />
Defendant BARRISS: Did police show up to your house yes or no<br />
Defendant GASKILL: No dumb fuck<br />
Defendant BARRISS: Lmao here’s how I know you’re lying</p></blockquote>
<p>Prosecutors say Barriss then posted a screen shot showing the following conversation between Viner and Gaskill:</p>
<blockquote><p>Defendant VINER: Oi<br />
Defendant GASKILL: Hi<br />
Defendant VINER: Did anyone show @ your house?<br />
Defendant VINER: Be honest<br />
Defendant GASKILL: Nope<br />
Defendant GASKILL: The cops are at my house because someone ik just killed his dad</p></blockquote>
<p>Barriss and Gaskill then allegedly continued their conversation:</p>
<blockquote><p>Defendant GASKILL: They showed up to my old house retard<br />
Defendant BARRISS: That was the call script<br />
Defendant BARRISS: Lol<br />
Defendant GASKILL: Your literally retarded<br />
Defendant GASKILL: Ik dumb ass<br />
Defendant BARRISS: So you just got caught in a lie<br />
Defendant GASKILL: No I played along with you<br />
Defendant GASKILL: They showed up to my old house that we own and rented out<br />
Defendant GASKILL: We don’t live there anymore bahahaha<br />
Defendant GASKILL: ik you just wasted your time and now your pissed<br />
Defendant BARRISS: Not really<br />
Defendant BARRISS: Once you said “killed his dad” I knew it worked lol<br />
Defendant BARRISS: That was the call lol<br />
Defendant GASKILL: Yes it did buy they never showed up to my house<br />
Defendant GASKILL: You guys got trolled<br />
Defendant GASKILL: Look up who live there we moved out almost a year ago<br />
Defendant GASKILL: I give you props though you’re the 1% that can actually swat babahaha<br />
Defendant BARRISS: Dude MY point is You gave an address that you dont live at but you were acting tough lol<br />
Defendant BARRISS: So you’re a bitch</p></blockquote>
<p>Later on the evening of Dec. 28, after news of the fatal swatting started blanketing the local television coverage in Kansas, Gaskill allegedly told Barriss to delete their previous messages. &#8220;Bape&#8221; in this conversation refers to a nickname allegedly used by Casey Viner:<span id="more-43950"></span></p>
<blockquote><p>Defendant GASKILL: Dm asap<br />
Defendant GASKILL: Please it’s very fucking impi<br />
Defendant GASKILL: Hello<br />
Defendant BARRISS: ?<br />
Defendant BARRISS: What you want<br />
Defendant GASKILL: Dude<br />
Defendant GASKILL: Me you and bape<br />
Defendant GASKILL: Need to delete everything<br />
Defendant GASKILL: This is a murder case now<br />
Defendant GASKILL: Casey deleted everything<br />
Defendant GASKILL: You need 2 as well<br />
Defendant GASKILL: This isn’t a joke K troll anymore<br />
Defendant GASKILL: If you don’t you’re literally retarded I’m trying to help you both out<br />
Defendant GASKILL: They know it was swat call</p></blockquote>
<p>The indictment also features chat records between Viner and others in which he admits to his role in the deadly swatting attack. In the follow chat excerpt, Viner was allegedly talking with someone identified only as &#8220;J.D.&#8221;</p>
<blockquote><p>Defendant VINER: I literally said you’re gonna be swatted, and the guy who swatted him can easily say I convinced him or something when I said hey can you swat this guy and then gave him the address and he said yes and then said he’d do it for free because I said he doesn’t think anything will happen<br />
Defendant VINER: How can I not worry when I googled what happens when you’re involved and it said a eu [sic] kid and a US person got 20 years in prison min<br />
Defendant VINER: And he didn’t even give his address he gave a false address apparently<br />
J.D.: You didn’t call the hoax in…<br />
Defendant VINER: Does t [sic] even matter ?????? I was involved I asked him to do it in the first place<br />
Defendant VINER: I gave him the address to do it, but then again so did the other guy he gave him the address to do it as well and said do it pull up etc</p></blockquote>
<p>Barriss is charged with multiple counts of making false information and hoaxes; cyberstalking; threatening to kill another or damage property by fire; interstate threats, conspiracy; and wire fraud. Viner and Gaskill were both charged with wire fraud, conspiracy and obstruction of justice. A copy of the indictment is available <a href="https://www.courtlistener.com/docket/6872417/1/united-states-v-barriss/" target="_blank" rel="noopener">here</a>.</p>
<p>The <em>Associated Press</em> <a href="https://apnews.com/7506fcc387314c9eb3c14a20ab45bdad" target="_blank" rel="noopener">reports</a> that the most serious charge of making a hoax call carries a potential life sentence because it resulted in a death, and that some of the other charges carry sentences of up to 20 years.</p>
<div id="attachment_42124" style="width: 518px" class="wp-caption aligncenter"><img class="size-full wp-image-42124" src="media/76cf57ef.singleshot.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/01/singleshot.png" alt="" width="508" height="353" /><p class="wp-caption-text">The moment that police in Kansas fired a single shot that killed Andrew Finch.</p></div>
<p>As I told the AP, swatting has been a problem for years, but it seems to have intensified around the time that top online gamers started being able to make serious money playing games online and streaming those games live to thousands or even tens of thousands of paying subscribers. Indeed, Barriss himself had earned a reputation as someone who delighted in watching police kick in doors behind celebrity gamers who were live-streaming.</p>
<p>This case is not the first time federal prosecutors have charged multiple people in the same swatting attacks even if only one person was involved in actually making the phony hoax calls to police. In 2013, <a href="https://krebsonsecurity.com/2013/03/the-world-has-no-room-for-cowards/" target="_blank" rel="noopener">my home was the target of a swatting attack</a> that thankfully ended without incident. The government ultimately charged four men — several of whom were minors at the time — with conducting that swat attack as well as many others they’d perpetrated against public figures and celebrities.</p>
<p>But despite spending considerable resources investigating those crimes, prosecutors were able to secure only light punishments for those involved in the swatting spree. One of those men, a serial swatter and cyberstalker named <strong>Mir Islam</strong>, was <a href="https://krebsonsecurity.com/2016/07/serial-swatter-stalker-and-doxer-mir-islam-gets-just-1-year-in-jail/" target="_blank" rel="noopener">sentenced to to just one year in jail</a> for his role in multiple swattings.  Another individual who was part of that group &#8212; <strong>Eric &#8220;Cosmo the God&#8221; Taylor</strong> &#8212; <a href="https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/" target="_blank" rel="noopener">got three years of probation</a>.</p>
<p>Something tells me Barriss, Gaskill and Viner aren&#8217;t going to be so lucky. Barriss has admitted his role in many swattings, and he admitted to his last, fatal swatting in <a href="https://krebsonsecurity.com/2017/12/kansas-man-killed-in-swatting-attack/" target="_blank" rel="noopener">an interview he gave to KrebsOnSecurity</a> less than 24 hours after Andrew Finch&#8217;s murder &#8212; saying he was not the person who pulled the trigger.</p>
<p><img class="aligncenter size-full wp-image-42078" src="media/d19d66ba.swatutistic.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/12/swatutistic.png" alt="" width="568" height="910" /></p>


feed_id: https://krebsonsecurity.com/?p=43910
title: Why Is Your Location Data No Longer Private?
uri: Why-Is-Your-Location-Data-No-Longer-Private
url: https://krebsonsecurity.com/2018/05/why-is-your-location-data-no-longer-private/
content:
<p>The past month has seen one blockbuster revelation after another about how our mobile phone and broadband providers have been leaking highly sensitive customer information, including <a href="https://krebsonsecurity.com/2018/05/mobile-giants-please-dont-share-the-where/" target="_blank" rel="noopener">real-time location data</a> and customer account details. In the wake of these consumer privacy debacles, many are left wondering who&#8217;s responsible for policing these industries? How exactly did we get to this point? What prospects are there for changes to address this national privacy crisis at the legislative and regulatory levels? These are some of the questions we&#8217;ll explore in this article.</p>
<p><img class="aligncenter wp-image-40944" src="media/e37a45be.capitol.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/capitol.png" alt="" width="591" height="277" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/capitol.png 1095w, https://krebsonsecurity.com/wp-content/uploads/2017/09/capitol-580x272.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/09/capitol-768x360.png 768w, https://krebsonsecurity.com/wp-content/uploads/2017/09/capitol-940x440.png 940w" sizes="(max-width: 591px) 100vw, 591px" /></p>
<p>In 2015, the <strong>Federal Communications Commission</strong> under the Obama Administration reclassified broadband Internet companies as telecommunications providers, which gave the agency authority to regulate broadband providers the same way as telephone companies.</p>
<p>The FCC also came up with so-called &#8220;<strong>net neutrality</strong>&#8221; rules designed to prohibit Internet providers from blocking or slowing down traffic, or from offering &#8220;fast lane&#8221; access to companies willing to pay extra for certain content or for higher quality service.</p>
<p>In mid-2016, the FCC adopted new privacy rules for all Internet providers that would have required providers to seek opt-in permission from customers before collecting, storing, sharing and selling anything that might be considered sensitive &#8212; including Web browsing, application usage and location information, as well as financial and health data.</p>
<p>But the Obama administration&#8217;s new FCC privacy rules didn&#8217;t become final until December 2016, a month after then <strong>President-elect Trump</strong> was welcomed into office by a Republican controlled House and Senate.</p>
<p>Congress still had 90 legislative days (when lawmakers are physically in session) to pass a resolution killing the privacy regulations, and on March 23, 2017 the Senate voted 50-48 to repeal them. Approval of the repeal in the House passed quickly thereafter, and <a href="https://www.washingtonpost.com/news/the-switch/wp/2017/04/04/trump-has-signed-repeal-of-the-fcc-privacy-rules-heres-what-happens-next/" target="_blank" rel="noopener">President Trump officially signed it on April 3, 2017</a>.</p>
<p>In <a href="https://www.washingtonpost.com/opinions/no-republicans-didnt-just-strip-away-your-internet-privacy-rights/2017/04/04/73e6d500-18ab-11e7-9887-1a5314b56a08_story.html?noredirect=on&amp;utm_term=.115f6c2bebb0" target="_blank" rel="noopener">an op-ed</a> published in <em>The Washington Post</em>, <strong>Ajit Pai</strong> &#8212; a former <strong>Verizon</strong> lawyer and President Trump&#8217;s pick to lead the FCC &#8212; said &#8220;despite hyperventilating headlines, Internet service providers have never planned to sell your individual browsing history to third parties.&#8221;</p>
<div id="attachment_43997" style="width: 261px" class="wp-caption alignright"><img class=" wp-image-43997" src="media/4e540341.pai.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/pai.png" alt="" width="251" height="277" /><p class="wp-caption-text">FCC Commissioner Ajit Pai.</p></div>
<p>&#8220;That’s simply not how online advertising works,&#8221; Pai wrote. &#8220;And doing so would violate ISPs’ privacy promises. Second, Congress’s decision last week didn’t remove existing privacy protections; it simply cleared the way for us to work together to reinstate a rational and effective system for protecting consumer privacy.&#8221;</p>
<p><strong>Sen. Bill Nelson</strong> (D-Fla.) came to a different conclusion, predicting that the repeal of the FCC privacy rules would allow broadband providers to collect and sell a &#8220;gold mine of data&#8221; about customers.</p>
<aside id="" class="nativo-promo nativo-promo-1 smartphone"></aside>
<p>&#8220;Your mobile broadband provider knows how you move about your day through information about your geolocation and internet activity through your mobile device,&#8221; <a href="https://www.computerworld.com/article/3184392/security/senate-votes-to-kill-fccs-broadband-privacy-rules.html" target="_blank" rel="noopener">Nelson said</a>. The Senate resolution &#8220;will take consumers out of this driver’s seat and place the collection and use of their information behind a veil of secrecy.&#8221;</p>
<p>Meanwhile, pressure was building on the now Republican-controlled FCC to repeal the previous administration&#8217;s net neutrality rules. The major ISPs and mobile providers claimed the new regulations put them at a disadvantage relative to competitors that were not regulated by the FCC, such as <strong>Amazon</strong>, <strong>Apple</strong>, <strong>Facebook</strong> and <strong>Google</strong>.</p>
<p>On Dec. 14, 2017, FCC Chairman Pai joined two other Republic FCC commissioners in a 3-2 vote to dismantle the net neutrality regulations.</p>
<p>As <em>The New York Times</em> <a href="https://www.nytimes.com/2017/12/14/technology/net-neutrality-repeal-vote.html" target="_blank" rel="noopener">observed</a> after the net neutrality repeal, &#8220;the commission’s chairman, Ajit Pai, vigorously defended the repeal before the vote. He said the rollback of the rules would eventually benefit consumers because broadband providers like AT&amp;T and Comcast could offer them a wider variety of service options.&#8221;</p>
<p class="css-c65vdd e2kc3sl0">“We are helping consumers and promoting competition,” Mr. Pai said. “Broadband providers will have more incentive to build networks, especially to underserved areas.”</p>
<h4>MORE OR LESS CHOICE?</h4>
<p>Some might argue we&#8217;ve seen reduced competition and more industry consolidation since the FCC repealed the rules. Major broadband and mobile provider <strong>AT&amp;T</strong> and cable/entertainment giant <strong>Time Warner</strong> are now <a href="https://slate.com/technology/2018/05/at-and-t-and-time-warner-trial-the-case-for-fearing-this-merger.html" target="_blank" rel="noopener">fighting the Justice Department</a> in a bid to merge. Two of the four-largest mobile telecom and broadband providers &#8212; <strong>T-Mobile</strong> and <strong>Sprint</strong> &#8212; have announced plans for a $26 billion merger.</p>
<p>The FCC privacy rules from 2016 that were overturned by Congress sought to give consumers more choice about how their data was to be used, stored and shared. But consumers now have less &#8220;choice&#8221; than ever about how their mobile provider shares their data and with whom. Worse, the mobile and broadband providers themselves are failing to secure their own customers&#8217; data.</p>
<p>This month, it emerged that the major mobile providers have been giving commercial third-parties the ability to instantly look up the precise location of any mobile subscriber in real time. KrebsOnSecurity broke the news that one of these third parties &#8212; <strong>LocationSmart</strong> &#8212; <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">leaked this ability for years to anyone via a buggy component on its Web site</a>.</p>
<div id="attachment_43840" style="width: 598px" class="wp-caption aligncenter"><img class=" wp-image-43840" src="media/8126b691.lsmartdemo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/lsmartdemo.png" alt="" width="588" height="462" /><p class="wp-caption-text">LocationSmart&#8217;s demo page featured a buggy component which allowed anyone to look up anyone else&#8217;s mobile device location, in real time, and without consent.</p></div>
<p>We also learned that another California company &#8212; <strong>Securus Technologies</strong> &#8212; was selling real-time location lookups to a number of state and local law enforcement agencies, and that accounts for dozens of those law enforcement officers were obtained by hackers.  Securus, it turned out, was ultimately getting its data from LocationSmart.</p>
<p>This week, researchers discovered that <a href="https://www.zdnet.com/article/tmobile-bug-let-anyone-see-any-customers-account-details/" target="_blank" rel="noopener">a bug in T-Mobile&#8217;s Web site</a> let anyone access the personal account details of any customer with just their cell phone number, including full name, address, account number and some cases tax ID numbers.</p>
<p>Not to be outdone, Comcast was revealed to have exposed sensitive information on customers through <a href="https://www.zdnet.com/article/comcast-bug-leaks-xfinity-home-addresses-wireless-passwords/?eminfo=%7b%22EMAIL%22%3a%22VLzRxZi4rMVdgSngCyb3GeQhYo7NmfVjwQUDPlrOtHw%3d%22%2c%22BRAND%22%3a%22FO%22%2c%22CONTENT%22%3a%22Newsletter%22%2c%22UID%22%3a%22FO_DTA_09F95225-D548-4858-B2A9-9F65162EB451%22%2c%22SUBID%22%3a%2282537088%22%2c%22JOBID%22%3a%22750449%22%2c%22NEWSLETTER%22%3a%22DATA_SHEET%22%2c%22ZIP%22%3a%22%22%2c%22COUNTRY%22%3a%22%22%7d" target="_blank" rel="noopener">a buggy component of its Web site</a> that could be tricked into displaying the home address where the company&#8217;s wireless router is located, as well as the router&#8217;s Wi-Fi name and password.</p>
<p>It&#8217;s not clear how FCC Chairman Pai intends to &#8220;reinstate a rational and effective system for protecting consumer privacy,&#8221; as he pledged after voting last year to overturn the 2015 privacy rules. The FCC reportedly has taken at least tentative steps to open an inquiry into the LocationSmart debacle, although <strong>Sen. Ron Wyden</strong> (D-Ore.) has called on Chairman Pai to recuse himself on the inquiry because Pai once represented Securus as an attorney. (Wyden also had <a href="media/bfe0d2f4.wydenstatement.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/wydenstatement.png" target="_blank" rel="noopener">some choice words</a> for the wireless companies).</p>
<p>The major wireless carriers all say they do not share customer location data <em>without customer consent</em> or in response to a court order or subpoena. Consent. All of these carriers pointed me to their privacy policies. It could be the carriers believe these policies clearly explain that simply by using their wireless device customers have opted-in to having their real-time location data sold or given to third-party companies.</p>
<p><strong>Michelle De Mooy</strong>, director of the privacy and data project at the <a href="https://www.cdt.org" target="_blank" rel="noopener">Center for Democracy &amp; Technology</a> (CDT), said if the mobile giants are burying that disclosure in privacy policy legalese, that&#8217;s just not good enough.</p>
<p>&#8220;Even if they say, &#8216;Our privacy policy says we can do this,&#8217; it violates peoples&#8217; reasonable expectations of when and why their location data is being collected and how that&#8217;s going to be used. It&#8217;s not okay to simply point to your privacy policies and expect that to be enough.&#8221;</p>
<p><span id="more-43910"></span></p>
<h4>CHECKING THE FTC&#8217;S RECORD</h4>
<p>When the FCC&#8217;s repeal of the net neutrality rules <a href="http://money.cnn.com/2018/05/10/technology/net-neutrality-end-date/index.html" target="_blank" rel="noopener">takes effect on June 11, 2018</a>, broadband providers will once again be regulated by the <strong>Federal Trade Commission</strong> (FTC). That power was briefly shared with FCC when the agency under the Obama administration passed its net neutrality rules with the assumption that it could regulate broadband providers like telecommunications companies.</p>
<p>When it comes to investigating companies for privacy and security violations, the FTC&#8217;s primary weapon is <a href="https://www.ftc.gov/enforcement/statutes/federal-trade-commission-act" target="_blank" rel="noopener">The FTC Act</a>, which &#8220;prohibits unfair and deceptive acts or practices in or affecting commerce.&#8221; According to the FTC Act, a &#8220;misrepresentation or omission is deceptive if it is material and is likely to mislead consumers acting reasonably under the circumstances.&#8221; It also finds that an act or practice &#8220;is unfair if it causes, or is likely to cause, substantial injury that is not reasonably avoidable by consumers, and not outweighed by countervailing benefits to consumers or competition.&#8221;</p>
<p><img class="aligncenter wp-image-43998" src="media/6a6d93a0.ftc.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/ftc.png" alt="" width="596" height="337" /></p>
<p><em>It&#8217;s difficult to think of a bigger violation of those principles than the current practice by the major mobile providers of sharing real-time location data on customers with third parties, without any opportunity for customers to opt-in or opt-out of such sharing.</em></p>
<p>But it&#8217;s unclear whether the FTC would take take any action against such activity, or indeed if it has any precedent to do so. The agency had the ability to go after mobile broadband providers for privacy and security violations between 2002 and 2015, and so KrebsOnSecurity asked the commission to share how many times during that period that it took enforcement actions against broadband providers.</p>
<p>The list I got back from them wasn&#8217;t exactly privacy or security focused. The FTC cited <a href="https://www.ftc.gov/news-events/press-releases/2003/09/aol-and-compuserve-settle-ftc-charges-unfair-practices" target="_blank" rel="noopener">a case in 2003</a> in which it sued <strong>AOL</strong> and <strong>CompuServe</strong> over unfair billing practices. In 2009, <a href="http://voices.washingtonpost.com/securityfix/2009/06/ftc_sues_shuts_down_n_calif_we.html" target="_blank" rel="noopener">it helped to take down 3FN</a>, a small, shady ISP that was based in the United States but run by Russians and hosting a stupendous amount of malware, scams and illegal content (i.e. child pornography).</p>
<p>In 2014, the FTC <a href="https://www.ftc.gov/news-events/press-releases/2014/10/ftc-says-att-has-misled-millions-consumers-unlimited-data" target="_blank" rel="noopener">alleged</a> that <strong>AT&amp;T Mobility</strong> deceptively advertised “unlimited” data while throttling mobile customers who used certain amounts of data (this case is still pending but <a href="https://www.theverge.com/2018/2/27/17057236/federal-judges-att-ftc-lawsuit-speed-throttling-fcc" target="_blank" rel="noopener">a recent appeals court decision</a> cleared the way for the FTC to continue its lawsuit).</p>
<p>In 2015, <strong>TracFone</strong>, the largest prepaid mobile provider in the United States, agreed to <a href="https://www.ftc.gov/news-events/press-releases/2015/01/prepaid-mobile-provider-tracfone-pay-40-million-settle-ftc" target="_blank" rel="noopener">pay $40 million</a> to the FTC for consumer refunds to settle charges that it deceived millions of consumers with regard to its “unlimited” data service.</p>
<p>The FTC also cited <a href="media/f11ca4d3.141112verizonclosingletter.pdf" data-original-source="https://www.ftc.gov/system/files/documents/closing_letters/verizon-communications-inc./141112verizonclosingletter.pdf" target="_blank" rel="noopener">a scolding letter</a> (PDF) that it sent to Verizon over issues related to the security of its customer routers. No action was taken by the FTC in that case.</p>
<p>How eager the FTC will be to police privacy practices of broadband providers may come down to the priorities of the agency&#8217;s new leaders. <span class="pullquote pqright">The Trump administration <a href="https://www.nytimes.com/2018/05/16/us/andrew-smith-payday-lenders-consumer-protection.html" target="_blank" rel="noopener">just tapped <strong>Andrew Smith</strong> as head of the FTC&#8217;s consumer protection office</a>. Smith is a lawyer who used to represent many of the companies that the agency is already investigating.</span></p>
<p>Smith will need to recuse himself from multiple ongoing investigations his office would normally lead, including data breaches at <a href="https://thinkprogress.org/equifax-additional-consumers-74a5fb1ab75d/" data-ss1527102352="1">Equifax</a> and <a href="https://thinkprogress.org/facebooks-denials-lawsuit-threats-94804a88fc01/" data-ss1527102352="1">Facebook</a>, thanks to his previous work on behalf of the companies. According to <a href="http://thehill.com/policy/technology/388069-ftc-names-lawyer-who-represented-facebook-and-equifax-as-consumer" target="_blank" rel="noopener">The Hill</a>, Smith testified in October before the Senate Banking Committee on behalf of the credit reporting industry as the panel investigated an Equifax data breach that compromised more than 145 million people.</p>
<p><strong>Gigi Sohn</strong>, a fellow at the <a href="https://www.law.georgetown.edu/news/press-releases/Georgetown-Law-New-Institute-for-Technology-Law-and-Policy-Announces-Appointment-of-Gigi-Sohn.cfm" target="_blank" rel="noopener">Georgetown Law Institute for Technology Law and Policy</a> and a former senior adviser to former <a href="https://en.wikipedia.org/wiki/Tom_Wheeler" target="_blank" rel="noopener">FCC Chair Tom Wheeler</a> in 2015, said the FTC doesn&#8217;t have a strong record on broadband privacy enforcement.</p>
<p>Sohn said the FTC’s legal framework does not require affirmative opt-in consent for browsing history and app usage, and that a provider would only have to let you opt-out — something that consumers rarely do and which companies routinely make it hard to do. More importantly, she said, while the FCC’s rules would have protected consumers before they were harmed, the FTC can only act <em>after</em> harm has already occurred.</p>
<p>&#8220;We passed privacy rules for broadband and mobile providers that would have required them to seek customer opt-in for anything that was considered sensitive,&#8221; Sohn said of her work at the FCC under the Obama administration. &#8220;The carrier had to give you clear and consistent opportunities to opt out. It was very broad, but the definition we set for personal information was far broader than what even the FTC considered sensitive.&#8221;</p>
<h4>REPEALING THE REPEAL OF NET NEUTRALITY</h4>
<p>So the carriers are already reneging on their promise to customers that they won&#8217;t share location data without customer consent or a court order. But where does that leave us on net neutrality? The answer is that the major wireless carriers are already doing what was expressly prohibited under the FCC&#8217;s net neutrality rules: Favoring their own content over competitors, and letting companies gain more favorable access by paying more.</p>
<p><img class="aligncenter wp-image-44001" src="media/ce8a7f1e.nn.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/nn.png" alt="" width="592" height="311" /></p>
<p>Around the time of the FCC&#8217;s repeal of the net neutrality rules last year, <em>The Wall Street Journal</em> <a href="https://www.wsj.com/articles/mobile-wireless-market-might-be-our-post-net-neutrality-world-1512988200" target="_blank" rel="noopener">prognosticated</a> about what might happen with the regulations out of the way. To do this, it looked at some of the offerings the mobile carriers pitched <em>before</em> the rules were drawn up.</p>
<p>&#8220;One example of how things could work is the mobile wireless market, where some providers already have used pricing tactics to favor certain websites and services over others,&#8221; wrote <strong>John D. McKinnon</strong> and <strong>Ryan Knutson</strong> for The Journal:</p>
<blockquote><p>The 2015 Obama-era rules didn’t explicitly prohibit these tactics, which generally allow customers to access certain websites without having it count against their monthly data cap. Wireless carriers, which often subject their users to strict data limits, were aggressive in experimenting with such plans, also known as “zero rating.”</p>
<p>Deals began emerging several years ago for inexpensive plans that offer unlimited high-speed access to popular services such as Facebook or Twitter, but limited or even restricted access to the rest of the internet.</p>
<p>T-Mobile US Inc. in late 2013 announced that its GoSmart Mobile brand had “become the first wireless provider…to offer free access to Facebook and Facebook Messenger for all of its wireless customers, even those without monthly data service.” The GoSmart Mobile plans started at $25 a month for “unlimited talk” with no other data service. T-Mobile has since transferred the GoSmart brand to another wireless firm.</p>
<p>In 2014, Virgin Mobile USA, a unit of Sprint Corp. , offered a wireless plan that cost $12, but users were only allowed to access one website: either Facebook, Twitter, Instagram or Pinterest. If they wanted all four, it was $10 more a month. Another $5 and they could access any online music streaming service.</p>
<p>Big internet providers also used zero-rating plans to favor their own content. AT&amp;T Inc. gave paying customers unlimited usage of its own online video service DirecTV Now, while other video sites counted against monthly data caps. Verizon Communications Inc. did the same for its mobile video app, called go90.&#8221;</p></blockquote>
<p>AT&amp;T Mobility offers a zero-rating plan called &#8220;<a href="https://webcache.googleusercontent.com/search?q=cache:pu2YAUU9_gEJ:https://www.att.com/gen/press-room%3Fpid%3D25183%26cdvn%3Dnews%26newsarticleid%3D37366+&amp;cd=1&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">Sponsored Data</a>&#8221; that allows content providers to pay up front to have streaming of that content allowed without counting against the provider&#8217;s monthly data caps.</p>
<p>Sohn said the FCC under the Obama administration initiated an investigation into AT&amp;T&#8217;s Sponsored Data plan and Verizon for its go90 service, but that the inquiry was abandoned by the current FCC leadership.</p>
<p>There are some prospects for a Congressional repeal of this administration&#8217;s gutting of the FCC&#8217;s net neutrality rules. On May 16, the Senate approved a resolution nullifying the FCC&#8217;s rollback of the net neutrality rules. But the measure faces an uphill battle in the House.</p>
<p>&#8220;Right now we&#8217;re probably 30 to 40 members short of being able to bring a vote in the House,&#8221; Sohn said. &#8220;About 20 Democrats haven&#8217;t gotten on board, and we have no Republicans so far. But I think that&#8217;s going to change. If Congress repeals the net neutrality repeal, the next step would be to craft stronger rules [either at the FCC or Congress]. We have until the end of this Congress to get it done.&#8221;</p>
<p>The CDT&#8217;s De Mooy gives the effort to repeal the repeal of net neutrality rules slim chances of passage this year. But she said the prospects for revisiting net neutrality and consumer privacy in the next Congress look good, particularly if Democrats pick up additional seats in the House.</p>
<p>&#8220;It seems to be something the Democrats are taking up more now,&#8221; Demooy said. &#8220;So much depends on what happens in November. But that&#8217;s true of so many tech policy issues.&#8221;</p>
<h4>SHOCK AND YAWN</h4>
<p>When I first saw a <a href="https://www.hcii.cmu.edu/people/robert-xiao" target="_blank" rel="noopener">Carnegie Mellon University researcher</a> show me last week that he could look up <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">the near-exact location of any mobile number</a> in the United States, I sincerely believed the public would be amazed and horrified at the idea that mobile providers are sharing this real-time data with third party companies, and at the fact that those third parties in turn weren&#8217;t doing anything to prevent the abuse of their own systems.</p>
<p>Instead, after a brief round of coverage in several publications, the story fell out of the news cycle. A <a href="https://slate.com/technology/2018/05/the-locationsmart-scandal-is-bigger-than-cambridge-analytica-heres-why-no-one-is-talking-about-it.html" target="_blank" rel="noopener">story this week in Slate.com</a> lamented how little coverage the mainstream press has given to the LocationSmart scandal, and marvels at how much more shocked people were over the Cambridge Analytic scandal with Facebook.</p>
<p>&#8220;Privacy abuses and slip-ups by major tech companies have become so numerous, and the prospect of containing them seems so hopeless, that the public and much of the media have become nearly numb to them,&#8221; writes <strong>Will Oremus</strong> for Slate. &#8220;My data was hacked? So it goes. It may have been used in unauthorized ways by unspecified parties? <em>C’est la vie</em>.&#8221;</p>
<p class="slate-paragraph" data-editable="text" data-uri="slate.com/components/slate-paragraph/instances/cjhgf3x65001u3i5tau9ey998@published" data-word-count="37">Oremus argues that what the LocationSmart scandal lacks is not import, nor the potential for serious harm, &#8220;but a link to some divisive political issue or societal outrage sufficient enough to generate visceral anger from people who aren’t privacy wonks.&#8221;</p>
<p>If you&#8217;ve read this far (bless you), don&#8217;t let breach fatigue and incessant media exposure of how little privacy we have harden into resignation. Yes, the prospects of any public debate about consumer privacy protections in the United States at the legislative level seem dim in a high-stakes mid-term election year. But supporters of net neutrality ideals can start getting involved by tweeting, calling and emailing <a href="https://www.battleforthenet.com/scoreboard/#house" target="_blank" rel="noopener">the House lawmakers listed in red at BattleForTheNet.com</a>.</p>
<p>While you&#8217;re at it, tell your lawmakers what you think about mobile providers giving or selling third-parties real-time access to customer location information, and let them know that this is no longer okay.</p>
<p>This is the second article in a two-part series. The first is here: <a href="https://krebsonsecurity.com/2018/05/mobile-giants-please-dont-share-the-where/" target="_blank" rel="noopener">Mobile Giants, Please Don&#8217;t Share the Where.</a></p>


feed_id: https://krebsonsecurity.com/?p=44020
title: FBI: Kindly Reboot Your Router Now, Please
uri: FBI-Kindly-Reboot-Your-Router-Now-Please
url: https://krebsonsecurity.com/2018/05/fbi-kindly-reboot-your-router-now-please/
content:
<p>The <strong>Federal Bureau of Investigation </strong>(FBI) is warning that a new malware threat has rapidly infected more than a half-million consumer devices. To help arrest the spread of the malware, the FBI and security firms are urging home Internet users to reboot routers and network-attached storage devices made by a range of technology manufacturers.</p>
<p>The growing menace &#8212; dubbed <strong>VPNFilter</strong> &#8212; targets <strong>Linksys</strong>, <strong>MikroTik</strong>, <strong>NETGEAR</strong> and <strong>TP-Link</strong> networking equipment in the small and home office space, as well as <a href="https://www.qnap.com/en-us/" target="_blank" rel="noopener">QNAP</a> network-attached storage (NAS) devices, according to researchers at <strong>Cisco</strong>.</p>
<p><img class="aligncenter  wp-image-36655" src="media/a96fd646.networktechnicians.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians.png" alt="" width="595" height="394" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians.png 1212w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-580x384.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-768x508.png 768w, https://krebsonsecurity.com/wp-content/uploads/2016/10/networktechnicians-940x622.png 940w" sizes="(max-width: 595px) 100vw, 595px" /></p>
<p>Experts are still trying to learn all that VPNFilter is built to do, but for now they know it can do two things well: Steal Web site credentials; and issue a self-destruct command, effectively rendering infected devices inoperable for most consumers.</p>
<p>Cisco researchers said they&#8217;re not yet sure how these 500,000 devices were infected with VPNFilter, but that most of the targeted devices have known public exploits or default credentials that make compromising them relatively straightforward.</p>
<p>&#8220;All of this has contributed to the quiet growth of this threat since at least 2016,&#8221; the company <a href="https://blog.talosintelligence.com/2018/05/VPNFilter.html" target="_blank" rel="noopener">wrote</a> on its <strong>Talos Intelligence blog</strong>.</p>
<p>The Justice Department <a href="https://www.justice.gov/opa/pr/justice-department-announces-actions-disrupt-advanced-persistent-threat-28-botnet-infected" target="_blank" rel="noopener">said last week</a> that VPNFilter is the handiwork of &#8220;<a href="media/21d3b4d7.rpt-apt28.pdf" data-original-source="https://www2.fireeye.com/rs/fireye/images/rpt-apt28.pdf" target="_blank" rel="noopener">APT28</a>,&#8221; the security industry code name for a group of Russian state-sponsored hackers also known as &#8220;<a href="https://en.wikipedia.org/wiki/Fancy_Bear" target="_blank" rel="noopener">Fancy Bear</a>&#8221; and the &#8220;Sofacy Group.&#8221; This is the same group accused of conducting election meddling attacks during the 2016 U.S. presidential race.</p>
<p>&#8220;Foreign cyber actors have compromised hundreds of thousands of home and office routers and other networked devices worldwide,&#8221; the FBI said in <a href="https://www.ic3.gov/media/2018/180525.aspx" target="_blank" rel="noopener">a warning</a> posted to the Web site of the <a href="https://www.ic3.gov/default.aspx" target="_blank" rel="noopener">Internet Crime Complaint Center</a> (IC3). &#8220;The actors used VPNFilter malware to target small office and home office routers. The malware is able to perform multiple functions, including possible information collection, device exploitation, and blocking network traffic.&#8221;</p>
<p>According to Cisco, here&#8217;s a list of the known affected devices:<span id="more-44020"></span></p>
<p>LINKSYS DEVICES:</p>
<p>E1200<br />
E2500<br />
WRVS4400N</p>
<p>MIKROTIK ROUTEROS VERSIONS FOR CLOUD CORE ROUTERS:</p>
<p>1016<br />
1036<br />
1072</p>
<p>NETGEAR DEVICES:</p>
<p>DGN2200<br />
R6400<br />
R7000<br />
R8000<br />
WNR1000<br />
WNR2000</p>
<p>QNAP DEVICES:</p>
<p>TS251<br />
TS439 Pro</p>
<p>Other QNAP NAS devices running QTS software</p>
<p>TP-LINK DEVICES:</p>
<p>R600VPN</p>
<div id="attachment_44041" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-44041" src="media/f0bc5297.ciscovpnfilter.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/ciscovpnfilter.png" alt="" width="595" height="432" /><p class="wp-caption-text">Image: Cisco</p></div>
<p>Unfortunately, there is no easy way to tell if your device is infected. If you own one of these devices and it is connected to the Internet, you should reboot (or unplug, wait a few seconds, replug) the device now. This should wipe part of the infection, if there is one. But you&#8217;re not out of the woods yet.</p>
<p>Cisco said part of the code used by VPNFilter can still persist until the affected device is reset to its factory-default settings. Most modems and DVRs will have a tiny, recessed button that can only be pressed with something small and pointy, such as a paper clip. Hold this button down for at least 10 seconds (some devices require longer) with the device powered on, and that should be enough to reset the device back to its factory-default settings. In some cases, you may need to hold the tiny button down and keep it down while you plug in the power cord, and then hold it for 30 seconds.</p>
<p>After resetting the device, you&#8217;ll need to log in to its administrative page using a Web browser. The administrative page of most commercial routers can be accessed by typing 192.168.1.1, or 192.168.0.1 into a Web browser address bar. If neither of those work, try looking up the documentation at the router maker’s site, or checking to see if the address is listed <a href="http://www.techspot.com/guides/287-default-router-ip-addresses/" target="_blank" rel="noopener">here</a>. If you still can’t find it, open the command prompt (Start &gt; Run/or Search for “cmd”) and then enter ipconfig. The address you need should be next to Default Gateway under your Local Area Connection.</p>
<p>Once you&#8217;re there, make sure you&#8217;ve changed the factory-default password that allows you to log in to the device (pick something strong that you can remember).</p>
<p>You&#8217;ll also want to make sure your device has the latest firmware updates. Most router Web interfaces have a link or button you click to check for newer device firmware. If there are any updates available, install those before doing anything else.</p>
<p>If you&#8217;ve reset the router&#8217;s settings, you&#8217;ll also want to encrypt your connection if you’re using a wireless router (one that broadcasts your modem’s Internet connection so that it can be accessed via wireless devices, like tablets and smart phones). WPA2 is the strongest encryption technology available in most modern routers, followed by WPA and WEP (the latter is fairly trivial to crack with open source tools, so don’t use it unless it’s your only option).</p>
<p>But even users who have a strong router password and have protected their wireless Internet connection with a strong WPA2 passphrase may have the security of their routers undermined by security flaws built into these routers. At issue is a technology called “Wi-Fi Protected Setup” (WPS) that ships with many routers marketed to consumers and small businesses. According to the Wi-Fi Alliance, an industry group, WPS is “designed to ease the task of setting up and configuring security on wireless local area networks. WPS enables typical users who possess little understanding of traditional Wi-Fi configuration and security settings to automatically configure new wireless networks, add new devices and enable security.”</p>
<p>However, WPS also may expose routers to easy compromise. Read more about this vulnerability <a href="http://krebsonsecurity.com/2011/12/new-tools-bypass-wireless-router-security/" target="_blank" rel="noopener">here</a>. If your router is among those listed as using WPS, see if you can disable WPS from the router’s administration page. If you’re not sure whether it can be, or if you’d like to see whether your router maker has shipped an update to fix the WPS problem on their hardware, check <a href="https://docs.google.com/spreadsheet/lv?key=0Ags-JmeLMFP2dFp2dkhJZGIxTTFkdFpEUDNSSHZEN3c" target="_blank" rel="noopener">this spreadsheet</a>.</p>
<p>Turning off any remote administration features that may be turned on by default is always a good idea, as is disabling <a href="https://en.wikipedia.org/wiki/Universal_Plug_and_Play" target="_blank" rel="noopener">Universal Plug and Play (UPnP)</a>, which can easily poke holes in your firewall without you knowing it). However, Cisco researchers say there is no indication that VPNFilter uses UPnP.</p>
<p>For more tips on how to live with your various Internet of Things (IoT) devices without becoming a nuisance to yourself or the Internet at large, please see <a href="https://krebsonsecurity.com/2018/01/some-basic-rules-for-securing-your-iot-stuff/" target="_blank" rel="noopener">Some Basic Rules for Securing Your IoT Stuff</a>.</p>


feed_id: https://krebsonsecurity.com/?p=43784
title: Will the Real Joker’s Stash Come Forward?
uri: Will-the-Real-Joker-s-Stash-Come-Forward
url: https://krebsonsecurity.com/2018/05/will-the-real-jokers-stash-come-forward/
content:
<p>For as long as scam artists have been around so too have opportunistic thieves who specialize in ripping off other scam artists. This is the story about a group of Pakistani Web site designers who apparently have made an impressive living impersonating some of the most popular and well known &#8220;carding&#8221; markets, or online stores that sell stolen credit cards.</p>
<div id="attachment_34283" style="width: 260px" class="wp-caption alignright"><img class=" wp-image-34283" src="media/b23517bf.jstashcard.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2016/03/jstashcard.png" alt="" width="250" height="352" srcset="https://krebsonsecurity.com/wp-content/uploads/2016/03/jstashcard.png 862w, https://krebsonsecurity.com/wp-content/uploads/2016/03/jstashcard-580x815.png 580w, https://krebsonsecurity.com/wp-content/uploads/2016/03/jstashcard-768x1080.png 768w" sizes="(max-width: 250px) 100vw, 250px" /><p class="wp-caption-text">An ad for new stolen cards on Joker&#8217;s Stash.</p></div>
<p>One wildly popular carding site that has been <a href="https://krebsonsecurity.com/2016/03/carders-park-piles-of-cash-at-jokers-stash/" target="_blank" rel="noopener">featured in-depth</a> at KrebsOnSecurity &#8212; <strong>Joker&#8217;s Stash</strong> &#8212; brags that the millions of credit and debit card accounts for sale via their service were stolen from merchants firsthand.</p>
<p>That is, the people running Joker&#8217;s Stash say they are hacking merchants and directly selling card data stolen from those merchants. Joker&#8217;s Stash has been tied to several recent retail breaches, including those at <a href="https://www.nbcnews.com/news/us-news/data-breach-saks-lord-taylor-compromises-customer-payment-data-n861856" target="_blank" rel="noopener">Saks Fifth Avenue, Lord and Taylor</a>, <a href="http://krebsonsecurity.com/2014/12/bebe-stores-confirms-credit-card-breach/" target="_blank" rel="noopener">Bebe Stores</a>, <a href="http://krebsonsecurity.com/?s=hilton+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">Hilton Hotels</a>, <a href="https://krebsonsecurity.com/2017/12/4-years-after-target-the-little-guy-is-the-target/" target="_blank" rel="noopener">Jason&#8217;s Deli</a>, <a href="https://www.cnbc.com/2017/09/28/whole-foods-suffers-data-breach-in-some-stores.html" target="_blank" rel="noopener">Whole Foods</a>, <a href="https://www.reuters.com/article/us-chipotle-cyber/chipotle-says-hackers-hit-most-restaurants-in-data-breach-idUSKBN18M2BY" target="_blank" rel="noopener">Chipotle</a> and <a href="https://krebsonsecurity.com/2017/09/breach-at-sonic-drive-in-may-have-impacted-millions-of-credit-debit-cards/" target="_blank" rel="noopener">Sonic</a>. Indeed, with most of these breaches, the first signs that any of the companies were hacked was when their customers&#8217; credit cards started showing up for sale on Joker&#8217;s Stash.</p>
<p>Joker&#8217;s Stash maintains a presence on several cybercrime forums, and its owners use those forum accounts to remind prospective customers that its Web site &#8212; <strong>jokerstash[dot]bazar </strong>&#8212; is the only way in to the marketplace.</p>
<p><em>The administrators constantly warn buyers to be aware there are many look-alike shops set up to steal logins to the real Joker&#8217;s Stash or to make off with any funds deposited with the impostor carding shop as a prerequisite to shopping there.</em></p>
<p>But that didn&#8217;t stop a prominent security researcher (not this author) from recently plunking down $100 in bitcoin at a site he thought was run by Joker&#8217;s Stash (<strong>jokersstash[dot]su</strong>). Instead, the proprietors of the impostor site said the minimum deposit for viewing stolen card data on the marketplace had increased to $200 in bitcoin.</p>
<p>The researcher, who asked not to be named, said he obliged with an additional $100 bitcoin deposit, only to find that his username and password to the card shop no longer worked. He&#8217;d been conned by scammers scamming scammers.</p>
<p>As it happens, prior to hearing from this researcher I&#8217;d received a mountain of research from <strong>Jett Chapman</strong>, another security researcher who swore he&#8217;d unmasked the real-world identity of the people behind the Joker&#8217;s Stash carding empire.</p>
<p>Chapman&#8217;s research, detailed in a 57-page report shared with KrebsOnSecurity, pivoted off of public information leading from the same jokersstash[dot]su that ripped off my researcher friend.</p>
<p>&#8220;I&#8217;ve gone to a few cybercrime forums where people who have used jokersstash[dot]su that were confused about who they really were,&#8221; Chapman said. &#8220;Many of them left feedback saying they&#8217;re scammers who will just ask for money to deposit on the site, and then you&#8217;ll never hear from them again.&#8221;</p>
<p>But the conclusion of Chapman&#8217;s report &#8212; that somehow jokersstash[dot]su was related to the real criminals running Joker&#8217;s Stash &#8212; didn&#8217;t ring completely accurate, although it was expertly documented and thoroughly researched. So with Chapman&#8217;s blessing, I shared his report with both the researcher who&#8217;d been scammed and a law enforcement source who&#8217;d been tracking Joker&#8217;s Stash.</p>
<p>Both confirmed my suspicions: Chapman had unearthed a vast network of sites registered and set up over several years to impersonate some of the biggest and longest-running criminal credit card theft syndicates on the Internet.<span id="more-43784"></span></p>
<h4>THE REAL JOKER&#8217;S STASH</h4>
<p>The real Joker&#8217;s Stash can only be reached after installing a browser extension known as &#8220;<a href="https://addons.mozilla.org/en-US/firefox/addon/b-dns/" target="_blank" rel="noopener">blockchain DNS</a>.&#8221; This component is needed to access any sites ending in the top-level domain names of .bazar,.bit (Namecoin), .coin, .lib and .emc (Emercoin).</p>
<p>Most Web sites use the global Domain Name System (DNS), which serves as a kind of phone book for the Internet by translating human-friendly Web site names (example.com) into numeric Internet address that are easier for computers to manage.</p>
<p>Regular DNS maps Internet addresses to domains by relying on a series of distributed, hierarchical lookups. If one server does not know how to find a domain, that server simply asks another server for the information.</p>
<p>Blockchain-based DNS systems also disseminate that mapping information in a distributed fashion, although via a peer-to-peer method. The entities that operate blockchain-based top level domains (e.g., .bazar) don&#8217;t answer to any one central authority &#8212; such as the <a href="https://en.wikipedia.org/wiki/ICANN" target="_blank" rel="noopener">Internet Corporation for Assigned Names and Numbers</a> (ICANN), which oversees the global DNS and domain name space. This potentially makes these domains much more difficult for law enforcement agencies to take down.</p>
<div id="attachment_40912" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/67f0a7ab.firetigerrr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr.png"><img class="wp-image-40912" src="media/67f0a7ab.firetigerrr.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr.png" alt="" width="597" height="598" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr.png 902w, https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-150x150.png 150w, https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-580x581.png 580w, https://krebsonsecurity.com/wp-content/uploads/2017/09/firetigerrr-768x770.png 768w" sizes="(max-width: 597px) 100vw, 597px" /></a><p class="wp-caption-text">This batch of some five million cards put up for sale Sept. 26, 2017 on the (real) carding site Joker&#8217;s Stash has been tied to a breach at Sonic Drive-In</p></div>
<p><em>Dark Reading</em> <a href="https://www.darkreading.com/vulnerabilities---threats/threat-actors-turn-to-blockchain-infrastructure-to-host-and-hide-malicious-activity/d/d-id/1331622" target="_blank" rel="noopener">explains further</a>: &#8220;When an individual registers a .bit — or another blockchain-based domain — they are able to do so in just a few steps online, and the process costs mere pennies. Domain registration is not associated with an individual&#8217;s name or address but with a unique encrypted hash of each user. This essentially creates the same anonymous system as Bitcoin for Internet infrastructure, in which users are only known through their cryptographic identity.&#8221;</p>
<p>And cybercriminals have taken notice. According to security firm <strong>FireEye</strong>, over the last year there&#8217;s been a surge in the number of threat actors that have started incorporating support for blockchain domains in their malware tools.</p>
<h4>THE FAKE JOKER&#8217;S STASH</h4>
<p class="Addon-summary">In contrast, the fake version of Joker&#8217;s Stash &#8212; <strong>jokersstash[dot]su</strong> &#8212; exists on the clear Web and displays a list of &#8220;trusted&#8221; Joker&#8217;s Stash domains that can be used to get on the impostor marketplace.  These lists are common on the login pages of carding and other cybercrime sites that tend to lose their domains frequently when Internet do-gooders report them to authorities. The daily reminder helps credit card thieves easily find the new domain should the primary domain get seized by law enforcement or the site&#8217;s domain registrar.</p>
<p><div id="attachment_44032" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/d24b3ef3.jokerstash-su.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/jokerstash-su.png"><img class="wp-image-44032" src="media/d24b3ef3.jokerstash-su.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/jokerstash-su.png" alt="" width="596" height="458" /></a><p class="wp-caption-text">Jokersstash[dot]su lists mirror sites in case the generic domain becomes inaccessible.</p></div>Most of the domains in the image above are hosted on the same Internet address: 190.14.38.6 (<strong>Offshore Racks S.A.</strong> in Panama). But Chapman found that many of these domains map back to just a handful of email addresses, including <strong>domain@paysafehost.com</strong>, <strong>fkaboot@gmail.com</strong>, and <strong>zanebilly30@gmail.com</strong>.</p>
<p>Chapman found that adding credit cards to his shopping cart in the fake Joker&#8217;s Stash site caused those same cards to show up in his cart when he accessed his account at one of the alternative domains listed in the screenshot above, suggesting that the sites were all connected to the same back-end database.</p>
<p>The email address fkaboot@gmail.com is tied to the name or alias &#8220;<strong>John Kelly</strong>,&#8221; as well as 35 domains, according to <strong>DomainTools</strong> (the full list is <a href="https://krebsonsecurity.com/wp-content/uploads/2018/05/fkaboot-rw.txt" target="_blank" rel="noopener">here</a>). Most of the sites at those domains borrow names and logos from established credit card fraud sites, including <strong>VaultMarket</strong>, <strong>T12Shop</strong>, <strong>BriansClub</strong> (which <a href="media/876b163f.briansdumps.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/briansdumps.png" target="_blank" rel="noopener">uses the head of yours truly on a moving crab</a> to advertise its stolen cards); and the <a href="https://krebsonsecurity.com/2018/02/u-s-arrests-13-charges-36-in-infraud-cybercrime-forum-bust/" target="_blank" rel="noopener">now defunct cybercrime forum Infraud</a>.</p>
<p>Domaintools says the address domain@paysafehost.com <a href="https://krebsonsecurity.com/wp-content/uploads/2018/05/domainatpaysafehost-rwhois.txt" target="_blank" rel="noopener">also maps to 35 domains</a>, including look-alike domains for major carding sites <a href="https://krebsonsecurity.com/?s=bulba&amp;x=0&amp;y=0" target="_blank" rel="noopener">Bulba</a>, <strong>GoldenDumps</strong>, <strong>ValidShop</strong>, <a href="https://krebsonsecurity.com/2016/05/carding-sites-turn-to-the-dark-cloud/" target="_blank" rel="noopener">McDucks, Mr. Bin, Popeye</a>, and the cybercrime forum <strong>Omerta</strong>.</p>
<p>The address zanebilly30@gmail.com <a href="https://krebsonsecurity.com/wp-content/uploads/2018/05/zanebilly-rw.txt" target="_blank" rel="noopener">is connected to 36 domains</a> that feature many of the same impersonated criminal brands as the first two lists.</p>
<p>The domain &#8220;paysafehost.com&#8221; is not responding at the moment, but until very recently it redirected to a site that tried to scam or phish customers seeking to buy stolen credit card data from <strong>VaultMarket</strong>. It looks more or less the same as the real VaultMarket&#8217;s login page, but Chapman noticed that in the bottom right corner of the screen was a Zendesk chat service soliciting customer questions.</p>
<p>Signing up for an account at paysafehost.com (the fake VaultMarket site) revealed a site that looked like VaultMarket but otherwise massively displayed ads for another carding service &#8212; <strong>isellz[dot]cc</strong> (one of the domains registered to domain@paysafehost.com).</p>
<p><a class="lightbox" href="media/c41f7dbd.paysafe-isellz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/paysafe-isellz.png"><img class="aligncenter wp-image-44048" src="media/c41f7dbd.paysafe-isellz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/paysafe-isellz.png" alt="" width="599" height="301" /></a></p>
<p>This same Zendesk chat service also was embedded in the homepage of jokersstash[dot]su.</p>
<p><a class="lightbox" href="media/e2451fdb.jstash-chat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/jstash-chat.png"><img class="aligncenter wp-image-44049" src="media/e2451fdb.jstash-chat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/jstash-chat.png" alt="" width="590" height="292" /></a></p>
<p>And on isellz[dot]cc:</p>
<div id="attachment_44052" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/240ce38f.isellz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/isellz.png"><img class="wp-image-44052" src="media/240ce38f.isellz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/isellz.png" alt="" width="599" height="340" /></a><p class="wp-caption-text">Notice the same Zendesk chat client in the bottom right corner of the Isellz home page.</p></div>
<p>According to <a href="https://www.farsightsecurity.com" target="_blank" rel="noopener">Farsight Security</a>, a company that maps historical connections between Internet addresses and domain names, several other interesting domains used paysafehost[dot]com as their DNS servers, including <strong>cvv[dot]kz</strong> (CVV stands for the card verification value and it refers to stolen credit card numbers, names and cardholder address that can be used to conduct e-commerce fraud).</p>
<p>All three domains &#8212; cvv[dot]kz, and isellz[dot]cc and paysafehost[dot]com list in their Web site registration records the email address <strong>xperiasolution@gmail.com</strong>, the site <strong>xperiasol.com</strong>, and the name &#8220;<strong>Bashir Ahmad</strong>.&#8221;</p>
<h4>XPERIA SOLUTIONS</h4>
<p>Searching online for the address xperiasolution@gmail.com turns up <a href="https://www.qatarliving.com/jobs/junaid-ahmad/required-male-female" target="_blank" rel="noopener">a help wanted ad</a> on the <strong>Qatar Living Jobs</strong> site from October 2017 for a freelance system administrator. The ad was placed by the user &#8220;<strong>junaidky</strong>&#8220;, and gives the xperiasolution@gmail.com email address for interested applicants to contact.</p>
<p>Chapman says at this point in his research he noticed that xperiasolution@gmail.com was also used to register the domain <strong>xperiasol.info</strong>, which for several years was hosted on the same server as a handful of other sites, such as <strong>xperiasol.com</strong> &#8212; the official Web site Xperia Solution (this site also features a Zen desk chat client in the lower right portion of the homepage).</p>
<p>Xperiasol.com&#8217;s Web site says the company is a Web site development firm and domain registrar in Islamabad, Pakistan. The site&#8217;s &#8220;Meet our Team&#8221; page states the founder and CEO of the company is a guy named <strong>Muhammad Junaid</strong>. Another man pictured as <strong>Yasir Ali</strong> is the company&#8217;s project manager.</p>
<div id="attachment_44072" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/f881f561.xperiasol.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/xperiasol.png"><img class="wp-image-44072" src="media/f881f561.xperiasol.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/xperiasol.png" alt="" width="594" height="437" /></a><p class="wp-caption-text">The top dogs at Xperia Sol.</p></div>
<p>We&#8217;ll come back to both of these two individuals in a moment. Xperiasol.info also is no longer responding, but not long ago the home page showed several open file directories:</p>
<p><img class="aligncenter size-full wp-image-44050" src="media/886b82ff.xperiasol-info.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/xperiasol-info.png" alt="" width="333" height="445" /></p>
<p>Clicking in the projects directory and drilling down into a project dated Feb. 8, 2018 turns up some kind of chatroom application in development. Recall that dozens of the fake carding domains mentioned above were registered to a &#8220;John Kelly&#8221; at fkaboot@gmail.com. Have a look at the name next to the chatroom application Web site that was archived at xperiasol.info:</p>
<p><img class="aligncenter wp-image-44051" src="media/7ed26426.xperia-sol-chat.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/xperia-sol-chat.png" alt="" width="598" height="794" /></p>
<p>Could Yasir Ali, the project manager of Xperiasol, be the same person who registered so many fake carding domains? What else do we know about Mr. Ali? It appears he runs another business called <strong>Agile: Institute of Information Technology</strong>. Agile&#8217;s domain &#8212; <strong>aiit.com.pk</strong> &#8212; was registered to Xperia Sol Technologies in 2016 and hosted on the same server.</p>
<p>Who else that we know besides Mr. Ali is listed on Agile&#8217;s &#8220;Meet the Team&#8221; page? Why Mr. Muhammad Junaid, of course, the CEO and founder of Xperia Sol.</p>
<div id="attachment_44054" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-44054" src="media/098fbff2.aiit.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/aiit.png" alt="" width="591" height="732" /><p class="wp-caption-text">Notice the placeholder &#8220;lorem ipsum&#8221; content. This can be seen throughout the Web sites for Xperia Sol&#8217;s &#8220;customers.&#8221;</p></div>
<p>Chapman shared pages of documentation showing that most of the &#8220;customers testimonials&#8221; supposedly from Xperia Sol&#8217;s Web design clients appear to be half-finished sites with plenty of broken links and &#8220;lorem ipsum&#8221; placeholder content (as is the case with the aiit.com.pk Web site pictured above).</p>
<p>Another &#8220;valuable client&#8221; listed on Xperia Sol&#8217;s home page is <strong>Softlottery[dot]com</strong> (previously softlogin[dot]com). This site appears to be a business that sells Web site design templates, but it lists its address as <em>Sailor suite room V124, DB 91, Someplace 71745 Earth</em>.</p>
<div id="attachment_44055" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/a54855d0.softlotteryold.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/softlotteryold.png"><img class="wp-image-44055" src="media/a54855d0.softlotteryold.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/softlotteryold.png" alt="" width="597" height="378" /></a><p class="wp-caption-text">Softlottery/Softlogin features a “corporate business” Web site template that includes a slogan from a major carding forum.</p></div>
<p>Among the &#8220;awesome&#8221; corporate design templates that Softlottery has for sale is one loosely based on a motto that has shown up on several carding sites: &#8220;We are those, who we are: Verified forum, verified people, serious deals.&#8221; Probably the most well-known cybercrime forum using that motto is Omerta (recall from above that the Omerta forum is another brand impersonated by this group).</p>
<p><strong>Flower Land</strong>, with the Web address <strong>flowerlandllc.com</strong> is also listed as a happy Xperia Sol customer and is hosted by Xperia Sol. But most of the links on that site are dead. More importantly, the site&#8217;s content appears to have been lifted from the Web site of an actual flower care business in Michigan called myflowerland.com.</p>
<p><strong>Zalmi-TV</strong> (<strong>zalmi.tv</strong>) is supposedly a news media partner of Xperia Sol, but again the Xperia-hosted site is half-finished and full of &#8220;lorem ipsum&#8221; placeholder content.</p>
<h4>THE MASTER MIND?</h4>
<p>But what about Xperia Sol&#8217;s founder, Muhammad Junaid, you ask? Mr. Junaid is known by several aliases, including his stage name, &#8220;<strong>Masoom Parinda</strong>,&#8221; a.k.a. &#8220;<strong>Master Mind</strong>). As Chapman unearthed in his research, Junaid has starred in some B-movie action films in Pakistan, and <a href="https://www.facebook.com/zalmitv" target="_blank" rel="noopener">Masoom Parinda</a> is his character&#8217;s name.</p>
<div id="attachment_44056" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-44056" src="media/79074dc7.Masoom-MastermindFB.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/Masoom-MastermindFB.png" alt="" width="597" height="639" /><p class="wp-caption-text">The fan page for Masoon Parinda, the character played by Muhammad Junaid Ahmed.</p></div>
<p>Mr. Junaid also goes by the names <a href="https://www.facebook.com/masoomparinda.pk/" target="_blank" rel="noopener">Junaid Ahmad Khan</a>, and <strong>Muhammad Junaid Ahmed</strong>. The latter is the one included in <a href="media/b9f24486.pak-dub.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/pak-dub.png" target="_blank" rel="noopener">a flight itinerary</a> that Junaid posted to his Facebook page in 2014.</p>
<p>There are also some interesting photos of his various cars &#8212; all of which have the Masoom Parinda nickname &#8220;Master Mind&#8221; written on the back window. There is also something else on each car&#8217;s rear window: A picture of a black and red scorpion.</p>
<p><a class="lightbox" href="media/fe69fc42.mmcartx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/mmcartx.png"><img class="aligncenter wp-image-44058 size-full" src="media/fe69fc42.mmcartx.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/mmcartx.png" alt="" width="358" height="306" /></a></p>
<p><a class="lightbox" href="media/edead5a4.mm-car-suv.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/mm-car-suv.png"><img class="aligncenter wp-image-44057 size-full" src="media/edead5a4.mm-car-suv.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/mm-car-suv.png" alt="" width="331" height="330" /></a></p>
<p><a class="lightbox" href="media/fb955f4b.mm-honda.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/mm-honda.png"><img class="aligncenter wp-image-44061 size-full" src="media/fb955f4b.mm-honda.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/mm-honda.png" alt="" width="578" height="374" /></a></p>
<p>Recall the logo that was used at the top of isellz[dot]cc, the main credit card fraud site tied to xperiasolutions@gmail.com. It features a giant black and red scorpion:</p>
<div id="attachment_44062" style="width: 564px" class="wp-caption aligncenter"><img class="size-full wp-image-44062" src="media/1639f5a7.isellsupclose.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/isellsupclose.png" alt="" width="554" height="510" /><p class="wp-caption-text">The isellz Web site features a scorpion as a logo.</p></div>
<p>I reached out to Mr. Junaid/Khan via <a href="https://www.facebook.com/zamerta" target="_blank" rel="noopener">his Facebook page</a>. Soon after that, his Facebook profile disappeared. But not before KrebsOnSecurity managed to get a copy of the page going back several years. Mr. Junaid/Khan is apparently friends with a local man named <strong>Bashar Ahmad</strong>. Recall that a &#8220;Bashar Ahmad&#8221; was the name tied to the domain registrations &#8212; cvv[dot]kz, and isellz[dot]cc and paysafehost[dot]com &#8212; and to the email address <strong>xperiasolution@gmail.com</strong>.</p>
<p>Mr. Ahmed also has a Facebook page going back more than seven years. In one of those posts, he publishes a picture of a scorpion very similar to the one on isellz[dot]cc and on Mr. Khan&#8217;s automobiles.</p>
<div id="attachment_44073" style="width: 599px" class="wp-caption aligncenter"><img class=" wp-image-44073" src="media/55dfb43c.bashirahmad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/bashirahmad.png" alt="" width="589" height="354" /><p class="wp-caption-text">A screen shot from Bashir Ahmad&#8217;s Facebook postings.</p></div>
<p>At the conclusion of his research, Chapman said he discovered one final and jarring connection between Xperia Sol and the carding site isellz[dot]cc: When isellz customers have trouble using the site, they can submit a support ticket. Where does that support ticket go? Would you believe to xperiasol@gmail.com? Click the image below to enlarge.</p>
<div id="attachment_44069" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/8a8f408a.isellz-xperiasol.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/isellz-xperiasol.png"><img class="wp-image-44069" src="media/8a8f408a.isellz-xperiasol.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/isellz-xperiasol.png" alt="" width="597" height="322" /></a><p class="wp-caption-text">The support page of the carding site isellz[dot]cc points to Xperia Sol. Click to enlarge.</p></div>
<p>It could be that all of this evidence pointing back to Xperia Sol is just a coincidence, or an elaborate character assassination scheme cooked up by one of the company&#8217;s competitors. Or perhaps Mr. Junaind/Khan is simply researching a new role as a hacker in an upcoming Pakistani cinematic thriller:</p>
<div id="attachment_44075" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-44075" src="media/017a2f19.crime-junaid.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/crime-junaid.png" alt="" width="591" height="567" /><p class="wp-caption-text">Mr. Junaid/Khan, in an online promotion for a movie he stars in about crime.</p></div>
<p>In many ways, creating a network of fake carding sites is the perfect cybercrime. After all, nobody is going to call the cops on people who make a living ripping off cybercriminals. Nor will anyone help the poor sucker who gets snookered by one of these fake carding sites. Caveat Emptor!</p>


feed_id: https://krebsonsecurity.com/?p=43710
title: Are Your Google Groups Leaking Data?
uri: Are-Your-Google-Groups-Leaking-Data
url: https://krebsonsecurity.com/2018/06/is-your-google-groups-leaking-data/
content:
<p><strong>Google</strong> is reminding organizations to review how much of their <strong>Google Groups</strong> mailing lists should be public and indexed by Google.com. The notice was prompted in part by a review that KrebsOnSecurity undertook with several researchers who&#8217;ve been busy cataloging thousands of companies that are using public Google Groups lists to manage customer support and in some cases sensitive internal communications.</p>
<p><img class="aligncenter wp-image-44115" src="media/785f1ffc.googgroups.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/googgroups.png" alt="" width="591" height="227" /></p>
<p>Google Groups is a service from Google that provides discussion groups for people sharing common interests. Because of the organic way Google Groups tend to grow as more people are added to projects &#8212; and perhaps given the ability to create public accounts on otherwise private groups &#8212; a number of organizations with household names are leaking sensitive data in their message lists.</p>
<p>Many Google Groups leak emails that should probably not be public but are nevertheless searchable on Google, including personal information such as passwords and financial data, and in many cases comprehensive lists of company employee names, addresses and emails.</p>
<p>By default, Google Groups are set to private. But Google acknowledges that there have been &#8220;a small number of instances where customers have accidentally shared sensitive information as a result of misconfigured Google Groups privacy settings.&#8221;</p>
<p>In early May, KrebsOnSecurity heard from two researchers at <a href="https://www.kennasecurity.com" target="_blank" rel="noopener">Kenna Security</a> who started combing through Google Groups for sensitive data. They found thousands of organizations that seem to be inadvertently leaking internal or customer information.</p>
<p>The researchers say <a href="https://www.kennasecurity.com/widespread-google-groups-misconfiguration-exposes-sensitive-information/" target="_blank" rel="noopener">they discovered more than 9,600 organizations</a> with public Google Groups settings, and estimate that about one-third of those organizations are currently leaking some form of sensitive email. Those affected include Fortune 500 companies, hospitals, universities and colleges, newspapers and television stations and U.S. government agencies.</p>
<p>In most cases, to find sensitive messages it&#8217;s enough to load the company&#8217;s public Google Groups page and start typing in key search terms, such as &#8220;password,&#8221; &#8220;account,&#8221; &#8220;hr,&#8221; &#8220;accounting,&#8221; &#8220;username&#8221; and &#8220;http:&#8221;.</p>
<p>Many organizations seem to have used Google Groups to index customer support emails, which can contain all kinds of personal information &#8212; particularly in cases where one employee is emailing another.</p>
<p>Here are just a few of their more eyebrow-raising finds:</p>
<p>• Re: Document(s) for Review for Customer [REDACTED]. Group: Accounts Payable<br />
• Re: URGENT: Past Due Invoice. Group: Accounts Payable<br />
• Fw: Password Recovery. Group: Support<br />
• GitHub credentials. Group: [REDACTED]<br />
• Sandbox: Finish resetting your Salesforce password. Group: [REDACTED]<br />
• RE: [REDACTED] Suspension Documents. Group: Risk and Fraud Management</p>
<p>Apart from exposing personal and financial data, misconfigured Google Groups accounts sometimes publicly index a tremendous amount of information about the organization itself, including links to employee manuals, staffing schedules, reports about outages and application bugs, as well as other internal resources.</p>
<p>This information could be a potential gold mine for hackers seeking to conduct so-called &#8220;spearphishing&#8221; attacks that single out specific employees at a targeted organization. Such information also would be useful for criminals who specialize in &#8220;business email compromise&#8221; (BEC) or &#8220;CEO fraud&#8221; schemes, in which thieves spoof emails from top executives to folks in finance asking for large sums of money to be wired to a third-party account in another country.</p>
<p>&#8220;The possible implications include spearphishing, account takeover, and a wide variety of case-specific fraud and abuse,&#8221; the Kenna Security team wrote.</p>
<p><span id="more-43710"></span></p>
<p>In <a href="https://gsuiteupdates.googleblog.com/2018/06/configure-your-google-groups-settings.html" target="_blank" rel="noopener">its own blog post on the topic</a>, Google said organizations using Google Groups should carefully consider whether to change the access to groups from &#8220;private&#8221; to &#8220;public&#8221; on the Internet. The company stresses that public groups have the marker &#8220;shared publicly&#8221; right at the top, next to the group name.</p>
<p>&#8220;If you give your users the ability to create public groups, you can always change the domain-level setting back to private,&#8221; Google said. &#8220;This will prevent anyone outside of your company from accessing any of your groups, including any groups previously set to public by your users.&#8221;</p>
<p>If your organization is using Google Groups mailing lists, please take a moment to read <a href="https://gsuiteupdates.googleblog.com/2018/06/configure-your-google-groups-settings.html" target="_blank" rel="noopener">Google&#8217;s blog post about how to check for oversharing</a>.</p>
<p>Also, unless you require some groups to be available to external users, it might be a good idea to turn your domain-level Google Group settings to default “private,&#8221; Kenna Security advises.</p>
<p>&#8220;This will prevent new groups from being shared to anonymous users,&#8221; the researchers wrote. &#8220;Secondly, check the settings of individual groups to ensure that they’re configured as expected. To determine if external parties have accessed information, Google Groups provides a feature that counts the number of &#8216;views&#8217; for a specific thread. In almost all sampled cases, this count is currently at zero for affected organizations, indicating that neither malicious nor regular users are utilizing the interface.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=44151
title: Researcher Finds Credentials for 92 Million Users of DNA Testing Firm MyHeritage
uri: Researcher-Finds-Credentials-for-92-Million-Users-of-DNA-Testing-Firm
url:
https://krebsonsecurity.com/2018/06/researcher-finds-credentials-for-92-million-users-of-dna-testing-firm-myheritage/

content:
<p><strong>MyHeritage</strong>, an Israeli-based genealogy and DNA testing company, disclosed today that a security researcher found on the Internet a file containing the email addresses and hashed passwords of more than 92 million of its users.</p>
<p><img class="aligncenter wp-image-44166" src="media/a5a48ed9.myheritage.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/myheritage.png" alt="" width="591" height="110" /></p>
<p>MyHeritage says it has no reason to believe other user data was compromised, and it is urging all users to <a href="http://helpcenter.myheritage.com/Account-Settings/Change-password-Email/634030922501487720/How-do-I-change-my-email-address-and-or-password.htm" target="_blank" rel="noopener">change their passwords</a>. It says sensitive customer DNA data is stored on IT systems that are separate from its user database, and that user passwords were &#8220;hashed&#8221; &#8212; or churned through a mathematical model designed to turn them into unique pieces of gibberish text that is (in theory, at least) difficult to reverse.</p>
<p>MyHeritage did not say <a href="https://blog.myheritage.com/2018/06/myheritage-statement-about-a-cybersecurity-incident/" target="_blank" rel="noopener">in its blog post</a> which method it used to obfuscate user passwords, but suggested that it had added some uniqueness to each password (beyond the hashing) to make them all much harder to crack.</p>
<p>&#8220;MyHeritage does not store user passwords, but rather a one-way hash of each password, in which the hash key differs for each customer,&#8221; wrote <strong>Omer Deutsch</strong>, MyHeritage&#8217;s chief information security officer. &#8220;This means that anyone gaining access to the hashed passwords does not have the actual passwords.&#8221;</p>
<p>The company said the security researcher who found the user database reported it on Monday, June 4. The file contained the email addresses and hashed passwords of 92,283,889 users who created accounts at MyHeritage up to and including Oct. 26, 2017, which MyHeritage says was &#8220;the date of the breach.&#8221;</p>
<p>MyHeritage added that it is expediting work on an upcoming two-factor authentication option that the company plans to make available to all MyHeritage users soon.</p>
<p>&#8220;This will allow users interested in taking advantage of it, to authenticate themselves using a mobile device in addition to a password, which will further harden their MyHeritage accounts against illegitimate access,&#8221; the blog post concludes.</p>
<p>MyHeritage has not yet responded to requests for comment and clarification on several points. I will update this post if that changes.<span id="more-44151"></span></p>
<h4>ANALYSIS</h4>
<p>MyHeritage&#8217;s repeated assurances that nothing related to user DNA ancestry tests and genealogy data was impacted by this incident are not reassuring. Much depends on the strength of the hashing routine used to obfuscate user passwords.</p>
<p>Thieves can use open-source tools to crack large numbers of passwords that are scrambled by weaker hashing algorithms (<a href="https://en.wikipedia.org/wiki/MD5" target="_blank" rel="noopener">MD5</a> and <a href="https://en.wikipedia.org/wiki/SHA-1" target="_blank" rel="noopener">SHA-1</a>, e.g.) with very little effort. Passwords jumbled by more advanced hashing methods &#8212; such as <a href="https://krebsonsecurity.com/2012/06/how-companies-can-beef-up-password-security/" target="_blank" rel="noopener">Bcrypt</a> &#8212; are typically far more difficult to crack, but I would expect any breach victim who was using Bcrypt to disclose this and point to it as a mitigating factor in a cybersecurity incident.</p>
<p>In its blog post, MyHeritage says it enabled a unique &#8220;hash key&#8221; for each user password. It seems likely the company is talking about adding random &#8220;<a href="https://en.wikipedia.org/wiki/Salt_(cryptography)" target="_blank" rel="noopener">salt</a>&#8221; to each password, which can be a very effective method for blunting large-scale password cracking attacks (if implemented properly).</p>
<p>If indeed the MyHeritage user database was taken and stored by a malicious hacker (as opposed to inadvertently exposed by an employee), there is a good chance that the attackers will be trying to crack all user passwords. And if any of those passwords are crackable, the attackers will then of course get access to the more personal data on those users.</p>
<p>In light of this and the sensitivity of the data involved, it would seem prudent for MyHeritage to simply expire all existing passwords and force a password reset for all of users, instead of <a href="http://helpcenter.myheritage.com/Account-Settings/Change-password-Email/634030922501487720/How-do-I-change-my-email-address-and-or-password.htm" target="_blank" rel="noopener">relying on them to do it themselves</a> at some point (hopefully, before any attackers might figure out how to crack the user password hashes).</p>
<p>Finally, it&#8217;s astounding that 92 million+ users thought it was okay to protect such sensitive data with just a username and password. And that MyHeritage is only now getting around developing two-factor solutions.</p>
<p>It&#8217;s now 2018, and two-factor authentication is not a new security technology by any stretch. A word of advice: If a Web site you trust with sensitive personal or financial information doesn&#8217;t offer some form of multi-factor authentication, it&#8217;s time to shop around.</p>
<p>Check out <a href="https://twofactorauth.org/" target="_blank" rel="noopener">twofactorauth.org</a>, and compare how your bank, email, Web/cloud hosting or domain name provider stacks up against the competition. If you find a competitor with better security, consider moving your data and business there.</p>
<p>Every company (including MyHeritage) likes to say that &#8220;your privacy and the security of your data are our highest priority.&#8221; Maybe it&#8217;s time we stopped patronizing companies that don&#8217;t outwardly demonstrate that priority.</p>
<p>For more on MyHeritage, check out this <a href="https://www.theatlantic.com/science/archive/2018/03/yaniv-erlich-genomes-pedigrees-myheritage/554441/" target="_blank" rel="noopener">March 2018 story</a> in <em>The Atlantic</em> about how the company recently mapped out a 13-million person family tree.</p>


feed_id: https://krebsonsecurity.com/?p=43780
title: Further Down the Trello Rabbit Hole
uri: Further-Down-the-Trello-Rabbit-Hole
url: https://krebsonsecurity.com/2018/06/further-down-the-trello-rabbit-hole/
content:
<p>Last month&#8217;s <a href="https://krebsonsecurity.com/2018/05/when-your-employees-post-passwords-online/" target="_blank" rel="noopener">story</a> about organizations exposing passwords and other sensitive data via collaborative online spaces at <strong>Trello.com</strong> only scratched the surface of the problem. A deeper dive suggests a large number of government agencies, marketing firms, healthcare organizations and IT support companies are publishing credentials via public Trello boards that quickly get indexed by the major search engines.</p>
<p>By default, Trello boards for both enterprise and personal use are set to either private (requires a password to view the content) or team-visible only (approved members of the collaboration team can view).</p>
<p>But individual users may be able to manually share personal boards that include personal or proprietary employer data, information that gets cataloged by Internet search engines and available to anyone with a Web browser.</p>
<p><img class="aligncenter wp-image-44153" src="media/ee7683d9.trello.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/trello.png" alt="" width="593" height="205" /></p>
<p><strong>David Shear</strong> is an analyst at <a href="https://www.flashpoint-intel.com">Flashpoint</a>, a New York City based threat intelligence company. Shear spent several weeks last month exploring the depths of sensitive data exposed on Trello. Amid his digging, Shear documented hundreds of public Trello boards that were exposing passwords and other sensitive information. KrebsOnSecurity worked with Shear to document and report these boards to Trello.</p>
<p>Shear said he&#8217;s amazed at the number of companies selling IT support services that are using Trello not only to store their own passwords, but even credentials to manage customer assets online.</p>
<p>&#8220;There&#8217;s a bunch of different IT shops using it to troubleshoot client requests, and to do updates to infrastructure,&#8221; Shear said. &#8220;We also found a Web development team that&#8217;s done a lot of work for various dental offices. You could see who all their clients were and see credentials for clients to log into their own sites. These are IT companies doing this. And they tracked it all via [public] Trello pages.&#8221;</p>
<p>One particularly jarring misstep came from someone working for <a href="http://www.seceon.com/" target="_blank" rel="noopener">Seceon</a>, a Westford, Mass. cybersecurity firm that touts the ability to detect and stop data breaches in real time. But until a few weeks ago the Trello page for Seceon featured multiple usernames and passwords, including credentials to log in to the company&#8217;s <strong>WordPress</strong> blog and <strong>iPage</strong> domain hosting.</p>
<div id="attachment_44146" style="width: 599px" class="wp-caption aligncenter"><a class="lightbox" href="media/bcc8b1a1.seceon-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/seceon-red.png"><img class="wp-image-44146" src="media/bcc8b1a1.seceon-red.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/seceon-red.png" alt="" width="589" height="433" /></a><p class="wp-caption-text">Credentials shared on Trello by an employee of Seceon, a cybersecurity firm.</p></div>
<p>Shear also found that a senior software engineer working for <strong>Red Hat Linux</strong> in October 2017 posted administrative credentials to two different servers apparently used to test new builds.</p>
<div id="attachment_44147" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/24bc4fb5.redhat-edited.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/redhat-edited.png"><img class="wp-image-44147" src="media/24bc4fb5.redhat-edited.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/redhat-edited.png" alt="" width="593" height="320" /></a><p class="wp-caption-text">Credentials posted by a senior software engineer at Red Hat.</p></div>
<p>The <strong>Maricopa County Department of Public Health</strong> (MCDPH) in Arizona used public Trello boards to document a host of internal resources that are typically found behind corporate intranets, such as this board that aggregated information for new hires (including information about how to navigate the MCDPH&#8217;s payroll system):</p>
<div id="attachment_44148" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/6cfd3d77.mcdph.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/mcdph.png"><img class="wp-image-44148" src="media/6cfd3d77.mcdph.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/mcdph.png" alt="" width="594" height="450" /></a><p class="wp-caption-text">The (now defunct) Trello page for the Maricopa County Department of Public Health.</p></div>
<p>Even federal health regulators have made privacy missteps with Trello. Shear&#8217;s sleuthing uncovered a public Trello page maintained by <a href="https://www.healthit.gov/" target="_blank" rel="noopener">HealthIT.gov</a> &#8212; the official Web site of the <strong>National Coordinator for Health Information Technology</strong>, a component of the <strong>U.S. Department of Health and Human Services</strong> (HHS) &#8212; that was leaking credentials.</p>
<p>There appear to be a great many marketers and realtors who are using public Trello boards as their personal password notepads. One of my favorites is a Trello page maintained by a &#8220;virtual assistant&#8221; who specializes in helping realtors find new clients and sales leads. Apparently, this person re-used her Trello account password somewhere else (and/or perhaps re-used it from a list of passwords available on her Trello page), and as a result someone added a &#8220;You hacked&#8221; card to the assistant&#8217;s Trello board, urging her to change the password.</p>
<p>One realtor from Austin, Texas who posted numerous passwords to her public Trello board apparently had <a href="https://twitter.com/PamelaKAshley" target="_blank" rel="noopener">her Twitter profile hijacked</a> and defaced with a photo featuring a giant Nazi flag and assorted Nazi memorabilia. It&#8217;s not clear how the hijacker obtained her password, but it appears to have been on Trello for some time.</p>
<p>Other entities that inadvertently shared passwords for private resources via public Trello boards included a Chinese aviation authority; the <strong>International AIDS Society</strong>; and the global technology consulting and research firm <a href="http://www.analysysmason.com/" target="_blank" rel="noopener">Analysis Mason</a>, which also exposed its <a href="https://twitter.com/AnalysysMason" target="_blank" rel="noopener">Twitter account</a> credentials on Trello until very recently.<span id="more-43780"></span></p>
<p>Trello responded to this report by making private many of the boards referenced above; other reported boards appear to remain public, minus the sensitive information. Trello said it was working with Google and other search engine providers to have any cached copies of the exposed boards removed.</p>
<p>&#8220;We have put many safeguards in place to make sure that public boards are being created intentionally and have clear language around each privacy setting, as well as persistent visibility settings at the top of each board,&#8221; a Trello spokesperson told KrebsOnSecurity in response to this research. &#8220;With regard to the search-engine indexing, we are currently sending the correct HTTP response code to Google after a board is made private. This is an automated, immediate action that happens upon users making the change. But we are trying to see if we can speed up the time it takes Google to realize that some of the URLs are no longer available.&#8221;</p>
<div id="attachment_43609" style="width: 601px" class="wp-caption aligncenter"><img class=" wp-image-43609" src="media/830360c7.trellovisibility.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/trellovisibility.png" alt="" width="591" height="657" /><p class="wp-caption-text">If a Trello board is Team Visible it means any members of that team can view, join, and edit cards. If a board is Private, only members of that specific board can see it. If a board is Public, anyone with the link to the board can see it.</p></div>
<p>Flashpoint&#8217;s Shear said Trello should be making a more concerted effort to proactively find sensitive data exposed by its users. For example, Shear said Trello&#8217;s platform could perform some type of automated analysis that looks for specific keywords (like &#8220;password&#8221;) and if the page is public display a reminder to the board&#8217;s author about how to make the page private.</p>
<p>&#8220;They could easily do input validation on things like passwords if they&#8217;re not going to proactively search their own network for this stuff,&#8221; Shear said.</p>
<p>Trello co-founder <strong>Michael Pryor</strong> said the company was grateful for the suggestion and would consider it.</p>
<p>&#8220;We are looking at other cloud apps of our size and how they balance the vast majority of useful sharing of public info with helping people not make a mistake,&#8221; Pryor said. &#8220;We’ll continue to explore the topic and potential solutions, and appreciate the work you put into the list you shared with us.&#8221;</p>
<p>Shear said he doubts his finds even come close to revealing the true extent of the sensitive data organizations are exposing via misconfigured Trello boards. He added that even in cases where public Trello boards don&#8217;t expose passwords or financial data, the information that countless organizations publish to these boards can provide plenty of ammunition for phishers and cybercriminals looking to target specific entities.</p>
<p>&#8220;I don&#8217;t think we&#8217;ve even uncovered the real depth of what&#8217;s probably there,&#8221; he said. &#8220;I&#8217;d be surprised if someone isn&#8217;t at least trying to collect a bunch of user passwords and configuration files off lots of Trello accounts for bad guy operations.&#8221;</p>
<p><strong>Update, 11:56 p.m. ET:</strong> Corrected location of MCDPH.</p>


feed_id: https://krebsonsecurity.com/?p=44204
title: Adobe Patches Zero-Day Flash Flaw
uri: Adobe-Patches-Zero-Day-Flash-Flaw
url: https://krebsonsecurity.com/2018/06/adobe-patches-zero-day-flash-flaw/
content:
<p><strong>Adobe</strong> has released an emergency update to address a critical security hole in its <strong>Flash Player</strong> browser plugin that is being actively exploited to deploy malicious software. If you&#8217;ve got Flash installed &#8212; and if you&#8217;re using <strong>Google Chrome</strong> or a recent version of <strong>Microsoft Windows</strong> you do &#8212; it&#8217;s time once again to make sure your copy of Flash is either patched, hobbled or removed.</p>
<p><img class="alignright size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />In <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-19.html" target="_blank" rel="noopener">an advisory</a> published today, Adobe said it is aware of a report that an exploit for the previously unknown Flash flaw &#8212; <strong>CVE-2018-5002</strong> &#8212; exists in the wild, and &#8220;is being used in limited, targeted attacks against Windows users. These attacks leverage <strong>Microsoft Office</strong> documents with embedded malicious Flash Player content distributed via email.&#8221;</p>
<p>The vulnerable versions of Flash include <em>v. 29.0.0.171</em> and earlier. The version of Flash released today brings the program to <em>v. 30.0.0.113</em> for Windows, <strong>Mac</strong>, <strong>Linux</strong> and <strong>Chrome OS</strong>. Check out <a href="https://helpx.adobe.com/flash-player.html" target="_blank" rel="noopener">this link</a> to detect the presence of Flash in your browser and the version number installed.</p>
<p>Both <strong>Internet Explorer</strong>/<strong>Edge</strong> on <strong>Windows 10</strong> and Chrome should automatically prompt users to update Flash when newer versions are available. At the moment, however, I can&#8217;t see any signs yet that either Microsoft or Google has pushed out new updates to address the Flash flaw. I&#8217;ll update this post if that changes.</p>
<p>Adobe credits Chinese security firm <strong>Qihoo 360</strong> with reporting the zero-day Flash flaw. Qihoo said in <a href="http://blogs.360.cn/blog/cve-2018-5002-en/" target="_blank" rel="noopener">a blog post</a> that the exploit was seen being used to target individuals and companies in Doha, Qatar, and is believed to be related to a nation-state backed cyber-espionage campaign that uses booby-trapped Office documents to deploy malware.</p>
<p>In February 2018, Adobe <a href="https://krebsonsecurity.com/2018/02/attackers-exploiting-unpatched-flaw-in-flash/" target="_blank" rel="noopener">patched another zero-day Flash flaw</a> that was <a href="https://www.fireeye.com/blog/threat-research/2018/02/attacks-leveraging-adobe-zero-day.html" target="_blank" rel="noopener">tied to cyber espionage attacks launched by North Korean hackers</a>.<span id="more-44204"></span></p>
<p>Hopefully, most readers here have taken my longstanding advice to disable or at least hobble Flash, a buggy and insecure component that nonetheless ships by default with <strong>Google Chrome</strong> and <strong>Internet Explorer</strong>. More on that approach (as well as slightly less radical solutions) can be found in <a href="http://krebsonsecurity.com/2015/06/a-month-without-adobe-flash-player/" target="_blank" rel="noopener">A Month Without Adobe Flash Player</a>. The short version is that you can probably get by without Flash installed and not miss it at all.</p>
<p>For readers still unwilling to cut the Flash cord, there are half-measures that work almost as well. Fortunately, <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank" rel="noopener">disabling Flash in Chrome</a> is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist/blacklist specific sites.</p>
<p>By default, <strong>Mozilla Firefox</strong> on Windows computers with Flash installed runs Flash in a “<a href="http://blogs.adobe.com/security/2012/06/inside-flash-player-protected-mode-for-firefox.html" target="_blank" rel="noopener">protected mode</a>,” which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.</p>
<p>Another, perhaps less elegant, alternative to wholesale kicking Flash to the curb is to keeping it installed in a browser that you don’t normally use, and then only using that browser on sites that require Flash.</p>
<p>Administrators have the ability to change Flash Player’s behavior when running on Internet Explorer on <strong>Windows 7</strong> and below by prompting the user before playing Flash content. A guide on how to do that is <a href="media/116dd27f.flash_player_27_0_admin_guide.pdf" data-original-source="https://www.adobe.com/content/dam/acom/en/devnet/flashplayer/articles/flash_player_admin_guide/pdf/flash_player_27_0_admin_guide.pdf" target="_blank" rel="noopener">here</a> (PDF). Administrators may also consider implementing <a href="https://support.office.com/en-us/article/what-is-protected-view-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653#bm5" target="_blank" rel="noopener" data-saferedirecturl="https://www.google.com/url?hl=en&amp;q=https://support.office.com/en-us/article/what-is-protected-view-d6f09ac7-e6b9-4495-8e43-2bbcdbcb6653%23bm5&amp;source=gmail&amp;ust=1517665562120000&amp;usg=AFQjCNH1N5uNNb93xTY_aa6zwH-Ou6cUGg">Protected View for Office</a>. Protected View opens a file marked as potentially unsafe in Read-only mode.</p>


feed_id: https://krebsonsecurity.com/?p=44137
title: Bad .Men at .Work. Please Don’t .Click
uri: Bad-Men-at-Work-Please-Don-t-Click
url: https://krebsonsecurity.com/2018/06/bad-men-at-work-please-dont-click/
content:
<p>Web site names ending in new top-level domains (TLDs) like <strong>.men</strong>, <strong>.work</strong> and <strong>.click</strong> are some of the riskiest and spammy-est on the Internet, according to experts who track such concentrations of badness online. Not that there still aren&#8217;t a whole mess of nasty <strong>.com</strong>, <strong>.net</strong> and <strong>.biz</strong> domains out there, but relative to their size (i.e. overall number of domains) these newer TLDs are far dicier to visit than most online destinations.</p>
<p>There are many sources for measuring domain reputation online, but one of the newest is <a href="https://www.spamhaus.org/statistics/tlds/" target="_blank" rel="noopener">The 10 Most Abused Top Level Domains list</a>, run by <strong>Spamhaus.org</strong>. Currently at the #1 spot on the list (the worst) is .men: Spamhaus says of the 65,570 domains it has seen registered in the .men TLD, more than half (55 percent) were &#8220;bad.&#8221;</p>
<p><img class="aligncenter size-full wp-image-44198" src="media/52f58047.toptenabusedtlds.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/toptenabusedtlds.png" alt="" width="541" height="884" /></p>
<p>According to Spamhaus, a TLD may be &#8220;bad&#8221; because it is tied to spam or malware dissemination (or both). More specifically, the &#8220;badness&#8221; of a given TLD may be assigned in two ways:</p>
<p>&#8220;The ratio of bad to good domains may be higher than average, indicating that the registry could do a better job of enforcing policies and shunning abusers. Or, some TLDs with a high fraction of bad domains may be quite small, and their total number of bad domains could be relatively limited with respect to other, bigger TLDs. Their total &#8220;badness&#8221; to the Internet is limited by their small total size.&#8221;</p>
<p>More than <a href="https://www.icann.org/registrar-reports/accredited-list.html" target="_blank" rel="noopener">1,500 TLDs exist today</a>, but hundreds of them were introduced in just the past few years. The nonprofit organization that runs the domain name space &#8212; the <strong>Internet Corporation for Assigned Names and Numbers</strong> (ICANN) &#8212; enabled the new TLDs in response to requests from advertisers and domain speculators &#8212; even though security experts warned that an onslaught of new, far cheaper TLDs would be a boon mainly to spammers and scammers.</p>
<p>And what a boon it has been. The newer TLDs are popular among spammers and scammers alike because domains in many of these TLDs can be had for pennies apiece. But not all of the TLDs on Spamhaus&#8217; list are prized for being cheaper than generic TLDs (like .com, .net, etc.). The cheapest domains at half of Spamhaus&#8217; top ten &#8220;baddest&#8221; TLDs go for prices between $6 and $14.50 per domain.</p>
<p>Still, domains in the remaining five Top Bad TLDs can be had for between 48 cents and a dollar each.</p>
<p>Security firm <strong>Symantec </strong>in March 2018 published its own <a href="https://www.symantec.com/blogs/feature-stories/top-20-shady-top-level-domains" target="_blank" rel="noopener">Top 20 list of Shady TLDs:</a></p>
<div id="attachment_44194" style="width: 456px" class="wp-caption aligncenter"><img class="size-full wp-image-44194" src="media/b9901738.sym-top20-tld.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/sym-top20-tld.png" alt="" width="446" height="804" /><p class="wp-caption-text">Symantec&#8217;s &#8220;Top 20 Shady TLDs,&#8221; published in March 2018.</p></div>
<p>Spamhaus says TLD registries that allow registrars to sell high volumes of domains to professional spammers and malware operators in essence aid and abet the plague of abuse on the Internet.</p>
<p>“Some registrars and resellers knowingly sell high volumes of domains to these actors for profit, and many registries do not do enough to stop or limit this endless supply of domains,” Spamhaus’ World’s Most Abused TLDs page explains.</p>
<p><strong>Namecheap, </strong>a Phoenix, Ariz. based domain name registrar that in Oct. 2017 was the <a href="https://domainnamewire.com/2018/02/02/coms-top-registrars/" target="_blank" rel="noopener">fourth-largest registrar</a>, currently offers by a wide margin the lowest registration prices for three out of 10 of Spamhaus’ baddest TLDs, selling most for less than 50 cents each.</p>
<p>Namecheap also is by far the cheapest registrar for 11 of Symantec&#8217;s Top 20 Shady New TLDs: Namecheap is easily the least expensive registrar to secure a domain in 11 of the Top 20, including .date, .trade, .review, .party, .loan, .kim, .bid, .win, .racing, .download and .stream.<span id="more-44137"></span></p>
<p>I should preface the following analysis by saying the prices that domain registrars charge for various TLD name registrations vary frequently, as do the rankings in these Top Bad TLD lists. But I was curious if there was any useful data about new TLD abuse at <a href="https://tld-list.com/tld/men" target="_blank" rel="noopener">tld-list.com</a> &#8212; a comparison shopping page for domain registrars.</p>
<p>What I found is that although domains in almost all of the above-mentioned TLDs are sold by dozens of registrars, most of these registrars have priced themselves out of the market for the TLDs that are currently so-favored by spammers and scammers.</p>
<p>Not so with Namecheap. True to its name, when it is the cheapest Namecheap consistently offers the lowest price by approximately 98 percent off the average price that other registrars selling the same TLD charge per domain. The company appears to have specifically targeted these TLDs with price promotions that far undercut competitors.</p>
<div id="attachment_44193" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/3e346b60.48cents.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/48cents.png"><img class="wp-image-44193" src="media/3e346b60.48cents.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/48cents.png" alt="" width="595" height="253" /></a><p class="wp-caption-text">Namecheap is by far the lowest-priced registrar for more than half of the 20 Top Bad TLDs tracked by Symantec earlier this year.</p></div>
<p>Here&#8217;s a look at the per-domain prices charged by the registrars for the TLDs named in Spamhaus&#8217;s top 10:</p>
<div id="attachment_44234" style="width: 602px" class="wp-caption aligncenter"><a class="lightbox" href="media/3275805c.spamhaus-top10.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/spamhaus-top10.png"><img class="wp-image-44234" src="media/3275805c.spamhaus-top10.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/spamhaus-top10.png" alt="" width="592" height="169" /></a><p class="wp-caption-text">The lowest, highest, and average prices charged by registrars for the domains in Spamhaus&#8217; Top 10 &#8220;Bad&#8221; TLDs. Click to enlarge.</p></div>
<p>This a price comparison for Symantec&#8217;s Top 20 list:</p>
<div id="attachment_44196" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/07ac7aa6.sym-tld-pricing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/sym-tld-pricing.png"><img class="wp-image-44196" src="media/07ac7aa6.sym-tld-pricing.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/sym-tld-pricing.png" alt="" width="594" height="295" /></a><p class="wp-caption-text">The lowest, highest, and average prices charged by registrars for the domains in Symantec&#8217;s Top 20 &#8220;Shady&#8221; TLDs. Click to enlarge.</p></div>
<p>I asked Namecheap&#8217;s CEO why the company&#8217;s name comes up so frequently in these lists, and if there was any strategy behind cornering the market for so many of the &#8220;bad&#8221; and &#8220;shady&#8221; TLDs.</p>
<p>&#8220;Our business model, as our name implies is to offer choice and value to everyone in the same way companies like Amazon or Walmart do,&#8221; <strong>Namecheap CEO Richard Kirkendall</strong> told KrebsOnSecurity. &#8220;Saying that because we offer low prices to all customers we somehow condone nefarious activity is an irresponsible assumption on your part. Our commitment to our millions of customers across the world is to continue to bring them the best value and choice whenever and wherever we can.&#8221;</p>
<p>Kirkendall said expecting retail registrars that compete on pricing to stop doing that is not realistic and would be the last place he would go to for change.</p>
<p>&#8220;On the other hand, if you do manage to secure higher pricing you will also in effect tax everyone for the bad actions of a few,&#8221; Kirkendall said. &#8220;Is this really the way to solve the problem? While a few dollars may not matter to you, there are plenty of less fortunate people out there where it does matter. They say the internet is the great equalizer, by making things cost more simply for the sake of creating barriers truly and indiscriminately creates barriers for everyone, not just for those you target.&#8221;</p>
<p>Incidentally, should you ever wish to block all domains from any given TLD, there are a number of tools available to do that. One of the easiest to use is <strong>Cisco</strong>&#8216;s <a href="https://www.opendns.com/home-internet-security/" target="_blank" rel="noopener">OpenDNS</a>, which includes up to 30 filters for managing traffic, content and Web sites on your computer and home network &#8212; including the ability to block entire TLDs if that&#8217;s something you want to do.</p>
<p>I&#8217;m often asked if blocking sites from loading when they&#8217;re served from specific TLDs or countries (like .ru) would be an effective way to block malware and phishing attacks. It&#8217;s important to note here that it&#8217;s not practical to assume you can block all traffic from given countries (that somehow blacklisting .ru is going to block all traffic from Russia). It also seems likely that the .com TLD space and US-based ISPs are bigger sources of the problem overall.</p>
<p>But that&#8217;s not to say blocking entire TLDs a horrible idea for individual users and home network owners. I&#8217;d wager there are whole a host of TLDs (including all of the above &#8220;bad&#8221; and &#8220;shady&#8221; TLDs) that most users could block across the board without forgoing anything they might otherwise want to have seen or visited. I mean seriously: When was the last time you intentionally visited a site registered in <a href="https://en.wikipedia.org/wiki/Gabon" target="_blank" rel="noopener">the TLD for Gabon (.ga)</a>?</p>
<p>And while many people might never click on a .party or .men domain in a malicious or spammy email, these domains are often loaded only after the user clicks on a malicious or booby-trapped link that may not look so phishy &#8212; such as a .com or .org link.</p>
<p><strong>Update: 11:46 a.m. ET:</strong> An earlier version of this story incorrectly stated the name of the company that owns OpenDNS.</p>


feed_id: https://krebsonsecurity.com/?p=44236
title: Microsoft Patch Tuesday, June 2018 Edition
uri: Microsoft-Patch-Tuesday-June-2018-Edition
url: https://krebsonsecurity.com/2018/06/microsoft-patch-tuesday-june-2018-edition/
content:
<p><strong>Microsoft</strong> today pushed out a bevy of software updates to fix more than four dozen security holes in <strong>Windows</strong> and related software. Almost a quarter of the vulnerabilities addressed in this month&#8217;s patch batch earned Microsoft&#8217;s &#8220;critical&#8221; rating, meaning malware or miscreants can exploit the flaws to break into vulnerable systems without any help from users.</p>
<p><img class="alignright size-full wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="229" height="240" />Most of the critical fixes are in Microsoft browsers or browser components. One of the flaws, <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8267" target="_blank" rel="noopener">CVE-2018-8267</a>, was publicly disclosed prior to today&#8217;s patch release, meaning attackers may have had a head start figuring out how to exploit the bug to attack <strong>Internet Explorer</strong> users.</p>
<p dir="ltr">According to <a href="https://www.recordedfuture.com" target="_blank" rel="noopener">Recorded Future</a>, the most important patched vulnerability is a remote code execution vulnerability in the Windows Domain Name System (DNS), which is present in all versions of supported versions of Windows from <strong>Windows 7</strong> to <strong>Windows 10</strong> as well as all versions of Windows Server from 2008 to 2016.</p>
<p dir="ltr">&#8220;The vulnerability allows an attacker to send a maliciously crafted DNS packet to the victim machine from a DNS server, or even send spoofed DNS responses from attack box,&#8221; wrote <strong>Allan Liska</strong>, a threat intelligence analyst at Recorded Future. &#8220;Successful exploitation of this vulnerability could allow an attacker to take control of the target machine.&#8221;</p>
<p>Security vendor <strong>Qualys</strong> <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/06/12/june-patch-tuesday-new-speculative-store-bypass-fixes-adobe-vulns" target="_blank" rel="noopener">says</a> mobile workstations that may connect to untrusted Wi-Fi networks are at high risk and this DNS patch should be a priority for them. Qualys also notes that Microsoft this month is shipping updates to mitigate another variant of the <a href="https://krebsonsecurity.com/2018/01/scary-chip-flaws-raise-spectre-of-meltdown/" target="_blank" rel="noopener">Spectre vulnerability</a> in Intel machines.</p>
<p>And of course there are updates available to address the <strong>Adobe Flash Player</strong> vulnerability that is already being exploited in active attacks. Read more on that <a href="https://krebsonsecurity.com/2018/06/adobe-patches-zero-day-flash-flaw/" target="_blank" rel="noopener">here</a>.<span id="more-44236"></span></p>
<p>It&#8217;s a good idea to get in the habit of backing up your computer before applying monthly updates from Microsoft. Windows has some built-in tools that can help recover from bad patches, but restoring the system to a backup image taken just before installing the updates is often much less hassle and an added piece of mind when you&#8217;re sitting there praying for the machine to reboot after patching.</p>
<p>This assumes you can get around to backing up before Microsoft decides to patch Windows on your behalf. Microsoft says by default, Windows 10 receives updates automatically, “and for customers running previous versions, we recommend they <a href="https://support.microsoft.com/en-us/help/306525/how-to-configure-and-use-automatic-updates-in-windows" data-ss1520968935="1">turn on automatic updates</a> as a best practice.” Microsoft doesn’t make it easy for Windows 10 users to change this setting, but <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">it is possible</a>.</p>
<p>For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.</p>
<p>As always, if you experience any problems installing any of these updates, please leave a note about your issues in the comments below.</p>
<p>Additional reading:</p>
<p><a href="https://blog.talosintelligence.com/2018/06/ms-tuesday.html" target="_blank" rel="noopener">Cisco Talos Intelligence blog take</a></p>
<p><a href="https://www.thezdi.com/blog/2018/6/12/the-june-2018-security-update-review" target="_blank" rel="noopener">The Zero Day Initiative&#8217;s Security Update Review</a></p>
<p><a href="https://isc.sans.edu/forums/diary/Microsoft+June+2018+Patch+Tuesday/23758/" target="_blank" rel="noopener">SANS Internet Storm Center</a></p>
<p><a href="https://portal.msrc.microsoft.com/en-us/security-guidance" target="_blank" rel="noopener">Microsoft Security Update Guide</a></p>


feed_id: https://krebsonsecurity.com/?p=44246
title: Librarian Sues Equifax Over 2017 Data Breach, Wins $600
uri: Librarian-Sues-Equifax-Over-2017-Data-Breach-Wins-600
url: https://krebsonsecurity.com/2018/06/librarian-sues-equifax-over-2017-data-breach-wins-600/
content:
<p>In the days following revelations last September that big-three consumer credit bureau <strong>Equifax</strong> had been <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">hacked and relieved of personal data on nearly 150 million people</a>, many Americans no doubt felt resigned and powerless to control their information. But not <strong>Jessamyn West</strong>. The 49-year-old librarian from a tiny town in Vermont took Equifax to court. And now she&#8217;s celebrating a small but symbolic victory after a small claims court awarded her $600 in damages stemming from the 2017 breach.</p>
<div id="attachment_44252" style="width: 254px" class="wp-caption alignright"><img class="size-full wp-image-44252" src="media/48ca015b.jwest.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/jwest.png" alt="" width="244" height="216" /><p class="wp-caption-text">Vermont librarian Jessamyn West sued Equifax over its 2017 data breach and won $600 in small claims court. Others are following suit.</p></div>
<p>Just days after Equifax disclosed the breach, West filed a claim with the local Orange County, Vt. courthouse asking a judge to award her almost $5,000. She told the court that her mother had just died in July, and that it added to the work of sorting out her mom&#8217;s finances while trying to respond to having the entire family&#8217;s credit files potentially exposed to hackers and identity thieves.</p>
<p>The judge ultimately agreed, but awarded West just $690 ($90 to cover court fees and the rest intended to cover the cost of up to two years of payments to online identity theft protection services).</p>
<p>In an interview with KrebsOnSecurity, West said she&#8217;s feeling victorious even though the amount awarded is a drop in the bucket for Equifax, which reported more than $3.4 billion in revenue last year.</p>
<p>&#8220;The small claims case was a lot more about raising awareness,&#8221; said West, a librarian at the <a href="http://orangesouthwest.org/rtcc" target="_blank" rel="noopener">Randolph Technical Career Center</a> who specializes in technology training and frequently conducts <a href="http://www.librarian.net/talks/privacy17/" target="_blank" rel="noopener">talks on privacy and security</a>.</p>
<p>&#8220;I just wanted to change the conversation I was having with all my neighbors who were like, &#8216;Ugh, computers are hard, what can you do?&#8217; to &#8216;Hey, here are some things you <em>can</em> do&#8217;,&#8221; she said. <span class="pullquote pqleft">&#8220;A lot of people don&#8217;t feel they have agency around privacy and technology in general. This case was about having your own agency when companies don&#8217;t behave how they&#8217;re supposed to with our private information.&#8221;</span></p>
<p>West said she&#8217;s surprised more people aren&#8217;t following her example. After all, if just a tiny fraction of the 147 million Americans who had their Social Security number, date of birth, address and other personal data stolen in last year&#8217;s breach filed a claim and prevailed as West did, it could easily cost Equifax tens of millions of dollars in damages and legal fees.</p>
<p>&#8220;The paperwork to file the claim was a little irritating, but it only cost $90,&#8221; she said. &#8220;Then again, I could see how many people probably would see this as a lark, where there&#8217;s a pretty good chance you&#8217;re not going to see that money again, and for a lot of people that probably doesn&#8217;t really make things better.&#8221;</p>
<p>Equifax is currently the target of several class action lawsuits related to the 2017 breach disclosure, but there have been a few other minor victories in state small claims courts.</p>
<p>In January, data privacy enthusiast <strong>Christian Haigh</strong> <a href="https://blog.legalist.com/i-won-8-000-from-equifax-in-small-claims-court-heres-how-you-can-too-f0ce6925c079?gi=b828331f5ba" target="_blank" rel="noopener">wrote about winning an $8,000 judgment</a> in small claims court against Equifax for its 2017 breach (the amount was reduced to $5,500 after Equifax appealed).</p>
<p>Haigh is co-founder of litigation finance startup <a href="https://legalist.com/" target="_blank" rel="noopener">Legalist</a>. According to <a href="https://www.inc.com/bill-murphy-jr/people-are-suing-equifax-in-small-claims-court-its-totally-brilliant-heres-why.html" target="_blank" rel="noopener">Inc.com</a>, Haigh&#8217;s company has started funding other people&#8217;s small claims suits against Equifax, too. (Legalist pays lawyers in plaintiff&#8217;s suits on an hourly basis, and takes a contingency fee if the case is successful.)</p>
<p><img class="aligncenter wp-image-44253" src="media/b86a1d9d.dvg.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/dvg.jpg" alt="" width="594" height="304" /><span id="more-44246"></span></p>
<p>Days after the Equifax breach news broke, a 20-year-old <strong>Stanford University</strong> student published a free online bot that helps users sue the company in small claims court.</p>
<p>It&#8217;s not clear if <a href="http://donotpay-search-master.herokuapp.com/" target="_blank" rel="noopener">the Web site tool</a> is still functioning, but West said it was <a href="https://www.usatoday.com/story/tech/news/2017/09/13/want-equifax-pay-bot-helps-victims-file-15-000-small-claims-suit/663102001/" target="_blank" rel="noopener">media coverage</a> of this very same lawsuit bot that prompted her to file.</p>
<p>&#8220;I thought if some stupid online bot can do this, I could probably figure it out,&#8221; she recalled.</p>
<p>If you&#8217;re a DYI type person, by all means file a claim in your local small claims court. And then write and publish about your experience, just like West did <a href="https://medium.com/@jessamyn/equifax-statement-for-small-claims-court-780d2608e752" target="_blank" rel="noopener">in a post at Medium.com</a>.</p>
<p>West said she plans to donate the money from her small claims win to the Vermont chapter of the <strong>American Civil Liberties Union</strong> (ACLU), and that she hopes her case inspires others.</p>
<p>&#8220;Even if all this does is get people to use better passwords, or go to the library, or to tell a company, &#8216;No, that&#8217;s not not good enough, you need to do better,&#8217; that would be a good thing,&#8221; West said. &#8220;I wanted to show that there are constructive ways to seek redress of grievances about lots of different things, which makes me happy. I was willing to do the work and go to court. I look at this like an opportunity to educate and inform yourself, and realize there is a step you can take beyond just rending of garments and gnashing of teeth.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=44130
title: Google to Fix Location Data Leak in Google Home, Chromecast
uri: Google-to-Fix-Location-Data-Leak-in-Google-Home-Chromecast
url: https://krebsonsecurity.com/2018/06/google-to-fix-location-data-leak-in-google-home-chromecast/
content:
<p><strong>Google</strong> in the coming weeks is expected to fix a location privacy leak in two of its most popular consumer products. New research shows that Web sites can run a simple script in the background that collects precise location data on people who have a <strong>Google Home</strong> or <strong>Chromecast</strong> device installed anywhere on their local network.</p>
<p><img class="aligncenter wp-image-44277" src="media/ed29c582.homecast.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/homecast.png" alt="" width="594" height="328" /></p>
<p><strong>Craig Young</strong>, a researcher with security firm <strong>Tripwire</strong>, said he discovered an authentication weakness that leaks incredibly accurate location information about users of both the smart speaker and home assistant <a href="https://store.google.com/us/product/google_home?hl=en-US" target="_blank" rel="noopener">Google Home</a>, and <a href="https://www.tomsguide.com/us/what-is-google-chromecast,news-17637.html" target="_blank" rel="noopener">Chromecast</a>, a small electronic device that makes it simple to stream TV shows, movies and games to a digital television or monitor.</p>
<p>Young said the attack works by asking the Google device for a list of nearby wireless networks and then sending that list to Google’s geolocation lookup services.</p>
<p>&#8220;An attacker can be completely remote as long as they can get the victim to open a link while connected to the same Wi-Fi or wired network as a Google Chromecast or Home device,&#8221; Young told KrebsOnSecurity. &#8220;The only real limitation is that the link needs to remain open for about a minute before the attacker has a location. The attack content could be contained within malicious advertisements or even a tweet.&#8221;</p>
<p>It is common for Web sites to keep a record of the numeric <a href="https://en.wikipedia.org/wiki/IP_address" target="_blank" rel="noopener">Internet Protocol (IP) address</a> of all visitors, and those addresses can be used in combination with online geolocation tools to glean information about each visitor&#8217;s hometown or region. But this type of location information is often quite imprecise. In many cases, IP geolocation offers only a general idea of where the IP address may be based geographically.</p>
<p>This is typically not the case with Google&#8217;s geolocation data, which includes <a href="https://www.maketecheasier.com/google-know-where-wifi-router/" target="_blank" rel="noopener">comprehensive maps of wireless network names around the world</a>, linking each individual Wi-Fi network to a corresponding physical location. Armed with this data, Google can very often determine a user&#8217;s location to within a few feet (particularly in densely populated areas), by triangulating the user between several nearby mapped Wi-Fi access points. [Side note: Anyone who&#8217;d like to see this in action need only to turn off location data and remove the SIM card from a smart phone and see how well navigation apps like Google&#8217;s <a href="https://www.waze.com/" target="_blank" rel="noopener">Waze</a> can still figure out where you are].</p>
<p>&#8220;The difference between this and a basic IP geolocation is the level of precision,&#8221; Young said. &#8220;For example, if I geolocate my IP address right now, I get a location that is roughly 2 miles from my current location at work. For my home Internet connection, the IP geolocation is only accurate to about 3 miles. With my attack demo however, I’ve been consistently getting locations within about 10 meters of the device.&#8221;</p>
<p>Young said a demo he created (a video of which is below) is accurate enough that he can tell roughly how far apart his device in the kitchen is from another device in the basement.</p>
<p>&#8220;I’ve only tested this in three environments so far, but in each case the location corresponds to the right street address,&#8221; Young said. &#8220;The Wi-Fi based geolocation works by triangulating a position based on signal strengths to Wi-Fi access points with known locations based on reporting from people’s phones.&#8221;</p>
<p>Beyond leaking a Chromecast or Google Home user&#8217;s precise geographic location, this bug could help scammers make phishing and extortion attacks appear more realistic. Common scams like fake FBI or IRS warnings or threats to release compromising photos or expose some secret to friends and family could abuse Google&#8217;s location data to lend credibility to the fake warnings, Young notes.</p>
<p>&#8220;The implications of this are quite broad including the possibility for more effective blackmail or extortion campaigns,&#8221; he said. &#8220;Threats to release compromising photos or expose some secret to friends and family could use this to lend credibility to the warnings and increase their odds of success.&#8221;</p>
<div style="text-align: center;"><iframe src="https://www.youtube.com/embed/ESS_D6P26zQ" width="560" height="315" frameborder="0" allowfullscreen="allowfullscreen"></iframe></div>
<p>When Young first reached out to Google in May about his findings, the company replied by closing his bug report with a &#8220;Status: Won&#8217;t Fix (Intended Behavior)&#8221; message. But after being contacted by KrebsOnSecurity, Google changed its tune, saying it planned to ship an update to address the privacy leak in both devices. Currently, that update is slated to be released in mid-July 2018.<span id="more-44130"></span></p>
<p>According to Tripwire, the location data leak stems from poor authentication by Google Home and Chromecast devices, which rarely require authentication for connections received on a local network.</p>
<p>&#8220;We must assume that any data accessible on the local network without credentials is also accessible to hostile adversaries,&#8221; Young wrote in <a href="https://www.tripwire.com/state-of-security/vert/googles-newest-feature-find-my-home/#.WyfDEMLoy-g.twitter" target="_blank" rel="noopener">a blog post</a> about his findings. &#8220;This means that all requests must be authenticated and all unauthenticated responses should be as generic as possible. Until we reach that point, consumers should separate their devices as best as is possible and be mindful of what web sites or apps are loaded while on the same network as their connected gadgets.&#8221;</p>
<p>Earlier this year, KrebsOnSecurity posted <a href="https://krebsonsecurity.com/2018/01/some-basic-rules-for-securing-your-iot-stuff/" target="_blank" rel="noopener">some basic rules for securing your various &#8220;Internet of Things&#8221; (IoT) devices</a>. That primer lacked one piece of advice that is a bit more technical but which can help mitigate security or privacy issues that come with using IoT systems: Creating your own &#8220;Intranet of Things,&#8221; by segregating IoT devices from the rest of your local network so that they reside on a completely different network from the devices you use to browse the Internet and store files.</p>
<p>&#8220;A much easier solution is to add another router on the network specifically for connected devices,&#8221; Young wrote. &#8220;By connecting the <a href="https://www.lnet.fi/en/moremachines" target="_blank" rel="noopener">WAN port</a> of the new router to an open <a href="https://www.lnet.fi/en/moremachines" target="_blank" rel="noopener">LAN port</a> on the existing router, attacker code running on the main network will not have a path to abuse those connected devices. Although this does not by default prevent attacks from the IoT devices to the main network, it is likely that most naïve attacks would fail to even recognize that there is another network to attack.&#8221;</p>
<p>For more on setting up a multi-router solution to mitigating threats from IoT devices, check out <a href="https://www.pcper.com/reviews/General-Tech/Steve-Gibsons-Three-Router-Solution-IOT-Insecurity" target="_blank" rel="noopener">this in-depth post</a> on the subject from security researcher and blogger <strong>Steve Gibson</strong>.</p>


feed_id: https://krebsonsecurity.com/?p=44291
title: Verizon to Stop Sharing Customer Location Data With Third Parties
uri: Verizon-to-Stop-Sharing-Customer-Location-Data-With-Third-Parties
url:
https://krebsonsecurity.com/2018/06/verizon-to-stop-sharing-customer-location-data-with-third-parties/

content:
<p>In the wake of a scandal involving third-party companies leaking or selling precise, real-time location data on virtually all Americans who own a mobile phone, the four major wireless carriers have responded to requests from a U.S. senator for more details about how the carriers are managing access to this extremely sensitive information. While three out of four providers said they had cancelled data sharing agreements with some of the offending companies, only one &#8212; <strong>Verizon</strong> &#8212; pledged to terminate all of them and initiate a wholesale review of their location data-sharing practices.</p>
<p><img class="aligncenter  wp-image-43845" src="media/f262877a.locationtracking.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/05/locationtracking.jpg" alt="" width="594" height="385" /></p>
<p>At issue are companies known in the wireless industry as &#8220;location aggregators,&#8221; entities that manage requests for real-time customer location data for a variety of purposes, such as roadside assistance and emergency response. These aggregators are supposed to obtain customer consent before divulging such information, but several recent incidents show that this third-party trust model is fundamentally broken.</p>
<p>On May 10, 2018, <em>The New York Times</em> <a href="https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html" target="_blank" rel="noopener">broke the story</a> that a little-known data broker named <strong>Securus</strong> was selling local police forces around the country the ability to look up the precise location of any cell phone across all of the major U.S. mobile networks.</p>
<p>Then it emerged that Securus had been hacked, its database of hundreds of law enforcement officer usernames and passwords plundered. We also learned that Securus’ data was ultimately obtained from a company called <strong>3Cinteractive</strong>, which in turn obtained its data through a California-based location tracking firm called <strong>LocationSmart</strong>.</p>
<p>On May 17, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">broke the news</a> of research by <strong>Carnegie Mellon University</strong> PhD student <strong>Robert Xiao</strong>, who discovered that a LocationSmart try-before-you-buy opt-in demo of the company’s technology was wide open — allowing real-time lookups from anyone on anyone’s mobile device — without any sort of authentication, consent or authorization.</p>
<p>LocationSmart disabled its demo page shortly after that story. By that time, <strong>Sen. Ron Wyden</strong> (D-Ore.) had already sent letters to <strong>AT&amp;T</strong>, <strong>Sprint</strong>, <strong>T-Mobile</strong> and Verizon, asking them to detail any agreements to share real-time customer location data with third-party data aggregation firms.</p>
<p>AT&amp;T, T-Mobile and Verizon all said they had terminated data-sharing agreements with Securus. In <a href="media/42841057.Sprint20Letter20to20Sen.20Wyden206.15.18.pdf" data-original-source="https://www.wyden.senate.gov/imo/media/doc/Sprint%20Letter%20to%20Sen.%20Wyden%206.15.18.pdf" target="_blank" rel="noopener">a written response</a> (PDF) to Sen. Wyden, Sprint declined to share any information about third-parties with which it may share customer location data, and it was the only one of the four carriers that didn&#8217;t say it was terminating any data-sharing agreements.</p>
<p>T-Mobile and Verizon each said they both share real-time customer data with two companies &#8212; LocationSmart and another firm called <a href="https://www.zumigo.com/" target="_blank" rel="noopener">Zumigo,</a> noting that these companies in turn provide services to a total of approximately 75 other customers.</p>
<p>Verizon emphasized that Zumigo &#8212; unlike LocationSmart &#8212; has never offered any kind of mobile location information demo service via its site. Nevertheless, Verizon said it had decided to terminate its current location aggregation arrangements with both LocationSmart and Zumigo.</p>
<p>&#8220;Verizon has notified these location aggregators that it intends to terminate their ability to access and use our customers&#8217; location data as soon as possible,&#8221; <a href="media/3b442498.Verizon20Response20to20Sen20Wyden2006_15_18.pdf" data-original-source="https://www.wyden.senate.gov/imo/media/doc/Verizon%20Response%20to%20Sen%20Wyden%2006_15_18.pdf" target="_blank" rel="noopener">wrote</a> <strong>Karen Zacharia</strong>, Verizon&#8217;s chief privacy officer. &#8220;We recognize that location information can provide many pro-consumer benefits. But our review of our location aggregator program has led to a number of internal questions about how best to protect our customers&#8217; data. We will not enter into new location aggregation arrangements unless and until we are comfortable that we can adequately protect our customers&#8217; location data through technological advancements and/or other practices.&#8221;</p>
<p>In <a href="media/d0c93c82.atampt20letter20to20RW206.15.pdf" data-original-source="https://www.wyden.senate.gov/imo/media/doc/at&amp;t%20letter%20to%20RW%206.15.pdf" target="_blank" rel="noopener">its response</a> (PDF), AT&amp;T made no mention of any other company besides Securus. AT&amp;T indicated it had no intention to stop sharing real-time location data with third-parties, stating that &#8220;without an aggregator, there would be no practical and efficient method to facilitate requests across different carriers.&#8221;</p>
<p>Sen. Wyden issued a statement today calling on all wireless companies to follow Verizon&#8217;s lead.</p>
<p>“Verizon deserves credit for taking quick action to protect its customers’ privacy and security,” Wyden said. “After my investigation and follow-up reports revealed that middlemen are selling Americans’ location to the highest bidder without their consent, or making it available on insecure web portals, Verizon did the responsible thing and promptly announced it was cutting these companies off. In contrast, AT&amp;T, T-Mobile, and Sprint seem content to continuing to sell their customers’ private information to these shady middle men, Americans’ privacy be damned.”<span id="more-44291"></span></p>
<p>Wyden&#8217;s letter asked the carriers to detail any arrangements they may have to validate that location aggregators are in fact gaining customer consent before divulging the information. Both Sprint and T-Mobile said location aggregators were contractually obligated to obtain customer consent before sharing the data, but they provided few details about any programs in place to review claims and evidence that an aggregator has obtained consent.</p>
<p>AT&amp;T and Verizon each said they have processes for periodically auditing consent practices by the location aggregators, but that Securus&#8217; unauthorized use of the data somehow flew under the radar.</p>
<p>AT&amp;T noted that it began its relationship with LocationSmart in October 2012 (back when it was known by another name, &#8220;Locaid&#8221;).  Under that agreement, LocationSmart&#8217;s customer 3Cinteractive would share location information with prison officials through prison telecommunications provider Securus, which operates a prison inmate calling service.</p>
<p>But AT&amp;T said after Locaid was granted that access, Securus began abusing it to sell an unauthorized &#8220;on-demand service&#8221; that allowed police departments to learn the real-time location data of any customer of the four major providers.</p>
<p>&#8220;We now understand that, despite AT&amp;T&#8217;s requirements to obtain customer consent, Securus did not in fact obtain customer consent before collecting customers&#8217; location information for its on-demand service,&#8221; wrote <strong>Timothy P. McKone</strong>, executive vice president of federal relations at AT&amp;T. &#8220;Instead, Securus evidently relied upon law enforcement&#8217;s representation that it had appropriate legal authority to obtain customer location data, such as a warrant, court order, or other authorizing document as a proxy for customer consent.&#8221;</p>
<p>McKone&#8217;s letter downplays the severity of the Securus incident, saying that the on-demand location requests &#8220;comprised a tiny fraction &#8212; less than two tenths of one percent &#8212; of the total requests Securus submitted for the approved inmate calling service. AT&amp;T has no reason to believe that there are other instances of unauthorized access to AT&amp;T customer location data.&#8221;</p>
<p><strong>Blake Reid</strong>, an associate clinical professor at the <strong>University of Colorado School of Law</strong>, said the entire mobile location-sharing debacle shows the futility of transitive trust.</p>
<p>&#8220;The carriers basically have arrangements with these location aggregators that contractually say, &#8216;You agree not to use this access we provide you without getting customer consent&#8217;,&#8221; Reid said. &#8220;Then that aggregator has a relationship with another aggregator, and so on. So what we then have is this long chain of trust where no one has ever consented to the provision of the location information, and yet it ends up getting disclosed anyhow.&#8221;</p>
<p>Curious how we got here and what Congress or federal regulators might do about the current situation? Check out last month&#8217;s story, <a href="https://krebsonsecurity.com/2018/05/why-is-your-location-data-no-longer-private/" target="_blank" rel="noopener">Why Is Your Location Data No Longer Private</a>.</p>


feed_id: https://krebsonsecurity.com/?p=44317
title: Supreme Court: Police Need Warrant for Mobile Location Data
uri: Supreme-Court-Police-Need-Warrant-for-Mobile-Location-Data
url: https://krebsonsecurity.com/2018/06/supreme-court-police-need-warrant-for-mobile-location-data/
content:
<p>The <strong>U.S. Supreme Court</strong> today ruled that the government needs to obtain a court-ordered warrant to gather location data on mobile device users. The decision is a major development for privacy rights, but experts say it may have limited bearing on the selling of real-time customer location data by the wireless carriers to third-party companies.</p>
<div id="attachment_44320" style="width: 603px" class="wp-caption aligncenter"><img class="wp-image-44320 " src="media/850050d3.scotus-smaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/scotus-smaller.png" alt="" width="593" height="415" /><p class="wp-caption-text">Image: Wikipedia.</p></div>
<p>At issue is <em><a href="https://en.wikipedia.org/wiki/Carpenter_v._United_States" target="_blank" rel="noopener">Carpenter v. United States</a></em>, which challenged a legal theory the Supreme Court outlined more than 40 years ago known as the &#8220;<a href="https://en.wikipedia.org/wiki/Third-party_doctrine" target="_blank" rel="noopener">third-party doctrine</a>.&#8221; The doctrine holds that people who voluntarily give information to third parties &#8212; such as banks, phone companies, email providers or Internet service providers (ISPs) &#8212; have &#8220;no reasonable expectation of privacy.&#8221;</p>
<p>That framework in recent years has been interpreted to allow police and federal investigators to obtain information &#8212; such as mobile location data &#8212; from third parties without a warrant. But in a 5-4 ruling issued today that flies in the face of the third-party doctrine, the Supreme Court cited &#8220;seismic shifts in digital technology&#8221; allowing wireless carriers to collect &#8220;deeply revealing&#8221; information about mobile users that should be protected by the <a href="https://www.law.cornell.edu/constitution/fourth_amendment" target="_blank" rel="noopener">4th Amendment to the U.S. Constitution</a>, which is intended to shield Americans against unreasonable searches and seizures by the government.</p>
<p><strong>Amy Howe</strong>, a reporter for <strong>SCOTUSblog.com</strong>, <a href="http://www.scotusblog.com/2018/06/opinion-analysis-court-holds-that-police-will-generally-need-a-warrant-for-cellphone-location-information/" target="_blank" rel="noopener">writes</a> that the decision means police will generally need to get a warrant to obtain cell-site location information, a record of the cell towers (or other sites) with which a cellphone connected.</p>
<p>The ruling is no doubt a big win for privacy advocates, but many readers have been asking whether this case has any bearing on the sharing or selling of real-time customer location data by the mobile providers to third party companies. Last month, <em>The New York times</em> <a href="https://www.nytimes.com/2018/05/10/technology/cellphone-tracking-law-enforcement.html" target="_blank" rel="noopener">revealed</a> that a company called <strong>Securus Technologies</strong> had been selling this highly sensitive real-time location information to local police forces across the United States, thanks to agreements the company had in place with the major mobile providers.</p>
<p>It soon emerged that Securus was getting its location data second-hand through a company called <strong>3Cinteractive</strong>, which in turn was reselling data from California-based &#8220;location aggregator&#8221; <strong>LocationSmart</strong>. Roughly two weeks after The Times&#8217; scoop, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked-location-data-for-customers-of-all-major-u-s-mobile-carriers-in-real-time-via-its-web-site/" target="_blank" rel="noopener">broke the news</a> that anyone could look up the real time location data for virtually any phone number assigned by the major carriers, using a buggy try-before-you-buy demo page that LocationSmart had made available online for years to showcase its technology.</p>
<p>Since those scandals broke, LocationSmart disabled its promiscuous demo page. More importantly, <strong>AT&amp;T</strong>, <strong>Sprint</strong>, <strong>T-Mobile</strong> and <strong>Verizon</strong> all have said they are now in the process of <a href="https://krebsonsecurity.com/2018/06/verizon-to-stop-sharing-customer-location-data-with-third-parties/" target="_blank" rel="noopener">terminating agreements with third-parties to share this real-time location data</a>.</p>
<p>Still, there is no law preventing the mobile providers from hashing out new deals to sell this data going forward, and many readers here have expressed concerns that the carriers can and eventually will do exactly that.</p>
<p>So the question is: Does today&#8217;s Supreme Court ruling have any bearing whatsoever on mobile providers sharing location data with private companies?</p>
<p>According to SCOTUSblog&#8217;s Howe, the answer is probably &#8220;no.&#8221;</p>
<p>“[Justice] Roberts emphasized that today’s ruling &#8216;is a narrow one&#8217; that applies only to cell-site location records,&#8221; Howe writes. <em>&#8220;He took pains to point out that the ruling did not &#8216;express a view on matters not before us&#8217; – such as obtaining cell-site location records in real time, or getting information about all of the phones that connected to a particular tower at a particular time</em>. He acknowledged that law-enforcement officials might still be able to obtain cell-site location records without a warrant in emergencies, to deal with &#8216;bomb threats, active shootings, and child abductions.'&#8221;<span id="more-44317"></span></p>
<p>However, today&#8217;s decision by the high court may have implications for companies like Securus which have marketed the ability to provide real-time mobile location data to law enforcement officials, according to <strong>Jennifer Lynch</strong>, a senior staff attorney with the <a href="https://www.eff.org" target="_blank" rel="noopener">Electronic Frontier Foundation</a>, a nonprofit digital rights advocacy group.</p>
<p>&#8220;The court clearly recognizes the &#8216;deeply revealing nature&#8217; of location data and recognizes we have a privacy interest in this kind of information, even when it’s collected by a third party (the phone companies),&#8221; Lynch wrote in an email to KrebsOnSecurity. &#8220;I think Carpenter would have implications for the Securus context where the phone companies were sharing location data with non-government third parties that were then, themselves, making that data available to the government.&#8221;</p>
<p>Lynch said that in those circumstances, there is a strong argument the government would need to get a warrant to access the data (even if the information didn’t come directly from the phone company).</p>
<p>&#8220;However, Carpenter’s impact in other contexts — specifically in contexts where the government is not involved — is much less clear,&#8221; she added. &#8220;Currently, there aren’t any federal laws that would prevent phone companies from sharing data with non-government third parties, and the Fourth Amendment would not apply in that context.&#8221;</p>
<p>And there&#8217;s the rub: There is nothing in the current law that prevents mobile companies from sharing real-time location data with other commercial entities. For that reality to change, Congress would need to act. For more on the prospects of that happening and how we wound up here, check out my May 26 story, <a href="https://krebsonsecurity.com/2018/05/why-is-your-location-data-no-longer-private/" target="_blank" rel="noopener">Why is Your Location Data No Longer Private?</a></p>
<p>The full Supreme Court opinion in <em>Carpenter v. United States</em> is available <a href="media/a24a9e79.16-402_h315.pdf" data-original-source="https://www.supremecourt.gov/opinions/17pdf/16-402_h315.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=44332
title: How to Avoid Card Skimmers at the Pump
uri: How-to-Avoid-Card-Skimmers-at-the-Pump
url: https://krebsonsecurity.com/2018/06/how-to-avoid-card-skimmers-at-the-pump/
content:
<p>Previous stories here on the proliferation of card-skimming devices hidden inside fuel pumps have offered a multitude of security tips for readers looking to minimize their chances of becoming the next victim, such as favoring filling stations that use security cameras and tamper-evident tape on their pumps. But according to police in San Antonio, Texas, there are far more reliable ways to avoid getting skimmed at a fuel station.</p>
<p>San Antonio, like most major U.S. cities, is grappling with a surge in pump skimming scams. So far in 2018, the <strong>San Antonio Police Department</strong> (SAPD) has found more than 100 skimming devices in area fuel pumps, and that figure already eclipses the total number of skimmers found in the area in 2017. The skimmers are hidden inside of the pumps, and there are often few if any outward signs that a pump has been compromised.</p>
<p>In virtually all cases investigated by the SAPD, the incidents occurred at filling stations using older-model pumps that have not yet been upgraded with physical and digital security features which make it far more difficult for skimmer thieves to tamper with fuel pumps and siphon customer card data (and PINs from debit card users).</p>
<p><strong>Lt. Marcus Booth</strong> is the financial crimes unit director for the SAPD. Booth said most filling stations in San Antonio and elsewhere use legacy pumps that have a vertical card reader and a flat, membrane-based keypad. In addition, access to the insides of these older pumps frequently is secured via a master key that opens not only all pumps at a given station, but in many cases all pumps of a given model made by the same manufacturer.</p>
<div id="attachment_44335" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/39437922.olderpump.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/olderpump.png"><img class="wp-image-44335" src="media/39437922.olderpump.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/olderpump.png" alt="" width="598" height="389" /></a><p class="wp-caption-text">Older model fuel pumps like this one feature a flat, membrane-based keypad and vertical card reader. Image: SAPD.</p></div>
<p>In contrast, Booth said, newer and more secure pumps typically feature a horizontal card acceptance slot along with a raised metallic keypad &#8212; much like a traditional payphone keypad and referred to in the fuel industry as a &#8220;full travel&#8221; keypad:</p>
<div id="attachment_44334" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/6306da19.newerpump.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/newerpump.png"><img class="wp-image-44334 size-full" src="media/6306da19.newerpump.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/newerpump.png" alt="" width="599" height="454" /></a><p class="wp-caption-text">Newer, more tamper-resistant fuel pumps include raised metallic keypads (known in the industry as &#8220;full travel&#8221; keypads), horizontal card readers and custom locks for each pump.</p></div>
<p>Booth said the SAPD has yet to see a skimming incident involving newer pump models like the one pictured directly above.</p>
<p>&#8220;Here in San Antonio, many of these stations with these older keypads and card slots were getting hit all the time, sometimes weekly,&#8221; he said. &#8220;But as soon as those went over to newer gear, we&#8217;ve seen zero problems.&#8221;</p>
<p>According to Booth, the newer pumps include not only custom keys for each pump, but also tamper protections that physically shut down a pump if the machine is improperly accessed. What&#8217;s more, these more advanced pumps do a better job of compartmentalizing individual components, very often enclosing the electronics that serve the card reader and keypad in separately secured metal cages.</p>
<p>&#8220;Pretty much all these full travel metallic keypads are encrypted, and if you disconnect them they disable themselves and can only be re-enabled by technician,&#8221; Booth told KrebsOnSecurity. &#8220;Also, if the pump is opened improperly, it disables itself. These two specific items: The card reader or the pad, if you pull power to them they&#8217;re dead, and then they can only be re-enabled by an authorized technician.&#8221;</p>
<p>Newer pumps may also include more modern mobile payment options &#8212; such as <strong>Apple Pay</strong> &#8212; although many stations with pumps that advertise this capability have not yet enabled it, which allows customers to pay for fuel without ever sharing their credit or debit card account details with the fuel station.<span id="more-44332"></span></p>
<p>One reason that pump skimmers seem to be more pervasive is that authorities across the country are doing a better job of working with banks and federal investigators to determine fuel stations that appear to be compromised. The flip side is that thieves are generally opportunistic, and tend to focus on targeting systems that offer the least resistance and lowest hanging fruit.</p>
<p>Unfortunately, there is still a ton of low-hanging fruit, and these newer and more secure pump systems remain the exception rather than the rule, Booth said. In December 2016, <strong>Visa</strong> <a href="https://krebsonsecurity.com/2016/12/visa-delays-chip-deadline-for-pumps-to-2020/" target="_blank" rel="noopener">delayed by three years</a> a deadline for fuel station owners to install payment terminals at the pump that are capable of handling more secure chip-based cards. The chip card technology standard, also known as <strong>EMV</strong> (short for <a href="https://en.wikipedia.org/wiki/EMV" target="_blank" rel="noopener">Europay, MasterCard and Visa</a>) makes credit and debit cards far more expensive and difficult for thieves to clone.</p>
<p>Under previous credit card association rules, station owners that didn’t have chip-ready readers in place by Oct. 2017 would have been on the hook to absorb 100 percent of the costs of fraud associated with transactions in which the customer presented a chip-based card yet was not asked or able to dip the chip (currently, card-issuing banks eat most of the fraud costs from fuel skimming). Currently, fuel stations have until Oct. 1, 2020 to meet the liability shift deadline.</p>
<p>Some pump skimming devices are <a href="https://krebsonsecurity.com/2013/07/dont-get-sucker-pumped/" target="_blank" rel="noopener">capable of stealing debit card PINs as well</a>, <em>so it’s a good idea to avoid paying with a debit card at the pump</em>. Armed with your PIN and debit card data, thieves can clone the card and pull money out of your account at an ATM. Having your checking account emptied of cash while your bank sorts out the situation can be a huge hassle and create secondary problems (bounced checks, for instance).</p>
<p>This advice often runs counter to the messaging pushed by fuel station owners themselves, many of whom offer lower prices for cash or debit card transactions. That&#8217;s because credit card transactions typically are more expensive to process.</p>
<p>In summary, if you have the choice, look for fuel pumps with raised keypads <em>and</em> horizontal card slots. And keep in mind that it may not be the best idea to frequent a particular filling station simply because it offers the lowest prices: Doing so could leave you with hidden costs down the road.</p>
<p>If you enjoyed this story, check out my series on all things skimmer-related: <a href="https://krebsonsecurity.com/all-about-skimmers/" target="_blank" rel="noopener">All About Skimmers</a>. Looking for more information on fuel pump skimming? Have a look at <a href="https://krebsonsecurity.com/?s=fuel+skimming&amp;x=0&amp;y=0" target="_blank" rel="noopener">some of these stories</a>.</p>


feed_id: https://krebsonsecurity.com/?p=43661
title: Plant Your Flag, Mark Your Territory
uri: Plant-Your-Flag-Mark-Your-Territory
url: https://krebsonsecurity.com/2018/06/plant-your-flag-mark-your-territory/
content:
<p>Many people, particularly older folks, proudly declare they avoid using the Web to manage various accounts tied to their personal and financial data &#8212; including everything from utilities and mobile phones to retirement benefits and online banking services. The reasoning behind this strategy is as simple as it is alluring: What&#8217;s not put online can&#8217;t be hacked. But increasingly, adherents to this mantra are finding out the hard way that if you don&#8217;t plant your flag online, fraudsters and identity thieves may do it for you.</p>
<p>The crux of the problem is that while most types of customer accounts these days can be managed online, the process of tying one&#8217;s account number to a specific email address and/or mobile device typically involves supplying personal data that can easily be found or purchased online &#8212; such as Social Security numbers, birthdays and addresses.</p>
<p><img class="aligncenter size-full wp-image-44352" src="media/d725a83f.plantflag.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/06/plantflag.png" alt="" width="528" height="360" /></p>
<p>Some examples of how being a modern-day <a href="https://www.merriam-webster.com/dictionary/Luddite" target="_blank" rel="noopener">Luddite</a> can backfire are well-documented, such as when scammers create online accounts in someone&#8217;s name at the <a href="https://krebsonsecurity.com/2015/03/sign-up-at-irs-gov-before-crooks-do-it-for-you/" target="_blank" rel="noopener">Internal Revenue Service</a>, the <a href="https://krebsonsecurity.com/2018/02/usps-finally-starts-notifying-you-by-mail-if-someone-is-scanning-your-snail-mail-online/" target="_blank" rel="noopener">U.S. Postal Service</a> or the <a href="https://krebsonsecurity.com/2013/09/crooks-hijack-retirement-funds-via-ssa-portal/" target="_blank" rel="noopener">Social Security Administration</a>.</p>
<p>Other examples may be far less obvious. Consider the case of a consumer who receives their home telephone service as part of a bundle through their broadband Internet service provider (ISP). Failing to set up a corresponding online account to manage one&#8217;s telecommunications services can provide a powerful gateway for fraudsters.</p>
<p><strong>Carrie Kerskie</strong> is president of <a href="https://www.griffonforce.com/" target="_blank" rel="noopener">Griffon Force LLC</a>, a company in Naples, Fla. that helps identity theft victims recover from fraud incidents. Kerskie recalled a recent case in which thieves purchased pricey items from a local jewelry store in the name of an elderly client who&#8217;d previously bought items at that location as gifts for his late wife.</p>
<p>In that incident, the perpetrator presented a MasterCard Black Card in the victim&#8217;s name along with a fake ID created in the victim&#8217;s name (but with the thief&#8217;s photo). When the jewelry store called the number on file to verify the transactions, the call came through to the impostor&#8217;s cell phone right there in the store.</p>
<p>Kerskie said a follow-up investigation revealed that the client had never set up an account at his ISP (Comcast) to manage it online. Multiple calls with the ISP&#8217;s customer support people revealed that someone had recently called Comcast pretending to be the 86-year-old client and established an online account.</p>
<p>&#8220;The victim never set up his account online, and the bad guy called Comcast and gave the victim&#8217;s name, address and Social Security number along with an email address,&#8221; Kerskie said. &#8220;Once that was set up, the bad guy logged in to the account and forwarded the victim&#8217;s calls to another number.&#8221;</p>
<p>Incredibly, Kerskie said, the fraudster immediately called Comcast to ask about the reason for the sudden account changes.</p>
<p>&#8220;While I was on the phone with Comcast, the customer rep told me to hold on a minute, that she&#8217;d just received a communication from the victim,&#8221; Kerskie recalled. &#8220;I told the rep that the client was sitting right beside me at the time, and that the call wasn&#8217;t from him. The minute we changed the call forwarding options, the fraudster called customer service to ask why the account had been changed.&#8221;</p>
<p>Two to three days after Kerskie helped the client clean up fraud with the Comcast account, she got a frantic call from the client&#8217;s daughter, who said she&#8217;d been trying her dad&#8217;s mobile phone but that he hadn&#8217;t answered in days. They soon discovered that dear old dad was just fine, but that he&#8217;d also neglected to set up an online account at his mobile phone provider.</p>
<p>&#8220;The bad guy had called in to the mobile carrier, provided his personal details, and established an online account,&#8221; Kerskie said. &#8220;Once they did that, they were able transfer his phone service to a new device.&#8221;</p>
<h4>OFFLINE BANKING</h4>
<p>Many people naively believe that if they never set up their bank or retirement accounts for online access then cyber thieves can&#8217;t get access either. But Kerskie said she recently had a client who had almost a quarter of a million dollars taken from his bank account precisely because he declined to link his bank account to an online identity.</p>
<p>&#8220;What we found is that the attacker linked the client&#8217;s bank account to an American Express Gift card, but in order to do that the bad guy had to know the exact amount of the microdeposit that AMEX placed in his account,&#8221; Kerskie said. &#8220;So the bad guy called the 800 number for the victim&#8217;s bank, provided the client&#8217;s name, date of birth, and Social Security number, and then gave them an email address he controlled. In this case, had the client established an online account previously, he would have received a message asking to confirm the fraudulent transaction.&#8221;</p>
<p>After tying the victim&#8217;s bank account to a prepaid card, the fraudster began slowly withdrawing funds in $5,000 increments. All told, thieves managed to siphon almost $170,000 over a six month period. The victim&#8217;s accounts were being managed by a trusted acquaintance, but the withdrawals didn&#8217;t raise alarms because they were roughly in line with withdrawal amounts the victim had made previously.</p>
<p>&#8220;But because the victim didn&#8217;t notify the bank within 60 days of the fraudulent transactions as required by law, the bank only had to refund the last 60 days worth of fraudulent transactions,&#8221; Kerskie said. &#8220;We were ultimately able to help him recover most of it, but that was a whole other ordeal.&#8221;<span id="more-43661"></span></p>
<p>Kerskie said many companies try to fight fraud on accounts belonging to customers who haven&#8217;t set up a corresponding online account by sending a letter via snail mail to those customers when account changes are made.</p>
<p>&#8220;But not everyone does that and if the thief who&#8217;s taking advantage of the situation is smart, he&#8217;ll simply set up an online account and change the billing address, so the customer never gets that notice,&#8221; Kerskie said.</p>
<p><H4>MARK YOUR TERRITORY</H4></p>
<p>Kerskie said it&#8217;s a good idea for people with older relatives to help those individuals ensure they have set up and manage online identities for their various accounts &#8212; <em>even if those relatives never intend to access any of the accounts online</em>. Helping those relatives <a href="https://krebsonsecurity.com/2015/06/how-i-learned-to-stop-worrying-and-embrace-the-security-freeze/" target="_blank" rel="noopener">place a security freeze on their credit files</a> with the four major credit bureaus (and with another, <a href="https://krebsonsecurity.com/2018/05/another-credit-freeze-target-nctue-com/" target="_blank" rel="noopener">little known bureau that many mobile providers rely upon for credit checks</a>) can go a long way toward preventing new account fraud.</p>
<p>Adding two-factor authentication (<a href="https://www.twofactorauth.org" target="_blank" rel="noopener">whenever it is available</a>) and/or establishing a customer-specific personal identification number (PIN) also can help secure online access. For those who can&#8217;t be convinced to use a password manager, even writing down all of the account details and passwords on a slip of paper can be helpful, provided the document is secured in a safe place.</p>
<p>This process is doubly important, Kerskie said, for parents and relatives who have just lost a spouse.</p>
<p>&#8220;When someone passes away, there&#8217;s often an obituary in the paper that offers a great deal of information about the deceased and any surviving family members,&#8221; she said. &#8220;And the bad guys absolutely love obits.&#8221;</p>
<p>Eschewing accounts on popular social media platforms also can have consequences, mainly because most people have enough information about themselves online that anyone can create an account in their name and start messaging friends and family members with various fraud schemes.</p>
<p>&#8220;I always tell people if you don&#8217;t want to set up an online account for social media that&#8217;s fine, but make sure you tell your friends and family, &#8216;If you ever get a social media request from me, just ignore it because I&#8217;ll never do that,'&#8221; Kerskie advised.</p>
<p>In summary, plant your flag online or &#8212; as Kerskie puts it &#8212; &#8220;mark your territory&#8221; &#8212; before fraudsters do it for you. And consider helping less Internet-savvy friends and family members to do the same.</p>
<p>&#8220;It can save a lot of headache,&#8221; she said. &#8220;The sad reality is that criminals very often only need to answer two or three questions to commit fraud in your name, whereas victims typically need to spend hours of their time and answer dozens of questions to undo the resulting fraud.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=44363
title: ExxonMobil Bungles Rewards Card Debut
uri: ExxonMobil-Bungles-Rewards-Card-Debut
url: https://krebsonsecurity.com/2018/07/exxonmobil-bungles-rewards-card-debut/
content:
<p>Energy giant <strong>ExxonMobil</strong> recently sent snail mail letters to its <a href="https://www.exxon.com/en/plenti" target="_blank" rel="noopener">Plenti rewards card</a> members stating that the points program was being replaced with a new one called <strong>Exxon Mobil Rewards+</strong>. Unfortunately, the letter includes a confusing toll free number and directs customers to a parked page that tries to foist Web browser extensions on visitors.</p>
<p>The mailer (the first page of which is screenshotted below) urges customers to visit exxonmobilrewardsplus[dot]com, to download its mobile app, and to call &#8220;1-888-REWARD+&#8221; with any questions. It may not be immediately obvious, but that &#8220;+&#8221; sign is actually the same thing as a zero on the telephone keypad (although I&#8217;m ashamed to say I had to look that up online to be sure). <a class="lightbox" href="media/2fcdec7b.exxonmobmailer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/exxonmobmailer.png"><img class="aligncenter wp-image-44365" src="media/2fcdec7b.exxonmobmailer.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/exxonmobmailer.png" alt="" width="570" height="408" /></a></p>
<p>Anyone curious enough to guess at other ending numbers other than zero will wind up at a call center advertising &#8220;free&#8221; Caribbean (1) cruises or at a pricey adult chat service dubbed &#8220;America&#8217;s hottest talk line&#8221; (6).</p>
<p>Worse, visiting the company&#8217;s new rewards Web site in Google Chrome prompted my browser to run a &#8220;security check,&#8221; followed by a series of popups offering to install a Chrome extension called &#8220;Browsing Safely.&#8221;</p>
<p>That extension changes your default search engine to Yahoo and appears to redirect all searches through a domain called lastlog[dot]in, which seems to be affiliated with <a href="https://intango.com/advertiser/" target="_blank" rel="noopener">an Israeli online advertising network</a>. After adding the Browsing Safely extension to Chrome using a virtual machine, my browser was redirected to Exxon.com.</p>
<div id="attachment_44366" style="width: 606px" class="wp-caption aligncenter"><img class=" wp-image-44366" src="media/7bd55455.exxonchromeext.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/exxonchromeext.png" alt="" width="596" height="311" /><p class="wp-caption-text">The Google Chrome extension offered when I first visited exxonmobilrewardsplus-dot-com.</p></div>
<p>Many people on Twitter who expressed confusion about the mailer said they accidentally added an &#8220;e&#8221; to the end of &#8220;exxonmobil&#8221; and ended up getting bounced around to spammy-looking sites with ad redirects and dodgy download offers.</p>
<p>ExxonMobil corporate has not yet responded to requests for comment. But after about 10 minutes on hold listening to the same Muzak-like song, I was able to reach a customer service person at the confusing ExxonMobil Rewards+ phone number. That person said the Web site for the rewards program wasn&#8217;t going to be active until July 11.</p>
<p>&#8220;Currently the Web site is not available,&#8221; the representative said. &#8220;Please don&#8217;t try to download anything from it right now. It should be active and available next week.&#8221;</p>
<p>It always amazes me when major companies roll out new marketing initiatives without consulting professionals who help mitigate security and privacy issues for a living. It seems likely that happened in this case because anyone who knows a thing or two about security would strongly advise against instructing customers to visit a parked domain or one that isn&#8217;t yet fully under the company&#8217;s control.</p>


feed_id: https://krebsonsecurity.com/?p=44375
title: Patch Tuesday, July 2018 Edition
uri: Patch-Tuesday-July-2018-Edition
url: https://krebsonsecurity.com/2018/07/patch-tuesday-july-2018-edition/
content:
<p><strong>Microsoft</strong> and <strong>Adobe</strong> each issued security updates for their products today. Microsoft&#8217;s July patch batch includes 14 updates to fix more than 50 security flaws in <strong>Windows</strong> and associated software. Separately, Adobe has pushed out an update for its <strong>Flash Player </strong>browser plugin, as well as a monster patch bundle for <strong>Adobe Reader/Acrobat</strong>.</p>
<p><img class="alignright  wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="212" height="222" />According to security firm <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/07/10/july-patch-tuesday-critical-browser-patches-lazy-fp-exchange-adobe-vulns" target="_blank" rel="noopener">Qualys</a>, all but two of the &#8220;critical&#8221; fixes in this round of updates apply to vulnerabilities in Microsoft&#8217;s browsers &#8212; <strong>Internet Explorer</strong> and <strong>Edge</strong>. Critical patches mend software flaws that can be exploited remotely by malicious software or bad guys with little to no help from the user, save for perhaps visiting a Web site or opening a booby-trapped link.</p>
<p>Microsoft also patched dangerous vulnerabilities in its <strong>.NET Framework</strong> (a Windows development platform required by many third-party programs and commonly found on most versions of Windows), as well as <strong>Microsoft Office</strong>. With both of these weaknesses, an attacker could trick a victim into opening an email that contained a specially crafted Office document which loads malicious code, says <strong>Allan Liska</strong>, a threat intelligence analyst at <a href="https://www.recordedfuture.com/" target="_blank" rel="noopener">Recorded Future</a>.</p>
<p>One of the more nettlesome features of Windows 10 is the operating system by default decides on its own when to install updates, very often shutting down open programs and restarting your PC in the middle of the night to do so unless you change the defaults.</p>
<p>Not infrequently, Redmond ships updates that end up causing stability issues for some users, and it doesn&#8217;t hurt to wait a day or two before seeing if any major problems are reported with new updates before installing them. Microsoft doesn’t make it easy for <strong>Windows 10</strong> users to change this setting, but <a href="https://www.howtogeek.com/224471/how-to-prevent-windows-10-from-automatically-downloading-updates/" target="_blank" rel="noopener">it is possible</a>. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in <strong>Windows Update</strong>.<span id="more-44375"></span></p>
<p>It’s a good idea to get in the habit of backing up your computer before applying monthly updates from Microsoft. Windows has some built-in tools that can help recover from bad patches, but restoring the system to a backup image taken just before installing updates is often much less hassle and an added piece of mind while you’re sitting there praying for the machine to reboot successfully after patching.</p>
<p>As per usual on Microsoft&#8217;s Patch Tuesday, Adobe issued <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-24.html" target="_blank" rel="noopener">an update</a> to its Flash Player browser plugin. The latest update brings Flash to <em>version 30.0.0.134</em>, and patches at least two security vulnerabilities in the program. Microsoft&#8217;s patch bundle includes the Flash update as well.</p>
<p><img class="alignleft size-full wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="211" height="180" />Adobe says the Flash update addresses &#8220;critical&#8221; security holes, meaning they could be exploited by malware or miscreants to take complete, remote control over vulnerable systems. My standard advice is for readers to kick Flash to the curb, as it&#8217;s a buggy program that is a perennial favorite target of malware purveyors.</p>
<p>For readers still unwilling to cut the Flash cord, there are half-measures that work almost as well. Fortunately, <a href="https://support.google.com/chrome/answer/108086?hl=en" target="_blank" rel="noopener">disabling Flash in Chrome</a> is simple enough. Paste “<a href="chrome://settings/content" target="_blank" rel="noopener">chrome://settings/content</a>” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>By default, <strong>Mozilla Firefox</strong> on Windows computers with Flash installed runs Flash in a “<a href="http://blogs.adobe.com/security/2012/06/inside-flash-player-protected-mode-for-firefox.html" target="_blank" rel="noopener">protected mode</a>,” which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.</p>
<p>Another, perhaps less elegant, alternative to wholesale junking Flash is keeping it installed in a browser that you don’t normally use, and then only using that browser on sites that require Flash.</p>
<p>If you use <strong>Adobe Reader</strong> or <strong>Acrobat</strong> to manage PDF documents, you&#8217;re probably going to want to update these products soon: Adobe <a href="https://helpx.adobe.com/security/products/acrobat/apsb18-21.html" target="_blank" rel="noopener">released updates</a> for both today that <em>fix more than 100 security vulnerabilities in the software titles</em>.</p>
<p>Some folks may be unaware that there are other free PDF readers which aren&#8217;t quite as bloated as Adobe&#8217;s. Whether these alternative readers are more secure is another question; they certainly seem to be updated less frequently, but that may have something to do with the fact that they include far fewer features and likely less overall attack surface area.</p>
<p>I can&#8217;t recall the last time I had Adobe Reader installed on anything I own. My preferred PDF reader for Windows is <a href="https://www.sumatrapdfreader.org/free-pdf-reader.html" target="_blank" rel="noopener">Sumatra PDF</a>, which is comparatively lightweight and very fast. Unfortunately, no matter how many times you change Sumatra to the default PDF reader on Windows 10, the operating system keeps defaulting to opening PDFs in Microsoft Edge.</p>
<p>For a detailed rundown of the individual vulnerabilities patched by Microsoft today, check out the <a href="https://isc.sans.edu/forums/diary/Microsoft+Patch+Tuesday+July+2018+now+with+Dashboard/23858/" target="_blank" rel="noopener">SANS Internet Storm Center</a>, which indexes the fixes by severity, how likely it is that each vulnerability will be exploited anytime soon, and whether specific flaws were publicly disclosed prior to today&#8217;s patch release.</p>
<p>According to SANS, at least three of the flaws &#8212; <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-8278" target="_blank" rel="noopener">CVE-2018-8278</a>, <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-8313" target="_blank" rel="noopener">CVE-2018-8313</a>, and <a href="https://nvd.nist.gov/vuln/detail/CVE-2018-8314" target="_blank" rel="noopener">CVE-2018-8314</a> &#8212; were previously disclosed publicly, meaning that attackers may have had a head start figuring out how to exploit these flaws for criminal gain.</p>
<p>As always, if you experience any problems installing or downloading these updates, please don&#8217;t hesitate to leave a comment. If past Patch Tuesday posts are any indicator, you may even find helpful responses or solutions from other readers experiencing the same issues.</p>


feed_id: https://krebsonsecurity.com/?p=44384
title: Notorious ‘Hijack Factory’ Shunned from Web
uri: Notorious-Hijack-Factory-Shunned-from-Web
url: https://krebsonsecurity.com/2018/07/notorious-hijack-factory-shunned-from-web/
content:
<p>Score one for the good guys: <strong><a href="https://www.bitcanal.com" target="_blank" rel="noopener">Bitcanal</a></strong>, a Portuguese Web hosting firm long accused of helping spammers hijack large swaths of dormant Internet address space over the years, was summarily kicked off the Internet this week after a half-dozen of the company&#8217;s bandwidth providers chose to sever ties with the company.</p>
<p><img class="aligncenter wp-image-44395" src="media/9cf86404.shunned.jpg" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/shunned.jpg" alt="" width="585" height="392" /></p>
<p>Spammers and Internet service providers (ISPs) that facilitate such activity often hijack Internet address ranges that have gone unused for periods of time. Dormant or “unannounced” address ranges are ripe for abuse partly because of the way the global routing system works: Miscreants can “announce” to the rest of the Internet that their hosting facilities are the authorized location for given Internet addresses. If nothing or nobody objects to the change, the Internet address ranges fall into the hands of the hijacker.</p>
<p>For years, security researchers have tracked the suspected theft of millions of <a href="https://en.wikipedia.org/wiki/IPv4" target="_blank" rel="noopener">IPv4 Internet addresses</a> back to Bitcanal, which was also doing business under the name &#8220;<strong>Ebony Horizon</strong>.&#8221; Experts say shortly after obtaining a chunk of IP addresses, Bitcanal would apparently sell or lease the space to spammers, who would then begin sending junk email from those addresses &#8212; taking full advantage of the good or at least neutral Internet reputation of the previous owner to evade anti-spam blacklists.</p>
<p>Much of the hijacked address space routed by Bitcanal was once assigned to business entities that no longer exist. But some of the more brazen hijacks attributed to Bitcanal and its customers involved thousands of Internet addresses assigned to active organizations, such as the company&#8217;s <a href="https://dyn.com/blog/latest-isps-to-hijack/" target="_blank" rel="noopener">well-documented acquisition of address space assigned to the Texas State Attorney General&#8217;s office</a>, as well as addresses managed by the <strong>U.S. Department of Defense</strong>.</p>
<p>Bitcanal&#8217;s reputation finally caught up with the company late last month, when anti-spam activist and researcher <strong>Ron Guilmette</strong> <a href="https://mailman.nanog.org/pipermail/nanog/2018-June/096034.html" target="_blank" rel="noopener">documented yet another new major IP address hijack</a> at the company and challenged Bitcanal&#8217;s upstream Internet providers to stop routing traffic for it (KrebsOnSecurity has published <a href="https://krebsonsecurity.com/?s=ip+address+hijack+guilmette&amp;x=0&amp;y=0" target="_blank" rel="noopener">several stories about previous high-profile IP address hijacks</a> involving spammers who were flagged by Guilmette).</p>
<p>Guilmette said Bitcanal and its proprietor &#8212; Portuguese businessman <a href="https://twitter.com/bitcanal" target="_blank" rel="noopener"><strong>Joao Silveira</strong></a> &#8212; have a well-documented history of &#8220;behaving badly and coloring outside the lines for literally years.&#8221;</p>
<p>&#8220;His actions in absconding with other people&#8217;s IP address space, over the years, are those of either a spoiled child or else those of a sociopath, depending on one&#8217;s personal point of view,&#8221; Guilmette said. &#8220;In either case the Internet will, by and large, be glad to see his backside, and will be better off without him.&#8221;</p>
<p><strong>Doug Madory</strong>, a researcher for Internet performance management firm <strong>Dyn</strong> (now owned by <strong>Oracle</strong>), published <a href="https://dyn.com/blog/shutting-down-the-bgp-hijack-factory/" target="_blank" rel="noopener">a blog post</a> chronicling Bitcanal&#8217;s history as an address &#8220;hijack factory.&#8221; That post also documents the gradual ostracization of Bitcanal over the past week, as one major Internet exchange after another pulled the plug on the company.</p>
<div id="attachment_44390" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/d1137a65.bitcanalbye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/bitcanalbye.png"><img class="wp-image-44390" src="media/d1137a65.bitcanalbye.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/bitcanalbye.png" alt="" width="595" height="254" /></a><p class="wp-caption-text">Dyn&#8217;s depiction of Bitcanal&#8217;s final remaining upstream Internet provider pulling the plug on the company on July 10, effectively severing it from existence on the Web. Source: Dyn.</p></div>
<p>Reached for comment just days before Bitcanal was shunned by all of its peering providers, Mr. Silveira expressed shock and surprise over what he called unfair attacks against his company&#8217;s reputation. He blamed the besmirchment on one or two &#8220;bad&#8221; customers who abused his service over the years.</p>
<p>&#8220;My thought is that one or two customer in my network maybe [imitated] people acting like a client and force the errors or injecting bad network space,&#8221; Silveira said in an emailed response to KrebsOnSecurity. &#8220;I am not the problem and this public trial and conviction will not solve the prefix hijacking matter. If these questions remain without solution, those actors will keep doing it.&#8221;<span id="more-44384"></span></p>
<p>Another business tied to Mr. Silveira suggests that Bitcanal/Ebony Horizon has long been actively involved in obtaining sizable chunks of Internet address space on behalf of its clients. The same contact phone number that once existed on the <a href="https://web.archive.org/web/20180330012205/http://bitcanal.com/" target="_blank" rel="noopener">(now unreachable) home page of Bitcanal.com</a> also appears on the homepage of <a href="http://ip4transfer.net" target="_blank" rel="noopener">ip4transfer.net</a>, a company that advertises the ability to lease large chunks of Internet address space.</p>
<div id="attachment_44394" style="width: 261px" class="wp-caption alignright"><img class=" wp-image-44394" src="media/a21c76d5.jsilveira.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/jsilveira.png" alt="" width="251" height="296" /><p class="wp-caption-text">Bitcanal owner Joao Silveira.</p></div>
<p>The current WHOIS registration records for ip4transfer.net are <a href="https://krebsonsecurity.com/2018/03/who-is-afraid-of-more-spams-and-scams/" target="_blank" rel="noopener">mostly redacted by domain registrar GoDaddy</a>, but the name Ebony Horizon appears as the current business name, and Mr. Silveira&#8217;s name is on the original domain registration records from 2016, according to historic WHOIS records maintained by <a href="https://www.domaintools.com" target="_blank" rel="noopener">DomainTools</a> [full disclosure: DomainTools is an advertiser on this blog].</p>
<p>Much of the content on ipv4transfer.net seeks to answer questions about what customers should expect when leasing address space from the company, including the possibility that some leased address ranges could be flagged as malicious or spammy by <strong>Spamhaus.org</strong>, an anti-spam group whose spam blacklists are relied upon by many ISPs to block large-scale spam campaigns. Prior to Bitcanal&#8217;s final disconnection this week, Spamhaus had blacklisted virtually all of Bitcanal&#8217;s address ranges as sources of spam and/or malicious email.</p>
<p>&#8220;Legitimate IP address space brokers don&#8217;t need to spend a lot of ink telling their customers how to avoid getting their shiny new IP address blocks listed by Spamhaus, or how to get them unlisted by Spamhaus, or what to do about it if the shiny new block they just purchased is already listed by Spamhaus,&#8221; Guilmette said.</p>
<p>Because the global routing of Internet address space is largely based on trust relationships between and among network operators, those operators have an obligation to ensure they&#8217;re not inadvertently facilitating the hijacking of Internet address space.</p>
<p>Perhaps coincidentally to the disconnection of Bitcanal, the <strong>RIPE Network Coordination Centre</strong> &#8212; one of the five global <a href="https://en.wikipedia.org/wiki/Regional_Internet_registry" target="_blank" rel="noopener">Regional Internet Registries</a> (RIRs) providing Internet address allocations &#8212; on July 10 <a href="https://labs.ripe.net/Members/alexander_azimov/bgp-flexibility-and-its-consequences" target="_blank" rel="noopener">published an analysis of route hijacking activity across the Internet</a>. The analysis includes a set of tips for network operators to help avoid contributing to the overall problem.</p>


feed_id: https://krebsonsecurity.com/?p=44406
title: Sextortion Scam Uses Recipient’s Hacked Passwords
uri: Sextortion-Scam-Uses-Recipient-s-Hacked-Passwords
url: https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/
content:
<p>Here&#8217;s a clever new twist on an old email scam that could serve to make the con far more believable. The message purports to have been sent from a hacker who&#8217;s compromised your computer and used your webcam to record a video of you while you were watching porn. The missive threatens to release the video to all your contacts unless you pay a Bitcoin ransom. The new twist? The email now references a real password previously tied to the recipient&#8217;s email address.</p>
<p><img class="aligncenter size-full wp-image-44412" src="media/4f452cd1.sextortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/sextortion.png" alt="" width="487" height="87" /></p>
<p>The basic elements of this <a href="https://www.fbi.gov/video-repository/newss-what-is-sextortion/view" target="_blank" rel="noopener">sextortion</a> scam email have been around for some time, and usually the only thing that changes with this particular message is the Bitcoin address that frightened targets can use to pay the amount demanded. But this one begins with an unusual opening salvo:</p>
<p>&#8220;I&#8217;m aware that &lt;substitute password formerly used by recipient here&gt; is your password,&#8221; reads the salutation.</p>
<p>The rest is formulaic:</p>
<blockquote><p>You don&#8217;t know me and you&#8217;re thinking why you received this e mail, right?</p>
<p>Well, I actually placed a malware on the <span class="il">porn</span> website and guess what, you visited this web site to have fun (you know what I mean). While you were watching the video, your web browser acted as a RDP (Remote Desktop) and a keylogger which provided me access to your display screen and webcam. Right after that, my software gathered all your contacts from your Messenger, Facebook account, and email account.</p>
<p>What exactly did I do?</p>
<p>I made a split-screen video. First part recorded the video you were viewing (you&#8217;ve got a fine taste haha), and next part recorded your webcam (Yep! It&#8217;s you doing nasty things!).</p>
<p>What should you do?</p>
<p>Well, I believe, $1400 is a fair price for our little secret. You&#8217;ll make the payment via Bitcoin to the below address (if you don&#8217;t know this, search &#8220;how to buy bitcoin&#8221; in Google).</p>
<p>BTC Address: 1Dvd7Wb72JBTbAcfTrxSJCZZuf4tsT<wbr />8V72<br />
(It is cAsE sensitive, so copy and paste it)</p>
<p>Important:</p>
<p>You have 24 hours in order to make the payment. (I have an unique pixel within this email message, and right now I know that you have read this email). If I don&#8217;t get the payment, I will send your video to all of your contacts including relatives, coworkers, and so forth. Nonetheless, if I do get paid, I will erase the video immidiately. If you want evidence, reply with &#8220;Yes!&#8221; and I will send your video recording to your 5 friends. This is a non-negotiable offer, so don&#8217;t waste my time and yours by replying to this email.</p></blockquote>
<p><span id="more-44406"></span>KrebsOnSecurity heard from three different readers who received a similar email in the past 72 hours. In every case, the recipients said the password referenced in the email&#8217;s opening sentence was in fact a password they had previously used at an account online that was tied to their email address.</p>
<p>However, all three recipients said the password was close to ten years old, and that none of the passwords cited in the sextortion email they received had been used anytime on their current computers.</p>
<p>It is likely that this improved sextortion attempt is at least semi-automated: My guess is that the perpetrator has created some kind of script that draws directly from the usernames and passwords from a given data breach at a popular Web site that happened more than a decade ago, and that every victim who had their password compromised as part of that breach is getting this same email at the address used to sign up at that hacked Web site.</p>
<p>I suspect that as this scam gets refined even more, perpetrators will begin using more recent and relevant passwords &#8212; and perhaps other personal data that can be found online &#8212; to convince people that the hacking threat is real. That&#8217;s because there are a number of <a href="https://krebsonsecurity.com/2018/01/canadian-police-charge-operator-of-hacked-password-service-leakedsource-com/" target="_blank" rel="noopener">shady password lookup services online</a> that index billions of usernames (i.e. email addresses) and passwords stolen in some of the biggest data breaches to date.</p>
<p>Alternatively, an industrious scammer could simply execute this scheme using a customer database from a freshly hacked Web site, emailing all users of that hacked site with a similar message and a current, working password. Tech support scammers also may begin latching onto this method as well.</p>
<p>Sextortion &#8212; even semi-automated scams like this one with no actual physical leverage to backstop the extortion demand &#8212; is a serious crime that can lead to devastating consequences for victims. Sextortion occurs when someone threatens to distribute your private and sensitive material if you don&#8217;t provide them with images of a sexual nature, sexual favors, or money.</p>
<p>According to the FBI, here are some things you can do to avoid becoming a victim:</p>
<p>-Never send compromising images of yourself to anyone, no matter who they are — or who they say they are.<br />
-Don&#8217;t open attachments from people you don&#8217;t know, and in general be wary of opening attachments even from those you do know.<br />
-Turn off [and/or cover] any web cameras when you are not using them.</p>
<p>The FBI says in many sextortion cases, the perpetrator is an adult pretending to be a teenager, and you are just one of the many victims being targeted by the same person. If you believe you’re a victim of sextortion, or know someone else who is, the FBI wants to hear from you: Contact your local FBI office (or toll-free at 1-800-CALL-FBI).</p>


feed_id: https://krebsonsecurity.com/?p=44424
title: ‘LuminosityLink RAT’ Author Pleads Guilty
uri: LuminosityLink-RAT-Author-Pleads-Guilty
url: https://krebsonsecurity.com/2018/07/luminositylink-rat-author-pleads-guilty/
content:
<p>A 21-year-old Kentucky man has pleaded guilty to authoring and distributing a popular hacking tool called &#8220;<strong>LuminosityLink</strong>,&#8221; a malware strain that security experts say was used by thousands of customers to gain unauthorized access to tens of thousands of computers across 78 countries worldwide.</p>
<div id="attachment_44426" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/ba733311.ll-ad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ll-ad.png"><img class="wp-image-44426" src="media/ba733311.ll-ad.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ll-ad.png" alt="" width="598" height="545" /></a><p class="wp-caption-text">The LuminosityLink Remote Access Tool (RAT) was sold for $40 to thousands of customers, who used the tool to gain unauthorized access to tens of thousands of computers worldwide.</p></div>
<p>Federal prosecutors say <strong>Colton Ray Grubbs</strong> of Stanford, Ky. conspired with others to market and distribute the LuminosityLink RAT, a $40 <strong>R</strong>emote <strong>A</strong>ccess <strong>T</strong>ool that made it simple for buyers to hack into computers to surreptitiously view documents, photographs and other files on victim PCs. The RAT also let users view what victims were typing on their keyboards, disable security software, and secretly activate the webcam on the target’s computer.</p>
<p>Grubbs, who went by the pseudonym &#8220;<strong>KFC Watermelon</strong>,&#8221; began selling the tool in May 2015. By mid-2017 he&#8217;d sold LuminosityLink to more than 8,600 customers, according to <a href="https://www.europol.europa.eu/newsroom/news/international-crackdown-anti-spyware-malware" target="_blank" rel="noopener">Europol</a>, the European Union&#8217;s law enforcement agency.</p>
<p>Speculation that Grubbs had been arrested began <a href="https://researchcenter.paloaltonetworks.com/2018/02/unit42-rat-trapped-luminositylink-falls-foul-vermin-eradication-efforts/" target="_blank" rel="noopener">surfacing last year</a> after KFC Watermelon stopped responding to customer support queries on <a href="https://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank" rel="noopener">Hackforums[dot]net</a>, the Web site where he primarily sold his product.</p>
<div id="attachment_44427" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/890bde6c.hf-ll.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/hf-ll.png"><img class="wp-image-44427" src="media/890bde6c.hf-ll.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/hf-ll.png" alt="" width="597" height="352" /></a><p class="wp-caption-text">Grubbs, using the hacker nickname &#8220;KFC Watermelon,&#8221; advertised and sold his RAT via Hackforums.net.</p></div>
<p>The sale and marketing of remote access tools, also known as remote administration tools, is not illegal in the United States, and indeed there are plenty of such tools sold by legitimate companies to help computer experts remotely administer computers.</p>
<p>However, these tools tend to be viewed by prosecutors instead as &#8220;<strong>R</strong>emote <strong>A</strong>ccess <strong>T</strong>rojans&#8221; when their proprietors advertise the programs as hacking devices and provide customer support aimed at helping buyers deploy the RATs stealthily and evade detection by anti-malware programs.</p>
<p>According to the indictment against him, Grubbs &#8220;recruited and encouraged co-conspirators to answer questions on Skype, an internet messaging service, from potential and actual purchasers of LuminosityLink seeking to use the software to get unauthorized and undetected access to victim computers and steal information.&#8221;</p>
<p>Linking Grubbs to LuminosityLink was likely not a tall hurdle for prosecutors. A <a href="https://opencorporates.com/companies/us_ky/0954545" target="_blank" rel="noopener">public filing</a> at the <strong>Kentucky Secretary of State</strong> office lists Grubbs as the owner of <strong>Luminosity Security Solutions LLC</strong>.</p>
<p>However, there are indications that Luminosity was not Grubb&#8217;s first foray into making and selling malware tools. According to <a href="https://researchcenter.paloaltonetworks.com/2018/02/unit42-rat-trapped-luminositylink-falls-foul-vermin-eradication-efforts/" target="_blank" rel="noopener">a February 2018 blog post</a> by <strong>Palo Alto Networks</strong>, the Skype account connected to KFC Watermelon&#8217;s identity on Hackforums is tied to the email address &#8220;codyjohnson1337@live.com; that email account was used in 2013 to register &#8220;plasmarat.pw,&#8221; a similar RAT sold and marketed on Hackforums.</p>
<div id="attachment_44432" style="width: 607px" class="wp-caption aligncenter"><img class=" wp-image-44432" src="media/ffacb6da.kfchf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/kfchf.png" alt="" width="597" height="357" /><p class="wp-caption-text">KFC Watermelon&#8217;s Skype profile (the &#8220;HF&#8221; in his Skype name is a likely reference to HackForums, where both Luminosity RAT and Plasma RAT were primarily sold and marketed).</p></div>
<p>The street address listed by the Kentucky Secretary of State&#8217;s office for Luminosity Security Solutions (127 Circle Dr., Stanford, KY) shows up in the original registration records for dozens of domains, including at least a half-dozen that early on listed the email address <strong>coltongrubbs@gmail.com</strong>. That same email address appears in the early registration records for <a href="https://www.exposedbotnets.com/2012/10/chatbarracudaseccom-barracuda-ircbotnet.html" target="_blank" rel="noopener">barracudasec[dot]com</a>, a domain that as far back as 2012 was identified as a popular &#8220;command and control&#8221; server that many denizens of Hackforums used to remotely administer large numbers of remotely commandeered computers or &#8220;bots.&#8221;<span id="more-44424"></span></p>
<p>Around the time that KFC Watermelon stopped responding to support requests on Hackforums, federal prosecutors were <a href="https://krebsonsecurity.com/2018/02/bot-roundup-avalanche-kronos-nanocore/" target="_blank" rel="noopener">securing a guilty plea</a> against <strong>Taylor Huddleston</strong>, a then 27-year-old programmer from Arkansas who sold the &#8220;<strong>NanoCore RAT</strong>.&#8221;  Like Grubbs, Huddleston initially pleaded not guilty to computer intrusion charges, arguing that <a href="https://krebsonsecurity.com/2017/04/dual-use-software-criminal-case-not-so-novel/" target="_blank" rel="noopener">he wasn&#8217;t responsible for how customers used his products</a>. That is, until prosecutors presented Skype logs showing that Huddleston routinely helped buyers work out how to use the tools to secretly compromise remote computers.</p>
<p>Grubbs&#8217; guilty plea could well lead to further arrests and prosecutions of customers who purchased and used LuminosityLink. Case in point: The author of the <strong>Blackshades Trojan</strong> — once a wildly popular RAT sold principally on Hackforums &#8212; was arrested along along with dozens of his customers in <a href="https://krebsonsecurity.com/2014/05/blackshades-trojan-users-had-it-coming/" target="_blank" rel="noopener">a global law enforcement sweep</a> in 2014.</p>
<p>Indeed, many former customers of LuminosityLink have posted to Hackforums that they are expecting similar treatment:</p>
<div id="attachment_44436" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/d896b997.ll-hf-fbi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ll-hf-fbi.png"><img class="wp-image-44436" src="media/d896b997.ll-hf-fbi.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ll-hf-fbi.png" alt="" width="594" height="83" /></a><p class="wp-caption-text">Hackforums users speculate that Grubbs&#8217; arrest could lead to the arrest and prosecution of his customers. Image: Palo Alto Networks.</p></div>
<p>Grubbs initially pleaded not guilty, and his trial was slated to begin in August. But in a plea agreement released today, Grubbs admitted to conspiring to make and sell LuminosityLink, and to knowingly assisting customers in using his software to break into computers.</p>
<p>The plea agreement notes that on July 10, 2017, when Grubbs found out the the FBI was about to raid his apartment, he hid the phone and debit card tied to his Bitcoin account, and also removed the hard drives from his computer and apartment prior to the search. &#8220;Three days later, Defendant transferred over 114 bitcoin from his LuminosityLink bitcoin address into six new bitcoin addresses,&#8221; the agreement states.</p>
<p>The charges to which Grubbs has pleaded guilty carry punishments of up to 25 years in prison and as much as $750,000 in fines, although any sentence the judge hands down in this case may be significantly tempered by U.S. Sentencing Guidelines.</p>
<p>A copy of the plea agreement is available <a href="media/494a5ef0.2018.07.16.Plea-Agreement.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/2018.07.16.Plea-Agreement.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>


feed_id: https://krebsonsecurity.com/?p=44453
title: Human Resources Firm ComplyRight Breached
uri: Human-Resources-Firm-ComplyRight-Breached
url: https://krebsonsecurity.com/2018/07/human-resources-firm-complyright-breached/
content:
Cloud-based human resources company ComplyRight said this week that a security breach of its Web site may have jeopardized sensitive consumer information -- including names, addresses, phone numbers, email addresses and Social Security numbers -- from tax forms submitted by the company's thousands of clients on behalf of employees.
Cloud-based human resources company ComplyRight said this week that a security breach of its Web site may have jeopardized sensitive consumer information -- including names, addresses, phone numbers, email addresses and Social Security numbers -- from tax forms submitted by the company's clients on behalf of employees.

Pompano Beach, Fla-based ComplyRight began mailing breach notification letters to affected consumers late last week, but the form letters are extremely vague about the scope and cause of the breach. Indeed, many readers who received these letters wrote to KrebsOnSecurity asking for more information, as the company hadn't yet published any details about the breach on its Web site. Also, most of those folks said they'd never heard of ComplyRight and could not remember ever doing business with a company by that name.


feed_id: https://krebsonsecurity.com/?p=44128
title: Google: Security Keys Neutralized Employee Phishing
uri: Google-Security-Keys-Neutralized-Employee-Phishing
url: https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/
content:
<p><strong>Google</strong> has not had any of its 85,000+ employees successfully phished on their work-related accounts since early 2017, when it began requiring all employees to use physical Security Keys in place of passwords and one-time codes, the company told KrebsOnSecurity.</p>
<div id="attachment_44470" style="width: 260px" class="wp-caption alignright"><img class=" wp-image-44470" src="media/fa0009f5.yubikey.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/yubikey.png" alt="" width="250" height="230" /><p class="wp-caption-text">A YubiKey Security Key made by Yubico. The basic model featured here retails for $20.</p></div>
<p>Security Keys are inexpensive USB-based devices that offer an alternative approach to two-factor authentication (2FA), which requires the user to log in to a Web site using something they know (the password) and something they have (e.g., a mobile device).</p>
<p>A Google spokesperson said Security Keys now form the basis of all account access at Google.</p>
<p>&#8220;We have had no reported or confirmed account takeovers since implementing security keys at Google,&#8221; the spokesperson said. &#8220;Users might be asked to authenticate using their security key for many different apps/reasons. It all depends on the sensitivity of the app and the risk of the user at that point in time.&#8221;</p>
<p>The basic idea behind two-factor authentication is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor.</p>
<p>The most common forms of 2FA require the user to supplement a password with a one-time code sent to their mobile device via text message or an app. Indeed, prior to 2017 Google employees also relied on one-time codes generated by a mobile app &#8212; <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&amp;hl=en_US" target="_blank" rel="noopener">Google Authenticator</a>.</p>
<p>In contrast, a Security Key implements a form of multi-factor authentication known as <strong>Universal 2nd Factor (U2F)</strong>, which allows the user to complete the login process simply by inserting the USB device and pressing a button on the device. The key works without the need for any special software drivers.</p>
<p>Once a device is enrolled for a specific Web site that supports Security Keys, the user no longer needs to enter their password at that site (unless they try to access the same account from a different device, in which case it will ask the user to insert their key).</p>
<p>U2F is an emerging open source authentication standard, and as such only a handful of high-profile sites currently support it, including <a href="https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/" target="_blank" rel="noopener">Dropbox</a>, <a href="https://www.facebook.com/notes/facebook-security/security-key-for-safer-logins-with-a-touch/10154125089265766/" target="_blank" rel="noopener">Facebook</a>, <a href="https://help.github.com/articles/configuring-two-factor-authentication/" target="_blank" rel="noopener">Github</a> (and of course Google&#8217;s various services). Most major password managers also now support U2F, including <a href="https://www.dashlane.com/features/fido-u2f" target="_blank" rel="noopener">Dashlane</a>, <a href="https://www.yubico.com/why-yubico/for-individuals/password-managers/keepass/" target="_blank" rel="noopener">Keepass</a> and <a href="https://www.lastpass.com/yubico" target="_blank" rel="noopener">LastPass.</a> <a href="https://help.duo.com/s/article/2253?language=en_US" target="_blank" rel="noopener">Duo Security</a> [full disclosure: an advertiser on this site] also can be set up to work with U2F.</p>
<p>With any luck, more sites soon will begin incorporating the <a href="https://www.w3.org/TR/webauthn/" target="_blank" rel="noopener">Web Authentication API</a> &#8212; also known as &#8220;<a href="https://en.wikipedia.org/wiki/WebAuthn" target="_blank" rel="noopener">WebAuthn</a>&#8221; &#8212; a standard put forth by the <a href="https://en.wikipedia.org/wiki/World_Wide_Web_Consortium" target="_blank" rel="noopener">World Wide Web Consortium</a> in collaboration with the <a href="https://www.fidoalliance.org" target="_blank" rel="noopener">FIDO Alliance</a>. <span class="pullquote pqleft">The beauty of WebAuthn is that it eliminates the need for users to constantly type in their passwords, which negates the threat from common password-stealing methods like phishing and <a href="https://www.rapid7.com/fundamentals/man-in-the-middle-attacks/" target="_blank" rel="noopener">man-in-the-middle attacks</a>.</span></p>
<p>Currently, U2F is supported by <a href="https://www.chromestatus.com/feature/5669923372138496" target="_blank" rel="noopener">Chrome</a>, <a href="https://www.yubico.com/2017/11/how-to-navigate-fido-u2f-in-firefox-quantum/" target="_blank" rel="noopener">Mozilla Firefox</a>, and <strong>Opera</strong>. In both Firefox and <strong>Quantum</strong> (the newer, faster version of Firefox), U2F is not enabled by default. To turn it on, type &#8220;about:config&#8221; in the browser bar, type or paste &#8220;security.webauth.u2f&#8221; and double-click the resulting entry to change the preference&#8217;s value from &#8220;false&#8221; to &#8220;true.&#8221;</p>
<p><strong>Microsoft</strong> says it expects to roll out updates to its flagship <strong>Edge</strong> browser to support U2F later this year. According to <a href="https://9to5mac.com/2018/04/10/touch-id-face-id-website-login/" target="_blank" rel="noopener">a recent article at 9to5Mac.com</a>, <strong>Apple</strong> has not yet said when or if it will support the standard in its <strong>Safari</strong> browser.<span id="more-44128"></span></p>
<p>Probably the most popular maker of Security Keys is <a href="https://www.yubico.com" target="_blank" rel="noopener">Yubico</a>, which sells a basic U2F key for $20 (it offers regular USB versions as well as those made for devices that require USB-C connections, such as Apple&#8217;s newer <strong>Mac OS</strong> systems). Yubikey also sells more expensive U2F keys designed to work with mobile devices.</p>
<p>If a site you frequent does not yet support WebAuthn, please consider hardening your login with another form of 2FA. Hundreds of sites now support multi-factor authentication. <a href="https://twofactorauth.org/" target="_blank" rel="noopener">Twofactorauth.org</a> maintains probably the most comprehensive list of which sites support 2FA, indexing each by type of site (email, gaming, finance, etc) and the type of 2FA offered (SMS, phone call, software token, etc.).</p>
<p>In general, using SMS and automated phone calls to receive a one-time token is less secure than relying on a software token app like Google Authenticator or <a href="https://authy.com/" target="_blank" rel="noopener">Authy</a>. That&#8217;s because thieves can intercept that one-time code by tricking your mobile provider into either <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">swapping your mobile device&#8217;s SIM card</a> or <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">&#8220;porting&#8221; your mobile number</a> to a different device. However, <em>if the only 2FA options offered by a site you frequent are SMS and/or phone calls, it is still better than simply relying on a password.</em></p>
<p>While we&#8217;re on the subject of multi-factor authentication, I should note that Google now offers an extra set of security measures for all of its properties called <a href="https://landing.google.com/advancedprotection/" target="_blank" rel="noopener">Advanced Protection</a>. Exactly how Google&#8217;s Advanced Protection works (and the trade-offs involved in turning it on) will likely be the subject of another story here, but <strong>Wired.com</strong> <a href="https://www.wired.com/story/google-advanced-protection/" target="_blank" rel="noopener">recently published a decent rundown about it</a>. Incidentally, <a href="https://null-byte.wonderhowto.com/how-to/use-u2f-security-keys-your-smartphone-access-your-google-account-with-advanced-protection-0182760/" target="_blank" rel="noopener">this article</a> includes a step-by-step guide on how to incorporate Security Keys into Advanced Protection.</p>
<p>I have been using Advanced Protection for several months now without any major issues, although it did take me a few tries to get it set up correctly. One frustrating aspect of having it turned on is that it does not allow one to use third-party email applications like Mozilla&#8217;s Thunderbird or Outlook. I found this frustrating because as far as I can tell there is no integrated solution in Gmail for PGP/OpenGPG email message encryption, and some readers prefer to share news tips this way. Previously, I had used Thunderbird along with a plugin called <a href="https://addons.thunderbird.net/en-US/thunderbird/addon/enigmail/" target="_blank" rel="noopener">Enigmail</a> to do that.</p>


feed_id: https://krebsonsecurity.com/?p=44451
title: Hackers Breached Virginia Bank Twice in Eight Months, Stole $2.4M
uri: Hackers-Breached-Virginia-Bank-Twice-in-Eight-Months-Stole-2-4M
url:
https://krebsonsecurity.com/2018/07/hackers-breached-virginia-bank-twice-in-eight-months-stole-2-4m/

content:
<p>Hackers used phishing emails to break into a Virginia bank in two separate cyber intrusions over an eight-month period, making off with more than $2.4 million total. Now the financial institution is suing its insurance provider for refusing to fully cover the losses.</p>
<p>According to a lawsuit filed last month in the Western District of Virginia, the first heist took place in late May 2016, after an employee at <strong>The National Bank of Blacksburg</strong> fell victim to a targeted phishing email.</p>
<p><img class="aligncenter size-full wp-image-44494" src="media/6f3d1c46.nbob.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/nbob.png" alt="" width="540" height="553" /></p>
<p>The email allowed the intruders to install malware on the victim&#8217;s PC and to compromise a second computer at the bank that had access to the <a href="https://www.firstdata.com/en_us/products/financial-institutions/debit-processing-atm-and-network/star-network.html" target="_blank" rel="noopener">STAR Network</a>, a system run by financial industry giant <strong>First Data</strong> that the bank uses to handle debit card transactions for customers. That second computer had the ability to manage National Bank customer accounts and their use of ATMs and bank cards.</p>
<p>Armed with this access, the bank says, hackers were able to disable and alter anti-theft and anti-fraud protections, such as 4-digit personal identification numbers (PINs), daily withdrawal limits, daily debit card usage limits, and fraud score protections.</p>
<p>National Bank said the first breach began Saturday, May 28, 2016 and continued through the following Monday. Normally, the bank would be open on a Monday, but that particular Monday was <a href="https://en.wikipedia.org/wiki/Memorial_Day" target="_blank" rel="noopener">Memorial Day</a>, a federal holiday in the United States. The hackers used hundreds of ATMs across North America to dispense funds from customer accounts. All told, the perpetrators stole more than $569,000 in that incident.</p>
<p>Following the 2016 breach, National Bank hired cybersecurity forensics firm <strong>Foregenix</strong> to investigate. The company determined the hacking tools and activity appeared to come from Russian-based Internet addresses.</p>
<p>In June of 2016, National Bank implemented additional security protocols, as recommended by FirstData. These protocols are known as “<a href="https://chargeback.com/velocity-checks-fraud-prevention/" target="_blank" rel="noopener">velocity rules</a>” and were put in place to help the bank flag specific types of repeated transaction patterns that happen within a short period of time</p>
<p>But just eight months later &#8212; in January 2017 according to the lawsuit &#8212; hackers broke in to the bank&#8217;s systems once more, again gaining access to the financial institution&#8217;s systems via a phishing email.</p>
<p>This time not only did the intruders regain access to the bank&#8217;s STAR Network, they also managed to compromise a workstation that had access to <strong>Navigator</strong>, which is software used by National Bank to manage credits and debits to customer accounts.</p>
<p>Prior to executing the second heist, the hackers used the bank&#8217;s Navigator system to fraudulently credit more than $2 million to various National Bank accounts. As with the first incident, the intruders executed their heist on a weekend. Between Jan. 7 and 9, 2017, the hackers modified or removed critical security controls and withdrew the fraudulent credits using hundreds of ATMs.</p>
<p>All the while, the intruders used the bank&#8217;s systems to actively monitor customer accounts from which the funds were being withdrawn. At the conclusion of the 2017 heist, the hackers used their access to delete evidence of fraudulent debits from customer accounts. The bank&#8217;s total reported loss from that breach was $1,833,984.</p>
<p><strong>Verizon</strong> was hired to investigate the 2017 attack, and according to the bank Verizon&#8217;s forensics experts concluded that the tools and servers used by the hackers were of Russian origin. The lawsuit notes <em>the company determined that it was likely the same group of attackers responsible for both intrusions</em>. Verizon also told the bank that the malware the attackers used to gain their initial foothold at the bank in the 2017 breach was embedded in a <a href="https://blog.barkly.com/what-is-macro-malware-2017" target="_blank" rel="noopener">booby-trapped</a> <strong>Microsoft Word</strong> document.<span id="more-44451"></span></p>
<h4>THE LAWSUIT</h4>
<p>In <a href="media/7d954a07.1-main.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/1-main.pdf" target="_blank" rel="noopener">its lawsuit</a> (PDF), National Bank says it had an insurance policy with <a href="https://www.everestre.com/" target="_blank" rel="noopener">Everest National Insurance Company</a> for two types of coverage or &#8220;riders&#8221; to protect it against cybercrime losses. The first was a &#8220;computer and electronic crime&#8221; (C&amp;E) rider that had a single loss limit liability of $8 million, with a $125,000 deductible.</p>
<p>The second was a &#8220;debit card rider&#8221; which provided coverage for losses which result directly from the use of lost, stolen or altered debit cards or counterfeit cards. That policy has a single loss limit of liability of $50,000, with a $25,000 deductible and an aggregate limit of $250,000.</p>
<p>According to the lawsuit, in June 2018 Everest determined both the 2016 and 2017 breaches were covered exclusively by the debit card rider, and not the $8 million C&amp;E rider. The insurance company said the bank could not recover lost funds under the C&amp;E rider because of two &#8220;exclusions&#8221; in that rider which spell out circumstances under which the insurer will not provide reimbursement.</p>
<p>The first of those exclusions rules out coverage for any loss &#8220;resulting directly or indirectly from the use or purported use of credit, debit, charge, access, convenience, or other cards . . . (1) in obtaining credit or funds, or (2) in gaining access to automated mechanical devices which, on behalf of the Insured, disburse Money, accept deposits, cash checks, drafts or similar Written instruments or make credit card loans . . ..”</p>
<p>The second exclusion in the C&amp;E rider negates coverage for “loss involving automated mechanical devices which, on behalf of the Insured, disburse Money, accept deposits, cash checks, drafts or similar Written instruments or make credit card loans . . ..”</p>
<p>&#8220;In its Coverage Determination, Everest further determined that the 2016 Intrusion and the 2017 Intrusion were a single event, and thus, pursuant to the Debit Card Rider, National Bank’s total coverage under the Bond was $50,000.00 for both intrusions,&#8221; the bank said in its lawsuit.</p>
<p>Everest National Insurance Company did not respond to requests for comment. But on July 20 it <a href="media/6cfb2728.everest-response.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/everest-response.pdf" target="_blank" rel="noopener">filed a response</a> (PDF) to the bank&#8217;s claims, alleging that National Bank has not accurately characterized the terms of its coverage or fully explained the basis for Everest&#8217;s coverage decision.</p>
<p><strong>Charisse Castagnoli</strong>, an adjunct professor with <a href="https://www.jmls.edu/academics/ip-privacy/advisory-board.php" target="_blank" rel="noopener">The John Marshall Law School</a>, said the bank&#8217;s claim appears to be based on a legal concept known as &#8220;<a href="https://en.wikipedia.org/wiki/Proximate_cause" target="_blank" rel="noopener">proximate cause</a>,&#8221; a claim that usually includes the telltale term &#8220;but for,&#8221; as this lawsuit does throughout.</p>
<p>&#8220;Proximate cause tries to get at where&#8217;s the legal liability associated with the original element that caused the loss,&#8221; Castagnoli said. &#8220;Take the example of a car crash victim whose master cylinder in the vehicle ran out of fluid and as a result the driver ran a red light and hit another car. The driver at fault might make the claim in a lawsuit against the car maker &#8216;but for your failure to manufacture this part correctly, this accident wouldn&#8217;t have occurred.'&#8221;</p>
<p>In this case, Castagnoli said what the bank seems to be claiming is that the Debit Card Rider shouldn&#8217;t apply because &#8212; <b>but for</b> the computer hacking &#8212; the losses wouldn’t have occurred. Indeed, the bank&#8217;s lawsuit claims: &#8220;All losses related to the 2017 Intrusion were the result of and would not have been possible but for the hacking of National Bank’s Computer Systems which resulted in the entering or changing of Electronic Data and Computer Programs within the Computer Systems.&#8221;</p>
<p>&#8220;Therefore, even though the losses were physically sustained  through ATM extractions, the Debit Card Rider limits shouldn’t apply because that kind of a rider doesn’t contemplate the dynamic changes in credit limits, and overrides of fraud monitoring, were only possible through <b>computer hacking</b> to which the C&amp;E Rider should apply,&#8221; Castagnoli explained.</p>
<p>The bank&#8217;s complaint against Everest notes that the financial institution doesn&#8217;t yet know for sure how the thieves involved in the 2017 breach extracted funds. In previous such schemes (known as &#8220;<a href="https://krebsonsecurity.com/2011/08/coordinated-atm-heist-nets-thieves-13m/" target="_blank" rel="noopener">unlimited cashouts</a>&#8220;), the fraudsters orchestrating the intrusion recruit armies of &#8220;money mules&#8221; &#8212; usually street criminals who are given cloned debit cards and stolen or fabricated PINs along with instructions on where and when to withdraw funds.</p>
<p>Castagnoli said establishing and proving these fine lines of proximate cause can be very difficult in insurance claims.</p>
<p><span class="pullquote pqleft">&#8220;While it is fairly easy to write a policy around data breach liability, when it comes to actual intrusions and managing intrusions, it&#8217;s a wild wild west,&#8221; she said.</span> &#8220;The policies and definitions they use are not consistent across carriers.&#8221;</p>
<p>Castagnoli advises companies contemplating cyber insurance policies to closely scrutinize their policies and riders, and find an expert who can help craft a policy that is tailored for the insured.</p>
<p>&#8220;The serious brokers who are out there selling cyber insurance all say the same thing: Have an expert help you to write your policy,&#8221; she said. &#8220;It&#8217;s mind-numbingly complicated and we don’t have standard language in insurance policies that help insurance clients decide what policy is right for them.&#8221;</p>
<p>She added that although there have been a handful of cases where cyber insurance providers have denied coverage to the insured, most of those disputes have been settled out of court.</p>
<p>&#8220;This is a rapidly growing area and a profit center for a lot of insurance companies,&#8221; Castagnoli said. &#8220;But there is not a lot of published case law on this, and you have to wonder if something public comes out like this what it&#8217;s going to do to the reputation of the industry.&#8221;</p>


feed_id: https://krebsonsecurity.com/?p=44527
title: LifeLock Bug Exposed Millions of Customer Email Addresses
uri: LifeLock-Bug-Exposed-Millions-of-Customer-Email-Addresses
url: https://krebsonsecurity.com/2018/07/lifelock-bug-exposed-millions-of-customer-email-addresses/
content:
<p>Identity theft protection firm <strong>LifeLock</strong> &#8212; a company that&#8217;s built a name for itself based on the promise of helping consumers protect their identities online &#8212; may have actually exposed customers to additional attacks from ID thieves and phishers. The company just fixed a vulnerability on its site that allowed anyone with a Web browser to index email addresses associated with millions of customer accounts, or to unsubscribe users from all communications from the company.</p>
<p>The upshot of this weakness is that cyber criminals could harvest the data and use it in targeted phishing campaigns that spoof LifeLock&#8217;s brand. Of course, phishers could spam the entire world looking for LifeLock customers without the aid of this flaw, but nevertheless the design of the company&#8217;s site suggests that whoever put it together lacked a basic understanding of Web site authentication and security.</p>
<div id="attachment_44535" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/71269f5f.ll-55m-redt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ll-55m-redt.png"><img class="wp-image-44535" src="media/71269f5f.ll-55m-redt.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ll-55m-redt.png" alt="" width="599" height="357" /></a><p class="wp-caption-text">LifeLock&#8217;s Web site exposed customer email addresses by tying each customer account to a numeric &#8220;subscriberkey&#8221; that could be easily enumerated. Pictured above is customer number 55,739,477. Click to enlarge.</p></div>
<p>Pictured above is a redacted screen shot of one such record (click the image to enlarge). Notice how the format of the link in the browser address bar ends with the text &#8220;subscriberkey=&#8221; followed by a number. Each number corresponds to a customer record, and the records appear to be sequential. Translation: It would be trivial to write a simple script that pulls down the email address of every LifeLock subscriber.</p>
<p>Security firm <strong>Symantec</strong>, which acquired LifeLock in November 2016 for $2.3 billion, took LifeLock.com offline shortly after being contacted by KrebsOnSecurity. According to LifeLock&#8217;s marketing literature as of January 2017, the company has more than 4.5 million customer accounts.</p>
<p>KrebsOnSecurity was alerted to the glaring flaw by <strong>Nathan Reese</strong>, a 42-year-old freelance security researcher based in Atlanta who is also a former LifeLock subscriber. Reese said he discovered the data leak after receiving an email to the address he had previously used at LifeLock, and that the message offered him a discount for renewing his membership.</p>
<p>Clicking the &#8220;unsubscribe&#8221; link at the bottom of the email brought up a page showing his subscriber key. From there, Reese said, he wrote a proof-of-concept script that began sequencing numbers and pulling down email addresses. Reese said he stopped the script after it enumerated approximately 70 emails because he didn&#8217;t want to set off alarm bells at LifeLock.</p>
<p>&#8220;If I were a bad guy, I would definitely target your customers with a phishing attack because I know two things about them,&#8221; Reese said. &#8220;That they&#8217;re a LifeLock customer and that I have those customers&#8217; email addresses. That&#8217;s a pretty sharp spear for my spear phishing right there. Plus, I definitely think the target market of LifeLock is someone who is easily spooked by the specter of cybercrime.&#8221;</p>
<div id="attachment_44537" style="width: 605px" class="wp-caption aligncenter"><img class=" wp-image-44537" src="media/b2a95400.ll-offline.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ll-offline.png" alt="" width="595" height="420" /><p class="wp-caption-text">LifeLock&#8217;s Web site is currently offline.</p></div>
<p>Misconfigurations like the one described above are some of the most common ways that companies leak customer data, but they&#8217;re also among the most preventable. Earlier this year, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/" target="_blank" rel="noopener">broke a story about a similar flaw at Panerabread.com</a>, which exposed tens of millions of customer records &#8212; including names, email and physical addresses, birthdays and the last four digits of the customer&#8217;s credit card.</p>
<p><strong>Update, 7:40 p.m.:</strong> Corrected the number of LifeLock subscribers based on a 2017 estimate by Symantec.</p>


feed_id: https://krebsonsecurity.com/?p=44550
title: State Govts. Warned of Malware-Laden CD Sent Via Snail Mail from China
uri: State-Govts-Warned-of-Malware-Laden-CD-Sent-Via-Snail-Mail-from-China
url:
https://krebsonsecurity.com/2018/07/state-govts-warned-of-malware-laden-cd-sent-via-snail-mail-from-china/

content:
<p>Here&#8217;s a timely reminder that email isn&#8217;t the only vector for phishing attacks: Several U.S. state and local government agencies have reported receiving strange letters via snail mail that include malware-laden compact discs (CDs) apparently sent from China, KrebsOnSecurity has learned.</p>
<p>This particular ruse, while crude and simplistic, preys on the curiosity of recipients who may be enticed into popping the CD into a computer. According to a non-public alert shared with state and local government agencies by the <a href="https://www.cisecurity.org/ms-isac/" target="_blank" rel="noopener">Multi-State Information Sharing and Analysis Center</a> (MS-ISAC), the scam arrives in a Chinese postmarked envelope and includes a &#8220;confusingly worded typed letter with occasional Chinese characters.&#8221;</p>
<div id="attachment_44551" style="width: 606px" class="wp-caption aligncenter"><a class="lightbox" href="media/7a65b65f.ltrandcd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ltrandcd.png"><img class="wp-image-44551" src="media/7a65b65f.ltrandcd.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/ltrandcd.png" alt="" width="596" height="314" /></a><p class="wp-caption-text">Several U.S. state and local government agencies have reported receiving this letter, which includes a malware-laden CD.</p></div>
<p>The MS-ISAC said preliminary analysis of the CDs indicate they contain Mandarin language <strong>Microsoft Word</strong> (.doc) files, some of which include malicious <a href="https://en.wikipedia.org/wiki/Visual_Basic" target="_blank" rel="noopener">Visual Basic</a> scripts. So far, State Archives, State Historical Societies, and a State Department of Cultural Affairs have all received letters addressed specifically to them, the MS-ISAC says. It&#8217;s not clear if anyone at these agencies was tricked into actually inserting the CD into a government computer.</p>
<p>I&#8217;m sure many readers could think of clever ways that this apparent mail-based phishing campaign could be made more effective or believable, such as including tiny USB drives instead of CDs, or at least a more personalized letter that doesn&#8217;t look like it was crafted by someone without a mastery of the English language.</p>
<p>Nevertheless, attacks like this are a reminder that cybercrime can take many forms. The first of <a href="https://krebsonsecurity.com/2011/05/krebss-3-basic-rules-for-online-safety/" target="_blank" rel="noopener">Krebs&#8217;s 3 Basic Rules for Online Safety</a> &#8212; &#8220;If you didn&#8217;t go looking for it don&#8217;t install it&#8221; &#8212; applies just as well here: If you didn&#8217;t go looking for it, don&#8217;t insert it or open it.</p>


feed_id: https://krebsonsecurity.com/?p=44585
title: Reddit Breach Highlights Limits of SMS-Based Authentication
uri: Reddit-Breach-Highlights-Limits-of-SMS-Based-Authentication
url: https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/
content:
<p><strong>Reddit.com</strong> today disclosed that a data breach exposed some internal data, as well as email addresses and passwords for some Reddit users. As Web site breaches go, this one doesn&#8217;t seem too severe. What&#8217;s interesting about the incident is that it showcases once again why relying on mobile text messages (SMS) for two-factor authentication (2FA) can lull companies and end users into a false sense of security.</p>
<p>In a post to Reddit, the social news aggregation platform said it learned on June 19 that between June 14 and 18 an attacker compromised a several employee accounts at its cloud and source code hosting providers.</p>
<p>Reddit said the exposed data included internal source code as well as email addresses and obfuscated passwords for all Reddit users who registered accounts on the site prior to May 2007. The incident also exposed the email addresses of some users who had signed up to receive daily email digests of specific discussion threads.</p>
<p><a class="lightbox" href="media/a1f80b23.redditbreach.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/redditbreach.png"><img class="aligncenter wp-image-44591" src="media/a1f80b23.redditbreach.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/redditbreach.png" alt="" width="586" height="390" /></a></p>
<p>Of particular note is that although the Reddit employee accounts tied to the breach were protected by SMS-based two-factor authentication, the intruder(s) managed to intercept that second factor.</p>
<p>&#8220;Already having our primary access points for code and infrastructure behind strong authentication requiring two factor authentication (2FA), we learned that SMS-based authentication is not nearly as secure as we would hope, and the main attack was via SMS intercept,&#8221; Reddit disclosed. &#8220;We point this out to encourage everyone here to move to token-based 2FA.&#8221;</p>
<p>Reddit didn&#8217;t specify how the SMS code was stolen, although it did say the intruders did not hack Reddit employees&#8217; phones directly. Nevertheless, there are a variety of well established ways that attackers can intercept one-time codes sent via text message.</p>
<p>In one common scenario, known as a <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">SIM-swap</a>, the attacker masquerading as the target tricks the target&#8217;s mobile provider into tying the customer&#8217;s service to a new SIM card that the bad guys control. A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider&#8217;s network. Customers can request a SIM swap when their existing SIM card has been damaged, or when they are switching to a different phone that requires a SIM card of another size.</p>
<p>Another typical scheme involves <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">mobile number port-out scams</a>, wherein the attacker impersonates a customer and requests that the customer&#8217;s mobile number be transferred to another mobile network provider. In both port-out and SIM swap schemes, the victim&#8217;s phone service gets shut off and any one-time codes delivered by SMS (or automated phone call) get sent to a device that the attackers control.<span id="more-44585"></span></p>
<h4>APP-BASED AUTHENTICATION</h4>
<p>A more secure alternative to SMS involves the use of a mobile app &#8212; such as <a href="https://play.google.com/store/apps/details?id=com.google.android.apps.authenticator2&amp;hl=en_US" target="_blank" rel="noopener">Google Authenticator</a> or <a href="https://authy.com/download/" target="_blank" rel="noopener">Authy</a> &#8212; to generate the one-time code that needs to be entered in addition to a password. This method is also sometimes referred to as a &#8220;time-based one-time password,&#8221; or TOTP. It&#8217;s more secure than SMS simply because the attacker in that case would need to steal your mobile device or somehow infect it with malware in order to gain access to that one-time code. More importantly, app-based two-factor removes your mobile provider from the login process entirely.</p>
<p>Fundamentally, two-factor authentication involves combining something you know (the password) with either something you have (a device) or something you are (a biometric component, for example). The core idea behind 2FA is that even if thieves manage to phish or steal your password, they still cannot log in to your account unless they also hack or possess that second factor.</p>
<p>Technically, 2FA via mobile apps and other TOTP-based methods are more accurately described as &#8220;two-step authentication&#8221; because the second factor is supplied via the same method as the first factor. For example, even though the second factor may be generated by a mobile-based app, that one-time code needs to be entered into the same login page on a Web site along with user&#8217;s password &#8212; meaning both the password and the one-time code can still be subverted by phishing, man-in-the-middle and credential replay attacks.</p>
<h4>SECURITY KEYS</h4>
<p>Probably the <em>most secure</em> form of 2FA available involves the use of hardware-based security keys. These inexpensive USB-based devices allow users to complete the login process simply by inserting the device and pressing a button. After a key is enrolled for 2FA at a particular site that supports keys, the user no longer needs to enter their password (unless they try to log in from a new device). The key works without the need for any special software drivers, and the user never has access to the code &#8212; so they can’t give it or otherwise leak it to an attacker.</p>
<p>The one limiting factor with security keys is that relatively few Web sites currently allow users to use them. Some of the most popular sites that do accept security keys include <a href="https://blogs.dropbox.com/tech/2018/05/introducing-webauthn-support-for-secure-dropbox-sign-in/" target="_blank" rel="noopener">Dropbox</a>, <a href="https://www.facebook.com/notes/facebook-security/security-key-for-safer-logins-with-a-touch/10154125089265766/" target="_blank" rel="noopener">Facebook</a> and <a href="https://help.github.com/articles/configuring-two-factor-authentication/" target="_blank" rel="noopener">Github</a>, as well as Google&#8217;s various services.</p>
<p>Last week, KrebsOnSecurity reported that <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">Google now requires all of its 85,000+ employees to use security keys for 2FA</a>, and that it has had no confirmed reports of employee account takeovers since the company began requiring them at the beginning of 2017.</p>
<p>The most popular maker of security keys &#8212; <a href="https://www.yubico.com" target="_blank" rel="noopener">Yubico</a> &#8212; sells the basic model for $20, with more expensive versions that are made to work with mobile devices. The keys are available directly from Yubico, or via Amazon.com. Yubico also includes <a href="https://www.yubico.com/solutions/" target="_blank" rel="noopener">a running list of sites</a> that currently support keys for authentication.</p>
<p>If you&#8217;re interested in migrating to security keys for authentication, it&#8217;s a good idea to purchase at least two of these devices. Virtually all sites that I have seen which allow authentication via security keys allow users to enroll multiple keys for authentication, in case one of the keys is lost or misplaced.</p>
<p>I would encourage all readers to pay a visit to <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">twofactorauth.org</a>, and to take full advantage of the most secure 2FA option available for any site you frequent. Unfortunately many sites do not support any kind of 2-factor authentication &#8212; let alone methods that go beyond SMS or a one-time code that gets read to you via an automated phone call. In addition, some sites that do support more robust, app- or key-based two-factor authentication still allow customers to receive SMS-based codes as a fallback method.</p>
<p>If the only 2FA options offered by a site you frequent are SMS and/or phone calls, this is still better than simply relying on a password. But it&#8217;s high time that popular Web sites of all stripes start giving their users more robust authentication options like TOTP and security keys. Many companies can be nudged in that direction if enough users start demanding it, so consider using any presence and influence you may have on social media platforms to make your voice heard on this important issue.</p>


feed_id: https://krebsonsecurity.com/?p=44578
title: The Year Targeted Phishing Went Mainstream
uri: The-Year-Targeted-Phishing-Went-Mainstream
url: https://krebsonsecurity.com/2018/08/the-year-targeted-phishing-went-mainstream/
content:
<p>A story published here on July 12 about <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener">a new sextortion-based phishing scheme</a> that invokes a real password used by each recipient has become the most-read piece on KrebsOnSecurity since this site launched in 2009. And with good reason &#8212; sex sells (the second most-read piece here was <a href="https://krebsonsecurity.com/2015/07/online-cheating-site-ashleymadison-hacked/" target="_blank" rel="noopener">my 2015 scoop about the Ashley Madison hack</a>).</p>
<p>But beneath the lurid allure of both stories lies a more unsettling reality: It has never been easier for scam artists to launch convincing, targeted phishing and extortion scams that are automated on a global scale. And given the sheer volume of hacked and stolen personal data now available online, it seems almost certain we will soon witness many variations on these phishing campaigns that leverage customized data elements to enhance their effectiveness.</p>
<p><img class="aligncenter size-full wp-image-44412" src="media/4f452cd1.sextortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/sextortion.png" alt="" width="487" height="87" /></p>
<p>The sextortion scheme that emerged this month falsely claims to have been sent from a hacker who’s compromised your computer and used your webcam to record a video of you while you were watching porn. The missive threatens to release the video to all your contacts unless you pay a Bitcoin ransom.</p>
<p>What spooked people most about this scam was that its salutation included a password that each recipient legitimately used at some point online. Like most phishing attacks, the sextortion scheme that went viral this month requires just a handful of recipients to fall victim for the entire scheme to be profitable.</p>
<p>From reviewing the Bitcoin addresses readers shared in the comments on that July 12 sextortion story, it is clear this scam tricked dozens of people into paying anywhere from a few hundred to thousands of dollars in Bitcoin. All told, <em>those addresses received close to $100,000 in payments over the past two weeks.</em></p>
<p>And that is just from examining the Bitcoin addresses posted here; the total financial haul from different versions of this attack is likely far higher. A more comprehensive review by the <a href="https://twitter.com/SecGuru_OTX/status/1022430328647024640" target="_blank" rel="noopener">Twitter user @SecGuru_OTX</a> and <a href="https://pastebin.com/UyTtLQwL" target="_blank" rel="noopener">posted to Pastebin</a> suggests that as of July 26 there were more than 300 Bitcoin addresses used to con at least 150 victims out of a total of 30 Bitcoins, or approximately $250,000.</p>
<p>There are several interesting takeaways from this phishing campaign. The first is that it effectively inverted a familiar threat model: Most phishing campaigns try to steal your password, whereas this one leads with it.</p>
<p>A key component of a targeted phishing attack is personalization. And purloined passwords are an evergreen lure because your average Internet user hasn&#8217;t the slightest inkling of just how many of their passwords have been breached, leaked, lost or stolen over the years.</p>
<p>This was evidenced by the number of commenters here who acknowledged that the password included in the extortion email <em>was one they were still using, with some even admitting they were using the password at multiple sites! </em></p>
<p>Surprisingly, none of the sextortion emails appeared to include a Web site link of any kind. But consider how effective this &#8220;I&#8217;ve got your password&#8221; scam would be at enticing a fair number of recipients into clicking on one.</p>
<p><img class="alignright size-full wp-image-30276" src="media/ef104142.athook.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/03/athook.png" alt="" width="194" height="375" />In such a scenario, the attacker might configure the link to lead to an &#8220;exploit kit,&#8221; crimeware designed to be stitched into hacked or malicious sites that exploits a variety of Web-browser vulnerabilities for the purposes of installing malware of the attacker&#8217;s choosing.</p>
<p>Also, most of the passwords referenced in the sextortion campaign appear to have been slurped from data breaches that are now several years old. For example, many readers reported that the password they received was the one compromised in <a href="https://krebsonsecurity.com/2016/05/as-scope-of-2012-breach-expands-linkedin-to-again-reset-passwords-for-some-users/" target="_blank" rel="noopener">LinkedIn&#8217;s massive 2012 data breach</a>.</p>
<p>Now imagine how much more convincing such a campaign would be if it leveraged a fresh password breach &#8212; perhaps one that the breached company wasn&#8217;t even aware of yet.</p>
<p>There are many other data elements that could be embedded in extortion emails to make them more believable, particularly with regard to freshly-hacked databases. For example, it is common for user password databases that are stolen from hacked companies to include the Internet Protocol (IP) addresses used by each user upon registering their account.</p>
<p>This could be useful for phishers because there are many automated &#8220;geo-IP&#8221; services that try to determine the geographical location of Website visitors based on their Internet addresses.</p>
<p>Some of these services allow users to upload large lists of IP addresses and generate links that plot each address on Google Maps. Suddenly, the phishing email not only includes a password you are currently using, but it also bundles a Google Street View map of your neighborhood!</p>
<p>There are countless other ways these schemes could become far more personalized and terrifying &#8212; all in an automated fashion. The point is that automated, semi-targeted phishing campaigns are likely here to stay.</p>
<p><span id="more-44578"></span></p>
<p>Here are some tips to help avoid falling prey to these increasingly sophisticated phishing schemes:</p>
<p>&#8211;<strong>Avoid clicking on links and attachments in email,</strong> even in messages that appear to be sent from someone you know.</p>
<p>&#8211;<strong>Urgency should be a giant red flag.</strong> Most phishing scams invoke a temporal element that warns of dire consequences should you fail to respond or act quickly. Take a deep breath. If you&#8217;re unsure whether the message is legitimate, visit the site or service in question manually (ideally, using a browser bookmark so as to avoid <a href="https://krebsonsecurity.com/?s=typosquatting&amp;x=0&amp;y=0" target="_blank" rel="noopener">potential typosquatting sites</a>).</p>
<p>&#8211;<strong>Don&#8217;t re-use passwords. </strong>If you&#8217;re the kind of person who likes to use the same password across multiple sites, then you definitely need to be using a password manager. That&#8217;s because password managers handle the tedious task of creating and remembering unique, complex passwords on your behalf; all you need to do is remember a single, strong master password or passphrase. In essence, you effectively get to use the same password across all Web sites.</p>
<p>Some of the more popular password managers include <a href="https://www.dashlane.com" target="_blank" rel="noopener">Dashlane</a>, <a href="https://keepass.info/" target="_blank" rel="noopener">Keepass</a>, <a href="https://www.lastpass.com" target="_blank" rel="noopener">LastPass</a>. [Side note: Using unique passwords at each site also can provide a strong clue about which Web site likely got breached in the event that said password shows up in one of these targeted phishing attacks going forward].</p>
<p><strong>-Do not respond to spam or phishing emails.</strong> Several readers reported sending virtual nastygrams back to their would-be sextortionists. Please resist any temptation to reply. In all likelihood, the only thing a reply will accomplish is letting the attackers know they have a live one on the hook, and ensuring that your email address will receive even more scams and spams in the future.</p>
<p><strong>-Don&#8217;t pay off extortionists.</strong> For the same reason that replying to spammers is a bad idea, rewarding extortionists only serves to further the victimization of yourself and others. Also, even if someone really does have the goods on you, there is no way that you as the victim can be sure that paying makes the threat go away.</p>


feed_id: https://krebsonsecurity.com/?p=44610
title: Credit Card Issuer TCM Bank Leaked Applicant Data for 16 Months
uri: Credit-Card-Issuer-TCM-Bank-Leaked-Applicant-Data-for-16-Months
url:
https://krebsonsecurity.com/2018/08/credit-card-issuer-tcm-bank-leaked-applicant-data-for-16-months/

content:
<p><strong>TCM Bank</strong>, a company that helps more than 750 small and community U.S. banks issue credit cards to their account holders, said a Web site misconfiguration exposed the names, addresses, dates of birth and Social Security numbers of thousands of people who applied for cards between early March 2017 and mid-July 2018.</p>
<p><img class="alignright  wp-image-44617" src="media/0e6f2ea2.leak.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/leak.png" alt="" width="249" height="243" />TCM is a subsidiary of Washington, D.C.-based <strong>ICBA Bancard Inc.</strong>, which helps community banks provide a credit card option to their customers using bank-branded cards.</p>
<p>In a letter being mailed to affected customers today, TCM said the information exposed was data that card applicants uploaded to a Web site managed by a third party vendor. TCM said it learned of the issue on July 16, 2018, and had the problem fixed by the following day.</p>
<p><strong>Bruce Radke</strong>, an attorney working with ICBA on its breach outreach efforts to customers, said fewer than 10,000 consumers who applied for cards were affected. Radke declined to name the third-party vendor, saying TCM was contractually prohibited from doing so.</p>
<p>&#8220;It was less than 25 percent of the applications we processed during the relevant time period that were potentially affected, and less than one percent of our cardholder base was affected here,&#8221; Radke said. &#8220;We&#8217;ve since confirmed the issue has been corrected, and we&#8217;re requiring the vendor to look at their technologies and procedures to detect and prevent similar issues going forward.&#8221;</p>
<p>ICBA Bancard is the payments subsidiary of the <a href="https://www.icba.org/" target="_blank" rel="noopener">Independent Community Bankers of America</a>, a organization representing more than 5,700 financial institutions that has been fairly vocal about holding retailers accountable for credit card breaches over the years. Last year, the <a href="https://www.americanbanker.com/news/icba-files-lawsuit-against-equifax-following-data-breach" target="_blank" rel="noopener">ICBA sued Equifax</a> over the big-three credit bureau&#8217;s <a href="https://krebsonsecurity.com/?s=equifax+breach&amp;x=0&amp;y=0" target="_blank" rel="noopener">massive data breach</a> that exposed the Social Security numbers and other sensitive data on nearly 150 million Americans.</p>
<p>Many companies that experience a data breach or data leak are quick to place blame for the incident on a third-party that mishandled sensitive information. Sometimes this blame is entirely warranted, but more often such claims ring hollow in the ears of those affected &#8212; particularly when they come from banks and security providers. For example, identity theft protection provider <strong>LifeLock</strong> recently addressed a Web site misconfiguration that <a href="https://krebsonsecurity.com/2018/07/lifelock-bug-exposed-millions-of-customer-email-addresses/" target="_blank" rel="noopener">exposed the email addresses of millions of customers</a>. LifeLock&#8217;s owner <strong>Symantec</strong> later said it fixed the flaw, which it blamed on a mistake by an unnamed third-party marketing partner.</p>
<p>Managing third-party risk can be challenging, especially for organizations with hundreds or thousands of partners (consider <a href="https://krebsonsecurity.com/2013/12/sources-target-investigating-data-breach/" target="_blank" rel="noopener">the Target breach</a>, which began with an opportunistic malware compromise <a href="https://krebsonsecurity.com/2014/02/target-hackers-broke-in-via-hvac-company/" target="_blank" rel="noopener">at a heating and air conditioning vendor</a>). Nevertheless, organizations of all shapes and sizes need to be vigilant about making sure their partners are doing their part on security, lest third-party risk devolves into a first-party breach of customer trust.</p>


feed_id: https://krebsonsecurity.com/?p=44625
title: Florida Man Arrested in SIM Swap Conspiracy
uri: Florida-Man-Arrested-in-SIM-Swap-Conspiracy
url: https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/
content:
<p>Police in Florida have arrested a 25-year-old man accused of being part of a multi-state cyber fraud ring that hijacked mobile phone numbers in online attacks that siphoned hundreds of thousands of dollars worth of bitcoin and other cryptocurrencies from victims.</p>
<p>On July 18, 2018, Pasco County authorities arrested <strong>Ricky Joseph Handschumacher</strong>, an employee of the city of Port Richey, Fla, charging him with grand theft and money laundering. Investigators allege Handschumacher was part of a group of at least nine individuals scattered across multiple states who for the past two years have drained bank accounts via an increasingly common scheme involving mobile phone &#8220;SIM swaps.&#8221;</p>
<p><img class="aligncenter size-full wp-image-40415" src="media/618d5447.phonefraudsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png" alt="" width="609" height="307" srcset="https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller.png 609w, https://krebsonsecurity.com/wp-content/uploads/2017/08/phonefraudsmaller-580x292.png 580w" sizes="(max-width: 609px) 100vw, 609px" /></p>
<p>A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their existing SIM card has been damaged, or when they are switching to a different phone that requires a SIM card of another size.</p>
<p>But SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target&#8217;s service to a new SIM card and mobile phone that the attackers control. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target&#8217;s password, as many banks and online services rely on text messages to send users a one-time code that needs to be entered in addition to a password for online authentication.</p>
<p>In some cases, fraudulent SIM swaps succeed thanks to lax authentication procedures at mobile phone stores. In other instances, mobile store employees work directly with cyber criminals to help conduct unauthorized SIM swaps, as appears to be the case with the crime gang that allegedly included Handschumacher.</p>
<h4>A WORRIED MOM</h4>
<p>According to court documents, investigators first learned of the group&#8217;s activities in February 2018, when a Michigan woman called police after she overheard her son talking on the phone and pretending to be an <strong>AT&amp;T</strong> employee. Officers responding to the report searched the residence and found multiple cell phones and SIM cards, as well as files on the kid&#8217;s computer that included &#8220;an extensive list of names and phone numbers of people from around the world.&#8221;</p>
<p>The following month, Michigan authorities found the same individual accessing personal consumer data via public Wi-Fi at a local library, and seized 45 SIM cards, a laptop and a <a href="https://trezor.io/" target="_blank" rel="noopener">Trezor wallet</a> &#8212; a hardware device designed to store crytpocurrency account data. In April 2018, the mom again called the cops on her son &#8212; identified only as confidential source #1 (&#8220;CS1&#8221;) in the criminal complaint &#8212; saying he&#8217;d obtained yet another mobile phone.</p>
<p>Once again, law enforcement officers were invited to search the kid&#8217;s residence, and this time found two bags of SIM cards and numerous driver&#8217;s licenses and passports. Investigators said they used those phony documents to locate and contact several victims; two of the victims each reported losing approximately $150,000 in cryptocurrencies after their phones were cloned; the third told investigators her account was drained of $50,000.</p>
<p>CS1 later told investigators he routinely conducted the phone cloning and cashouts in conjunction with eight other individuals, including Handschumacher, who allegedly used the handle &#8220;coinmission&#8221; in the group&#8217;s daily chats via <a href="https://discordapp.com/" target="_blank" rel="noopener">Discord</a> and <a href="https://telegram.org/" target="_blank" rel="noopener">Telegram</a>. Search warrants revealed that in mid-May 2018 the group worked in tandem to steal 57 bitcoins from one victim &#8212; then valued at almost $470,000 &#8212; and agreed to divide the spoils among members.</p>
<h4>GRAND PLANS</h4>
<p>Investigators soon obtained search warrants to monitor the group&#8217;s Discord server chat conversations, and observed Handschumacher allegedly bragging in these chats about using the proceeds of his alleged crimes to purchase land, a house, a vehicle and a &#8220;quad vehicle.&#8221; Interestingly, <a href="https://www.facebook.com/ricky.handschumacher?lst=1486605214%3A100001522297881%3A1533500100" target="_blank" rel="noopener">Handschumacher&#8217;s public Facebook page</a> remains public, and is replete with pictures that he posted of recent new vehicle aquisitions, including a pickup truck and multiple all-terrain vehicles and jet skis.</p>
<p>The Pasco County Sherrif&#8217;s office says their surveillance of the Discord server revealed that the group routinely paid employees at cellular phone companies to assist in their attacks, and that they even discussed a plan to hack accounts belonging to the CEO of cryptocurrency exchange <a href="https://www.gemini.com" target="_blank" rel="noopener">Gemini Trust Company</a>. The complaint doesn&#8217;t mention the CEO by name, but the current CEO is bitcoin billionaire <a href="https://en.wikipedia.org/wiki/Tyler_Winklevoss" target="_blank" rel="noopener">Tyler Winklevoss</a>, who co-founded the exchange along with his twin brother Cameron.</p>
<p>&#8220;Handschumacher and another co-conspirator talk about compromising the CEO of Gemini and posted his name, date of birth, Skype username and email address into the conversation,&#8221; the complaint reads. &#8220;Handschumacher and the co-conspirators discuss compromising the CEO&#8217;s Skype account and T-Mobile account. The co-conspirator states he will call his &#8216;guy&#8217; at T-Mobile to ask about the CEO&#8217;s account.&#8221;<span id="more-44625"></span></p>
<p>Court documents state that the group used <strong>Coinbase.com</strong> and multiple other cryptocurrency exchanges to launder the proceeds of their thefts in a bid to obfuscate the source of the stolen funds. Subpoenas to Coinbase revealed Handschumacher had a total of 82 bitcoins sold from or sent to his account, and that virtually all of the funds were received via outside sources (as opposed to being purchased through Coinbase).</p>
<p>Neither Handschumacher nor his attorney responded to requests for comment. The complaint against Handschumacher says that following his arrest he confessed to his involvement in the group, and that he admitted to using his cell phone to launder cryptocurrency in amounts greater than $100,000.</p>
<p>But on July 23, Handschumacher&#8217;s attorney entered a plea of &#8220;not guilty&#8221; on behalf of his client, who is now facing charges of grand larceny, money laundering, and accessing a computer or electronic device without authorization.</p>
<p>Handschumacher&#8217;s arrest comes on the heels of an apparent law enforcement crackdown on individuals involved in SIM swap schemes. As <a href="https://motherboard.vice.com/en_us/article/a3q7mz/hacker-allegedly-stole-millions-bitcoin-sim-swapping" target="_blank" rel="noopener">first reported by Motherboard.com earlier this month</a>, on July 12, police in California arrested <strong>Joel Ortiz</strong> &#8212; a 20-year-old college student accused of being part of a group of criminals who hacked dozens of cellphone numbers to steal more than $5 million in cryptocurrency.</p>
<p>The Motherboard story notes that Ortiz allegedly was an active member of <strong>OGusers[dot]com</strong>, a marketplace for Twitter and Instagram usernames that SIM swapping hackers use to sell stolen accounts &#8212; usually one- to six-letter usernames. Short usernames are something of a prestige or status symbol for many youngsters, and some are willing to pay surprising sums of money for them.</p>
<p>Sources familiar with the investigation tell KrebsOnSecurity that <a href="https://www.instagram.com/rickie/" target="_blank" rel="noopener">Handschumacher</a> also was a member of OGUsers, although it remains unclear how active he may have been there.</p>
<h4>WHAT YOU CAN DO</h4>
<p>All four major U.S. mobile phone companies allow customers to set personal identification numbers (PINs) on their accounts to help combat SIM swaps, as well as another type of phone hijacking known as a <a href="https://krebsonsecurity.com/2018/02/how-to-fight-mobile-number-port-out-scams/" target="_blank" rel="noopener">number port-out scam</a>. But these precautions may serve as little protection against crooked insiders working at mobile phone retail locations. On May 18, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">published a story</a> about a Boston man who had his three-letter Instagram username hijacked after attackers executed a SIM swap against his T-Mobile account. According to T-Mobile, that attack was carried out with the help of a rogue company employee.</p>
<p>SIM swap scams illustrate a crucial weak point of multi-factor authentication methods that rely on a one-time code sent either via text message or an automated phone call. If an online account that you value offers more robust forms of multi-factor authentication &#8212; such as one-time codes generated by an app, or better yet <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">hardware-based security keys</a> &#8212; please consider taking full advantage of those options.</p>
<p>If, however, SMS-based authentication is the only option available, this is still far better than simply relying on a username and password to protect the account. If you haven&#8217;t done so lately, head on over to <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">twofactorauth.org</a>, which maintains probably the most comprehensive list of which sites support multi-factor authentication, indexing each by type of site (email, gaming, finance, etc) and the type of added authentication offered (SMS, phone call, software/hardware token, etc.).</p>


feed_id: https://krebsonsecurity.com/?p=44642
title: FBI Warns of ‘Unlimited’ ATM Cashout Blitz
uri: FBI-Warns-of-Unlimited-ATM-Cashout-Blitz
url: https://krebsonsecurity.com/2018/08/fbi-warns-of-unlimited-atm-cashout-blitz/
content:
<p>The <strong>Federal Bureau of Investigation</strong> (FBI) is warning banks that cybercriminals are preparing to carry out a highly choreographed, global fraud scheme known as an &#8220;ATM cash-out,&#8221; in which crooks hack a bank or payment card processor and use cloned cards at cash machines around the world to fraudulently withdraw millions of dollars in just a few hours.</p>
<p class="p1"><img class="alignright wp-image-30632" src="media/ad84042b.fbilogo.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2015/04/fbilogo.png" alt="" width="249" height="250" srcset="https://krebsonsecurity.com/wp-content/uploads/2015/04/fbilogo.png 460w, https://krebsonsecurity.com/wp-content/uploads/2015/04/fbilogo-150x150.png 150w" sizes="(max-width: 249px) 100vw, 249px" />&#8220;The FBI has obtained unspecified reporting indicating cyber criminals are planning to conduct a global Automated Teller Machine (ATM) cash-out scheme in the coming days, likely associated with an unknown card issuer breach and commonly referred to as an &#8216;unlimited operation&#8217;,&#8221; reads a confidential alert the FBI shared with banks privately on Friday.</p>
<p class="p1">The FBI said unlimited operations compromise a financial institution or payment card processor with malware to access bank customer card information and exploit network access, enabling large scale theft of funds from ATMs.</p>
<p class="p1">&#8220;Historic compromises have included small-to-medium size financial institutions, likely due to less robust implementation of cyber security controls, budgets, or third-party vendor vulnerabilities,&#8221; the alert continues. &#8220;The FBI expects the ubiquity of this activity to continue or possibly increase in the near future.&#8221;</p>
<p>Organized cybercrime gangs that coordinate unlimited attacks typically do so by hacking or phishing their way into a bank or payment card processor. Just prior to executing on ATM cashouts, the intruders will remove many fraud controls at the financial institution, such as maximum ATM withdrawal amounts and any limits on the number of customer ATM transactions daily.</p>
<p>The perpetrators also alter account balances and security measures to make an unlimited amount of money available at the time of the transactions, allowing for large amounts of cash to be quickly removed from the ATM.</p>
<p class="p1">&#8220;The cyber criminals typically create fraudulent copies of legitimate cards by sending stolen card data to co-conspirators who imprint the data on reusable magnetic strip cards, such as gift cards purchased at retail stores,&#8221; the FBI warned. &#8220;At a pre-determined time, the co-conspirators withdraw account funds from ATMs using these cards.&#8221;</p>
<p class="p1">Virtually all ATM cashout operations are launched on weekends, often just after financial institutions begin closing for business on Saturday. Last month, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/07/hackers-breached-virginia-bank-twice-in-eight-months-stole-2-4m/" target="_blank" rel="noopener">broke a story</a> about an apparent unlimited operation used to extract a total of $2.4 million from accounts at the <strong>National Bank of Blacksburg</strong> in two separate ATM cashouts between May 2016 and January 2017.</p>
<p>In both cases, the attackers managed to phish someone working at the Blacksburg, Virginia-based small bank. From there, the intruders compromised systems the bank used to manage credits and debits to customer accounts.<span id="more-44642"></span></p>
<p>The 2016 unlimited operation against National Bank began Saturday, May 28, 2016 and continued through the following Monday. That particular Monday was <a href="https://en.wikipedia.org/wiki/Memorial_Day" target="_blank" rel="noopener">Memorial Day</a>, a federal holiday in the United States, meaning bank branches were closed for more than two days after the heist began. All told, the attackers managed to siphon almost $570,000 in the 2016 attack.</p>
<p>The Blacksburg bank hackers struck again on Saturday, January 7, and by Monday Jan 9 had succeeded in withdrawing almost $2 million in another unlimited ATM cashout operation.</p>
<p>The FBI is urging banks to review how they&#8217;re handling security, such as implementing strong password requirements and two-factor authentication using a physical or digital token when possible for local administrators and business critical roles.</p>
<p>Other tips in the FBI advisory suggested that banks:</p>
<p>-Implement separation of duties or dual authentication procedures for account balance or withdrawal increases above a specified threshold.</p>
<p class="p1">-Implement application whitelisting to block the execution of malware.</p>
<p class="p1">-Monitor, audit and limit administrator and business critical accounts with the authority to modify the account attributes mentioned above.</p>
<p class="p1">-Monitor for the presence of remote network protocols and administrative tools used to pivot back into the network and conduct post-exploitation of a network, such as Powershell, cobalt strike and TeamViewer.</p>
<p class="p1">-Monitor for encrypted traffic (SSL or TLS) traveling over non-standard ports.</p>
<p class="p1">-Monitor for network traffic to regions wherein you would not expect to see outbound connections from the financial institution.</p>


feed_id: https://krebsonsecurity.com/?p=44576
title: Patch Tuesday, August 2018 Edition
uri: Patch-Tuesday-August-2018-Edition
url: https://krebsonsecurity.com/2018/08/patch-tuesday-august-2018-edition/
content:
<p><strong>Adobe </strong>and <strong>Microsoft</strong> each released security updates for their software on Tuesday. Adobe plugged five security holes in its <strong>Flash Player</strong> browser plugin. Microsoft pushed 17 updates to fix at least 60 vulnerabilities in Windows and other software, including two &#8220;<a href="https://en.wikipedia.org/wiki/Zero-day_(computing)" target="_blank" rel="noopener">zero-day</a>&#8221; flaws that attackers were already exploiting before Microsoft issued patches to fix them.</p>
<p><img class="alignright wp-image-26837" src="media/863df0f6.brokenwindows.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2014/07/brokenwindows.png" alt="" width="194" height="203" />According to security firm <strong>Ivanti</strong>, the first of the two zero-day flaws (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8373" target="_blank" rel="noopener">CVE-2018-8373</a>) is a critical flaw in <strong>Internet Explorer</strong> that attackers could use to foist malware on IE users who browse to hacked or booby-trapped sites. The other zero-day is a bug (<a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414" target="_blank" rel="noopener">CVE-2018-8414</a>) in the Windows 10 shell that could allow an attacker to run code of his choice.</p>
<p>Microsoft also patched more variants of the <a href="https://krebsonsecurity.com/2018/01/scary-chip-flaws-raise-spectre-of-meltdown/" target="_blank" rel="noopener">Meltdown/Spectre memory vulnerabilities</a>, collectively dubbed &#8220;<a href="https://foreshadowattack.eu/" target="_blank" rel="noopener">Foreshadow</a>&#8221; by a team of researchers who discovered and reported the <strong>Intel</strong>-based flaws. For more information about how Foreshadow works, check out their <a href="media/49f73e79.foreshadow.pdf" data-original-source="https://foreshadowattack.eu/foreshadow.pdf" target="_blank" rel="noopener">academic paper</a> (PDF), and/or the video below. Microsoft&#8217;s analysis is <a href="https://blogs.technet.microsoft.com/srd/2018/08/10/analysis-and-mitigation-of-l1-terminal-fault-l1tf/" target="_blank" rel="noopener">here</a>.</p>
<p>One nifty little bug fixed in this patch batch is <a href="https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8345" target="_blank" rel="noopener">CVE-2018-8345</a>. It addresses a problem in the way Windows handles shortcut files; ending in the “.lnk” extension, shortcut files are Windows components that link (hence the “lnk” extension) easy-to-recognize icons to specific executable programs, and are typically placed on the user’s Desktop or Start Menu.</p>
<p>That description of a shortcut file was taken verbatim from the <a href="https://krebsonsecurity.com/2010/07/experts-warn-of-new-windows-shortcut-flaw/" target="_blank" rel="noopener">first widely read report</a> on what would later be dubbed the <a href="https://en.wikipedia.org/wiki/Stuxnet" target="_blank" rel="noopener">Stuxnet worm</a>, which also employed an exploit for a weakness in the way Windows handled shortcut (.lnk) files. According to security firm <a href="https://blog.qualys.com/laws-of-vulnerabilities/2018/08/14/august-patch-tuesday-63-vulns-l1tf-exchange-sql-active-attacks-on-ie-flaw" target="_blank" rel="noopener">Qualys</a>, this patch should be prioritized for both workstations and servers, as the user does not need to click the file to exploit. &#8220;Simply viewing a malicious LNK file can execute code as the logged-in user,&#8221; Qualys&#8217; <strong>Jimmy Graham</strong> wrote.<span id="more-44576"></span></p>
<p>Not infrequently, Redmond ships updates that end up causing stability issues for some users, and it doesn’t hurt to wait a day or two before seeing if any major problems are reported with new updates before installing them. Microsoft doesn’t make it easy for Windows 10 users to change this setting, but it is possible. For all other Windows OS users, if you’d rather be alerted to new updates when they’re available so you can choose when to install them, there’s a setting for that in Windows Update.</p>
<p>It’s a good idea to get in the habit of backing up your computer before applying monthly updates from Microsoft. Windows has some built-in tools that can help recover from bad patches, but restoring the system to a backup image taken just before installing updates is often much less hassle and an added piece of mind while you’re sitting there praying for the machine to reboot successfully after patching.</p>
<p><img class="alignleft wp-image-18875" src="media/18bb50f1.brokenflash-a.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2013/02/brokenflash-a.png" alt="" width="193" height="165" />Adobe&#8217;s Flash update brings the program to <a href="https://helpx.adobe.com/security/products/flash-player/apsb18-25.html" target="_blank" rel="noopener"><em>v. 30.0.0.154</em></a> for Windows,<strong> macOS</strong>, <strong>Chrome</strong> and <strong>Linux</strong>. Most readers here know how I feel about Flash, which is a major security liability and a frequent target of browser-based attacks. The updates from Microsoft include these Flash fixes for IE, and <strong>Google Chrome</strong> has already pushed an update to address these five Flash flaws (although a browser restart may be needed).</p>
<p>But seriously, if you don&#8217;t have a specific need for Flash, just disable it already. Chrome is set to ask before playing Flash objects, but disabling Flash in Chrome is simple enough. Paste “chrome://settings/content” into a Chrome browser bar and then select “Flash” from the list of items. By default it should be set to “Ask first” before running Flash, although users also can disable Flash entirely here or whitelist and blacklist specific sites.</p>
<p>By default, Mozilla Firefox on Windows computers with Flash installed runs Flash in a “protected mode,” which prompts the user to decide if they want to enable the plugin before Flash content runs on a Web site.</p>
<p>Adobe also released <a href="https://helpx.adobe.com/security/products/acrobat/apsb18-29.html" target="_blank" rel="noopener">security updates</a> for its PDF Reader and Acrobat products.</p>
<p>As always, please leave a note in the comments below if you experience any problems installing any of these updates.</p>


feed_id: https://krebsonsecurity.com/?p=44676
title: Hanging Up on Mobile in the Name of Security
uri: Hanging-Up-on-Mobile-in-the-Name-of-Security
url: https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/
content:
<p>An entrepreneur and virtual currency investor is suing <strong>AT&amp;T</strong> for $224 million, claiming the wireless provider was negligent when it failed to prevent thieves from hijacking his mobile account and stealing millions of dollars in cryptocurrencies. Increasingly frequent, high-profile attacks like these are prompting some experts to say the surest way to safeguard one&#8217;s online accounts may be to disconnect them from the mobile providers entirely.</p>
<p><img class="aligncenter size-full wp-image-44711" src="media/daad1d09.newsnip.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/newsnip.png" alt="" width="419" height="586" /></p>
<p>The claims come in <a href="https://www.reuters.com/article/us-cryptocurrency-at-t-lawsuit/us-investor-sues-att-for-224-million-over-loss-of-cryptocurrency-idUSKBN1L01AA" target="_blank" rel="noopener">a lawsuit</a> filed this week in Los Angeles on behalf of <strong>Michael Terpin</strong>, who co-founded the first angel investor group for bitcoin enthusiasts in 2013. Terpin alleges that crooks stole almost $24 million worth of cryptocurrency after fraudulently executing a &#8220;SIM swap&#8221; on his mobile phone account at AT&amp;T in early 2018.</p>
<p>A SIM card is the tiny, removable chip in a mobile device that allows it to connect to the provider’s network. Customers can legitimately request a SIM swap when their existing SIM card has been damaged, or when they are switching to a different phone that requires a SIM card of another size.</p>
<p>But SIM swaps are frequently abused by scam artists who trick mobile providers into tying a target’s service to a new SIM card and mobile phone that the attackers control. Unauthorized SIM swaps often are perpetrated by fraudsters who have already stolen or phished a target’s password, as many banks and online services rely on text messages to send users a one-time code that needs to be entered in addition to a password for online authentication.</p>
<p>Terpin alleges that on January 7, 2018, someone requested an unauthorized SIM swap on his AT&amp;T account, causing his phone to go dead and sending all incoming texts and phone calls to a device the attackers controlled. Armed with that access, the intruders were able to reset credentials tied to his cryptocurrency accounts and siphon nearly $24 million worth of digital currencies.</p>
<p>According to Terpin, this was the second time in six months someone had hacked his AT&amp;T number. On June 11, 2017, Terpin&#8217;s phone went dead. He soon learned his AT&amp;T password had been changed remotely after 11 attempts in AT&amp;T stores had failed. At the time, AT&amp;T suggested Terpin take advantage of the company&#8217;s &#8220;extra security&#8221; feature &#8212; a customer-specified six-digit PIN which is required before any account changes can be made.</p>
<p>Terpin claims an investigation by AT&amp;T into the 2018 breach found that an employee at an AT&amp;T store in Norwich, Conn. somehow executed the SIM swap on his account without having to enter his &#8220;extra security&#8221; PIN, and that AT&amp;T knew or should have known that employees could bypass its customer security measures.</p>
<p>Terpin is suing AT&amp;T for his $24 million worth of cryptocurrencies, plus $200 million in punitive damages. A copy of his complaint is <a href="media/cc2dca98.Complaint-as-Filed-3063362-1.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/Complaint-as-Filed-3063362-1.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p style="font-weight: 400;">AT&amp;T declined to comment on specific claims in the lawsuit, saying only in a statement that, &#8220;We dispute these allegations and look forward to presenting our case in court.&#8221;</p>
<h4>AN &#8216;IDENTITY CRISIS&#8217;?</h4>
<p>Mobile phone companies are a major weak point in authentication because so many companies have now built their entire procedure for authenticating customers on a process that involves sending a one-time code to the customer via SMS or automated phone call.</p>
<p>In some cases, thieves executing SIM swaps have already phished or otherwise stolen a target&#8217;s bank or email password. But many major social media platforms &#8212; such as <strong>Instagram</strong> &#8212; <em>allow users to reset their passwords using nothing more than text-based (SMS) authentication</em>, meaning thieves can hijack those accounts just by having control over the target&#8217;s mobile phone number.</p>
<p><strong>Allison Nixon</strong> is director of security research at <a href="https://www.flashpoint-intel.com" target="_blank" rel="noopener">Flashpoint</a>, a security company in New York City that has been closely tracking the murky underworld of communities that teach people how to hijack phone numbers assigned to customer accounts at all of the major mobile providers.</p>
<p><span class="pullquote pqleft">Nixon calls the current SIM-jacking craze &#8220;a major identity crisis&#8221; for cybersecurity on multiple levels.</span></p>
<p>&#8220;Phone numbers were never originally intended as an identity document, they were designed as a way to contact people,&#8221; Nixon said. &#8220;But because of all these other companies are building in security measures, a phone number has become an identity document.&#8221;</p>
<p>In essence, mobile phone companies have become &#8220;critical infrastructure&#8221; for security precisely because so much is riding on who controls a given mobile number. At the same time, so little is needed to undo weak security controls put in place to prevent abuse.</p>
<p>&#8220;The infrastructure wasn&#8217;t designed to withstand the kind of attacks happening now,&#8221; Nixon said. &#8220;The protocols need to be changed, and there are probably laws affecting the telecom companies that need to be reviewed in light of how these companies have evolved.&#8221;</p>
<p>Unfortunately, with the major mobile providers so closely tied to your security, there is no way you can remove the most vulnerable chunks of this infrastructure &#8212; the mobile store employees who can be paid or otherwise bamboozled into helping these attacks succeed.</p>
<p>No way, that is, unless you completely disconnect your mobile phone number from any sort of SMS-based authentication you currently use, and replace it with Internet-based telephone services that do not offer &#8220;helpful&#8221; customer support &#8212; such as <a href="https://voice.google.com/u/0/signup" target="_blank" rel="noopener">Google Voice</a>.</p>
<p>Google Voice lets users choose a phone number that gets tied to their Google account, and any calls or messages to that number will be forwarded to your mobile number. But unlike phone numbers issued by the major mobile providers, Google Voice numbers can&#8217;t be stolen unless someone also hacks your Google password &#8212; in which case you likely have much bigger problems.</p>
<p>With Google Voice, there is no customer service person who can be conned over the phone into helping out. There is no retail-store employee who will <a href="https://www.flashpoint-intel.com/blog/sim-swap-fraud-account-takeover/" target="_blank" rel="noopener">sell access to your SIM information for a paltry $80 payday</a>. <span class="pullquote pqright">In this view of security, customer service becomes a customer disservice.</span></p>
<p>Mind you, this isn&#8217;t my advice. The above statement summarizes the arguments allegedly made by one of the most accomplished SIM swap thieves in the game today. On July 12, 2018, <a href="https://motherboard.vice.com/en_us/article/a3q7mz/hacker-allegedly-stole-millions-bitcoin-sim-swapping" target="_blank" rel="noopener">police in California arrested <strong>Joel Ortiz</strong></a>, a 20-year-old college student from Boston who&#8217;s accused of using SIM swaps to steal more than $5 million in cryptocurrencies from 40 victims.</p>
<p>Ortiz allegedly had help from a number of unnamed accomplices who collectively targeted high-profile and wealthy people in the cryptocurrency space. In one of three brazen attacks at a bitcoin conference this year, Ortiz allegedly used his SIM swapping skills to steal more than $1.5 million from a cryptocurrency entrepreneur, including nearly $1 million the victim had crowdfunded.</p>
<div id="attachment_44685" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/54b23a24.joelortiz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/joelortiz.png"><img class="wp-image-44685" src="media/54b23a24.joelortiz.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/joelortiz.png" alt="" width="593" height="418" /></a><p class="wp-caption-text">A July 2018 posting from the &#8220;OG&#8221; Instagram account &#8220;0&#8221;, allegedly an account hijacked by Joel Ortiz (pictured holding an armload of Dom Perignon champagne).</p></div>
<p>Ortiz reportedly was a core member of <strong>OGUsers[dot]com</strong>, a forum that&#8217;s grown wildly popular among criminals engaging in SIM swaps to steal cryptocurrency and hijack high-value social media accounts. OG is short for &#8220;original gangster,&#8221; and it refers to a type of &#8220;street cred&#8221; for possession of social media account names that are relatively short (between one and six characters). On ogusers[dot]com, Ortiz allegedly picked the username &#8220;j&#8221;. Short usernames are considered more valuable because they confer on the account holder the appearance of an early adopter on most social networks.</p>
<p>Discussions on the Ogusers forum indicate Ortiz allegedly is the current occupant of perhaps the most OG username on Twitter &#8212; <a href="https://twitter.com/0" target="_blank" rel="noopener">an account represented by the number zero &#8220;0&#8221;.</a> The alias displayed on that twitter profile is &#8220;j0&#8221;. He also apparently controls <a href="https://www.instagram.com/0/" target="_blank" rel="noopener">the Instagram account by the same number</a>, as well as the <a href="https://www.instagram.com/t/" target="_blank" rel="noopener">Instagram account &#8220;t&#8221;</a>, which lists its alias as &#8220;Joel.&#8221;</p>
<p>Shown below is <a href="https://webcache.googleusercontent.com/search?q=cache:8ZasZ_YIBqsJ:https://ogusers.com/Thread-Sim-Swap-prevention-guide+&amp;cd=2&amp;hl=en&amp;ct=clnk&amp;gl=us" target="_blank" rel="noopener">a cached snippet</a> from an Ogusers forum posting by &#8220;j&#8221; (allegedly Ortiz), advising people to remove their mobile phone number from all important multi-factor authentication options, and to replace it with something like Google Voice.</p>
<div id="attachment_44683" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/a1cf6cad.j-ogusers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/j-ogusers.png"><img class="wp-image-44683" src="media/a1cf6cad.j-ogusers.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/j-ogusers.png" alt="" width="597" height="198" /></a><p class="wp-caption-text">Ogusers SIM swapper &#8220;j&#8221; advises forum members on how not to become victims of SIM swapping. Click to enlarge.</p></div>
<p><span id="more-44676"></span></p>
<h4>WHAT CAN YOU DO?</h4>
<p>All four major wireless carriers &#8212; AT&amp;T, <strong>Sprint</strong>, <strong>T-Mobile</strong> and <strong>Verizon</strong> &#8212; let customers add security against SIM swaps and related schemes by setting a PIN that needs to be provided over the phone or in person at a store before account changes should be made. But these security features can be bypassed by incompetent or corrupt mobile store employees.</p>
<p>Mobile store employees who can be bought or tricked into conducting SIM swaps are known as &#8220;plugs&#8221; in the Ogusers community, and without them SIM swapping schemes become much more difficult.</p>
<p>Last week, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/" target="_blank" rel="noopener">broke the news</a> that police in Florida had arrested a 25-year-old man who&#8217;s accused of being part of a group of at least nine individuals who routinely conducted fraudulent SIM swaps on high-value targets. Investigators in that case say they have surveillance logs that show the group discussed working directly with mobile store employees to complete the phone number heists.</p>
<p>In May I wrote about a 27-year-old Boston man who had his three-letter Instagram account name stolen after <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">thieves hijacked his number at T-Mobile</a>. Much like Mr. Terpin, the victim in that case had already taken T-Mobile&#8217;s advice and placed a PIN on his account that was supposed to prevent the transfer of his mobile number. T-Mobile ultimately acknowledged that the heist had been carried out by a rogue T-Mobile store employee.</p>
<p>So consider establishing a Google Voice account if you don&#8217;t already have one. In setting up a new number, Google requires you to provide a number capable of receiving text messages. Once your Google Voice number is linked to your mobile, the device at the mobile number you gave to Google should notify you instantly if anyone calls or messages the Google number (this assumes your phone has a Wi-Fi or mobile connection to the Internet).</p>
<p>After you&#8217;ve done that, take stock of every major account you can think of, replacing your mobile phone number with your Google Voice number in every case it is listed in your profile.</p>
<p>Here&#8217;s where it gets tricky. If you&#8217;re all-in for taking the anti-SIM-hacking advice allegedly offered by Mr. Ortiz, once you&#8217;ve changed all of your multi-factor authentication options from your mobile number to your Google Voice number, <em>you then have to remove that mobile number you supplied to Google from your Google Voice account.</em> After that, you can still manage calls/messages to and from your Google Voice number using the Google Voice mobile app.</p>
<p>And notice what else Ortiz advises in the screen shot above to secure one&#8217;s Gmail and other Google accounts: Using a physical security key (where possible) to replace passwords. <a href="https://krebsonsecurity.com/2018/08/reddit-breach-highlights-limits-of-sms-based-authentication/#more-44585" target="_blank" rel="noopener">This post from a few weeks back</a> explains what security keys are, how they can help harden your security posture, and how to use them. If Google&#8217;s own internal security processes count for anything, the company <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">recently told this author that none of its 85,000 employees had been successfully phished for their work credentials since January 2017</a>, when Google began requiring all employees to use physical security keys in place of one-time passwords sent to a mobile device.</p>
<p><strong>Standard disclaimer:</strong> If the only two-factor authentication offered by a company you use is based on sending a one-time code via SMS or automated phone call, <em>this is still better than relying on simply a password alone</em>. But one-time codes generated by a mobile phone app such as <a href="https://www.authy.com" target="_blank" rel="noopener">Authy</a> or <strong>Google Authenticator</strong> are more secure than SMS-based options because they are not directly vulnerable to SIM-swapping attacks.</p>
<p>The web site <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">twofactorauth.org</a> breaks down online service providers by the types of secondary authentication offered (SMS, call, app-based one-time codes, security keys). Take a moment soon to review this important resource and harden your security posture wherever possible.</p>


feed_id: https://krebsonsecurity.com/?p=44670
title: Indian Bank Hit in $13.5M Cyberheist After FBI ATM Cashout Warning
uri: Indian-Bank-Hit-in-13-5M-Cyberheist-After-FBI-ATM-Cashout-Warning
url:
https://krebsonsecurity.com/2018/08/indian-bank-hit-in-13-5m-cyberheist-after-fbi-atm-cashout-warning/

content:
<p>On Sunday, Aug. 12, KrebsOnSecurity carried <a href="https://krebsonsecurity.com/2018/08/fbi-warns-of-unlimited-atm-cashout-blitz/" target="_blank" rel="noopener">an exclusive</a>: The <strong>FBI</strong> was warning banks about an imminent &#8220;ATM cashout&#8221; scheme about to unfold across the globe, thanks to a data breach at an unknown financial institution. On Aug. 14, a bank in India disclosed hackers had broken into its servers, stealing nearly $2 million in fraudulent bank transfers and $11.5 million unauthorized ATM withdrawals from more than two dozen cash machines across multiple countries.</p>
<p><img class="aligncenter wp-image-44724" src="media/80673321.atmdissolve.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/atmdissolve.png" alt="" width="596" height="315" /></p>
<p>The FBI put out its alert on Friday, Aug. 10. The criminals who hacked into Pune, India-based <a href="https://en.wikipedia.org/wiki/Cosmos_Bank" target="_blank" rel="noopener">Cosmos Bank</a> executed their two-pronged heist the following day, sending co-conspirators to fan out and withdraw a total of about $11.5 million from 25 ATMs in Canada, Hong Kong and India.</p>
<p>The FBI warned it had intelligence indicating that criminals had breached an unknown payment provider&#8217;s network with malware to access bank customer card information and exploit network access, enabling large scale theft of funds from ATMs.</p>
<p>Organized cybercrime gangs that coordinate these so-called &#8220;unlimited attacks&#8221; typically do so by hacking or phishing their way into a bank or payment card processor. Just prior to executing on ATM cashouts, the intruders will remove many fraud controls at the financial institution, such as maximum withdrawal amounts and any limits on the number of customer ATM transactions daily.</p>
<p>The perpetrators alter account balances and security measures to make an unlimited amount of money available at the time of the transactions, allowing for large amounts of cash to be quickly removed from the ATM.</p>
<p>My story about the FBI alert was breaking news on Sunday, but it was just a day short of useful to financial institutions impacted by the breach and associated ATM cashout blitz.</p>
<p>But according to Indian news outlet <a href="https://www.dailypioneer.com/todays-newspaper/cosmos-cooperative-bank-loses-rs-94-cr-in-cyber-heist.html" target="_blank" rel="noopener">Dailypionneer.com</a>, there was a second attack carried out on August 13, when the Cosmos Bank hackers transferred nearly $2 million to the account of <strong>ALM Trading Limited</strong> at <strong>Hang Seng Bank</strong> in Hong Kong.</p>
<p>&#8220;The bank came to know about the malware attack on its debit card payment system on August 11, when it was observed that unusually repeated transactions were taking place through ATM VISA and Rupay Card for nearly two hours,&#8221; writes <strong>TN Raghunatha</strong> for the Daily Pioneer.<span id="more-44670"></span></p>
<p>Cosmos Bank was quick to point out that the attackers did not access systems tied to customer accounts, and that the money taken was from the bank&#8217;s operating accounts. The 112-year-old bank blamed the attack on &#8220;a switch which is operative for the payment gateway of <strong>VISA/Rupay Debit</strong> card and not on the core banking system of the bank, the customers’ accounts and the balances are not at all affected.&#8221;</p>
<p>Visa issued a statement saying it was aware of the compromise affecting a client financial institution in India.</p>
<p>&#8220;Our systems were able to identify the issue quickly, enabling the financial institution to take appropriate action,&#8221; the company said. &#8220;Visa is working closely with the client in supporting their ongoing investigations on the matter.&#8221;</p>
<p>The FBI said these types of ATM cashouts are most common at smaller financial institutions that may not have sufficient resources dedicated to staying up to date with the latest security measures for handling payment card data.</p>
<p>“Historic compromises have included small-to-medium size financial institutions, likely due to less robust implementation of cyber security controls, budgets, or third-party vendor vulnerabilities,” the alert read. “The FBI expects the ubiquity of this activity to continue or possibly increase in the near future.”</p>
<p>In July 2018, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/07/hackers-breached-virginia-bank-twice-in-eight-months-stole-2-4m/" target="_blank" rel="noopener">broke the news of two separate cyber break-ins</a> at tiny <b>National Bank of Blacksburg </b>in Virginia in a span of just eight months that led to ATM cashouts netting thieves more than $2.4 million. The Blacksburg bank is now suing its insurance provider for refusing to fully cover the loss.</p>
<p>As reported by <a href="https://in.reuters.com/article/cyber-heist-india/cosmos-bank-loses-13-5-million-in-cyber-attack-idINKBN1KZ1J9" target="_blank" rel="noopener">Reuters</a>, Cosmos Bank said in a press statement that its main banking software receives debit card payment requests via a “switching system” that was bypassed in the attack. “During the malware attack, a proxy switch was created and all the fraudulent payment approvals were passed by the proxy switching system,” the bank said.</p>
<p>Translation: If a financial institution is not fully encrypting its payment processing network, this can allow intruders with access to the network to divert and/or alter the response that gets sent when an ATM transaction is requested. In one such scenario, the network might say a given transaction should be declined, but thieves could still switch the signal for that ATM transaction from &#8220;declined&#8221; to &#8220;approved.&#8221;</p>
<p>One final note: Several news outlets have confused the attack that hit Cosmos Bank with another ATM crime called &#8220;<a href="https://krebsonsecurity.com/?s=jackpotting&amp;x=0&amp;y=0" target="_blank" rel="noopener">jackpotting</a>,&#8221; which requires thieves to have physical access to the inside of the cash machine and the ability to install malicious software that makes the ATM spit out large chunks of cash at once. Like ATM cashouts/unlimited operations, jackpotting attacks do not directly affect customer accounts but instead drain ATMs of currency.</p>


feed_id: https://krebsonsecurity.com/?p=44746
title: Alleged SIM Swapper Arrested in California
uri: Alleged-SIM-Swapper-Arrested-in-California
url: https://krebsonsecurity.com/2018/08/alleged-sim-swapper-arrested-in-california/
content:
<p>Authorities in Santa Clara, Calif. have arrested and charged a 19-year-old area man on suspicion hijacking mobile phone numbers as part of a scheme to steal large sums of bitcoin and other cryptocurrencies. The arrest is the third known law enforcement action this month targeting &#8220;SIM swappers,&#8221; individuals who specialize in stealing wireless phone numbers and hijacking online financial and social media accounts tied to those numbers.</p>
<p><img class="aligncenter size-full wp-image-44764" src="media/c598e34d.simsmaller.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/simsmaller.png" alt="" width="517" height="281" /></p>
<p><strong>Xzavyer Clemente Narvaez</strong> was arrested Aug. 17, 2018 by investigators working with Santa Clara County&#8217;s &#8220;<strong>REACT task force</strong>,&#8221; which says it&#8217;s targeting those involved in &#8220;the takeovers of cell phone, email and financial accounts resulting in the theft of cryptocurrency.&#8221;</p>
<p>Prosecutors allege Narvaez used the proceeds of his crimes (estimated at &gt; $1 million in virtual currencies) to purchase luxury items, including <a href="https://www.cargurus.com/Cars/2018-McLaren-570S-Price-c27201" target="_blank" rel="noopener">a McLaren</a> &#8212; a $200,000 high-performance sports car. Investigators said they interviewed several alleged victims of Narvaez, including one man who reported being robbed of $150,000 in virtual currencies after his phone number was hijacked.</p>
<p>A fraudulent SIM swap occurs when a victim&#8217;s cell phone service is redirected from <a href="https://en.wikipedia.org/wiki/Subscriber_identity_module" target="_blank" rel="noopener">a SIM card</a> under the control of the victim to one under the control of the suspect, without the knowledge or authorization of the victim account holder.</p>
<p>When a victim experiences a fraudulent SIM swap, their phone suddenly has no service and all incoming calls and text messages are sent to the attacker&#8217;s device. This includes any one-time codes sent via text message or automated phone call that many companies use to supplement passwords for their online accounts.</p>
<p>Narvaez came to law enforcement&#8217;s attention following the arrest of <strong>Joel Ortiz</strong>, a <a href="https://www.bostonglobe.com/business/2018/07/31/boston-school-valedictorian-arrested-cryptocurrency-theft/7p5MnBQKPlpz3V96IwGb5K/story.html" target="_blank" rel="noopener">gifted</a> 20-year-old college student from Boston who was <a href="https://motherboard.vice.com/en_us/article/a3q7mz/hacker-allegedly-stole-millions-bitcoin-sim-swapping" target="_blank" rel="noopener">charged in July 2018</a> with using SIM swaps to steal more than $5 million in cryptocurrencies from 40 victims.</p>
<p>A redacted statement of facts Santa Clara prosecutors shared with KrebsOnSecurity says records obtained from Google revealed that a cellular device used by Ortiz to commit SIM swaps had at one point been used to access the Google account identified as <strong>Xzavyer.Narvaez@gmail.com</strong>.</p>
<p>That statement refers frequently to the term <a href="https://support.bell.ca/Mobility/Smartphones_and_mobile_internet/What_is_an_IMEI_number_and_how_can_I_find_mine" target="_blank" rel="noopener">IMEI</a>; this is the <strong>International Mobile Equipment Identity</strong> number, which is a unique identification number or serial number that all mobile phones and smartphones have.</p>
<p>Prosecutors used data gathered from a large number of tech companies to put Narvaez&#8217;s phone in specific places near his home in <a href="https://www.google.com/maps/place/Tracy,+CA/@37.7185753,-121.7267412,10z/data=!4m5!3m4!1s0x809014590a55994d:0xe8466f79e0af1499!8m2!3d37.7396513!4d-121.4252227" target="_blank" rel="noopener">Tracy, Calif.</a> at the time his alleged victims reported having their phones hijacked. His alleged re-use of the same mobile device for multiple SIM hijacks ultimately gave him away:</p>
<blockquote><p>&#8220;On 7/18/18, investigators received information from an AT&amp;T investigator regarding unauthorized SIM swaps conducted through an AT&amp;T authorized retailer. He reported that approximately 28 SIM swaps were conducted using the same employee ID number over an approximately two-week time period in November 2017. Records were obtained that included a list of IMEI numbers used to take over the victims&#8217; cell phone numbers.&#8221;</p>
<p>&#8220;AT&amp;T provided call detail records pertaining to the IMEI numbers listed to conduct the SIM swaps. One of those IMEI numbers, ending in 3218, was used to take over the cell phone of a resident of Illinois. I contacted the victim who verified that some of his accounts had been &#8220;hacked&#8221; in late 2017 but said he did not suffer any financial loss. Sgt. Tarazi analyzed the AT&amp;T location data pertaining to that account takeover. That data indicated that on 7/27/17, when the victim from Illinois lost access to his accounts, the IMEI (ending in 3218) of the cell phone controlling the victim&#8217;s cell phone number was located in Tracy, California.&#8221;</p>
<p>&#8220;The specific tower is located approximately 0.6 miles away from the address 360 Yosemite Drive in Tracy. Several &#8220;NELOS&#8221; records (GPS coordinates logged by AT&amp;T to estimate the location of devices on their network) indicate the phone was within 1000 meters of 360 Yosemite Drive in Tracy. AT&amp;T also provided call detail records pertaining to Narvaez&#8217; cell phone account, which was linked to him through financial services account records. Sgt. Tarazi examined those records and determined that Narvaez&#8217; own cell phone was connected to the same tower and sector during approximately the same time frame that the suspect device (ending in 3218) was connected to the victim&#8217;s account.&#8221;</p></blockquote>
<p><strong>Apple</strong> responded to requests with records pertaining to customer accounts linked to that same suspect IMEI number. Those records identified three California residents whose Apple accounts were linked to that same IMEI number.<span id="more-44746"></span></p>
<div id="attachment_44771" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/fe92149a.narvaez-statement.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/narvaez-statement.png"><img class="wp-image-44771" src="media/fe92149a.narvaez-statement.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/narvaez-statement.png" alt="" width="598" height="589" /></a><p class="wp-caption-text">A snippet from a redacted &#8220;statement of facts&#8221; filed by prosecutors in the Narvaez case.</p></div>
<p><strong>Verizon</strong> provided call detail records pertaining to the IMEI number ending in 3218. From the statement of facts:</p>
<blockquote><p>These records that this phone had in fact been used to access the two Verizon numbers listed above, and at the same time was connected to a Verizon celltower located approximately 1.3 miles away from 360 Yosemite Drive in Tracy, CA. This cell tower was the closest Verizon tower to 360 Yosemite Drive.</p>
<p>&#8220;Records obtained from DMV indicated the 2018 McLaren was purchased from a car dealership in Southern California. Sale records obtained from the dealership indicated the payment for the vehicle was made by Tiffany Ross, primarily using bitcoin, accepted by the merchant processor <strong>BitPay</strong> on behalf of the dealership. The remainder of the price of the vehicle was financed through the trade-in of a 2012 Audi R8. The buyer/s listed email address was a Gmail address. Records also indicated the Audi R8 had been purchased in June 2017 by Xzavyer Narvaez. The entire balance for that vehicle was paid using bitcoin.&#8221;</p>
<p>&#8220;A different Gmail address was listed under the buyer&#8217;s contact information. Google provided records indicating both e-mail addresses used to pay for the vehicles belonged to Xzavyer Narvaez.&#8221;</p>
<p>&#8220;BitPay provided records that identified the Bitcoin transactions in which the vehicles were purchased. Investigator Berry utilized the Bitcoin blockchain, which is the distributed public ledger of all historical transactions on the Bitcoin network, to trace the flow of the bitcoins used to purchase the McLaren back to an address attributed to the cryptocurrency exchanger Bittrex.&#8221;</p>
<p>&#8220;Bittrex verified that funds from Bittrex to the output address identified in the blockchain that led to the purchase of the McLaren came from Narvaez&#8217; account, and verified the address utilized for the deposit of bitcoin into that account. The Bitcoin blockchain currently indicates that Narvaez&#8217; Bittrex deposit address has had more than 157 bitcoin flow through it, in 208 transactions, between 7/12/18 and 3/12/18. Based on the current market value of a bitcoin, 157 bitcoins are currently worth approximately S1,000,000.&#8221;</p></blockquote>
<p>Narvaez faces four counts of using personal identifying information without authorization; four counts of altering and damaging computer data with intent to defraud or obtain money, or other value; and grand theft of personal property of a value over nine hundred and fifty thousand dollars. He is expected to issue a plea on Sept. 26, 2018. A copy of the charges against him is <a href="media/24ea7744.20180821070250_4126887_1_Charging-Language-Component-Felony.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/20180821070250_4126887_1_Charging-Language-Component-Felony.pdf" target="_blank" rel="noopener">here</a> (PDF).</p>
<p>Federal authorities also have been active in targeting SIM swappers of late. One day after Narvaez was apprehended, <a href="https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/" target="_blank" rel="noopener">police in Florida arrested a 25-year-old man</a> accused of being part of a group of about nine people that allegedly stole hundreds of thousands of dollars in virtual currencies from SIM swap victims. That case drew on collaboration with <strong>Homeland Security Investigations</strong>, which acted on a tip from a concerned mom in Michigan who overheard her son impersonating an AT&amp;T employee and found bags of SIM cards in his room.</p>
<p>All of the major wireless companies let customers protect their accounts from SIM swapping by selecting a personal identification number (PIN) that is supposed to be required when account changes are requested in person or over the phone. But one big part of the problem is that many of these SIM swappers <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">are working directly with retail mobile store employees</a> who know how to bypass these protections.</p>
<p>If you&#8217;re concerned about the threat from SIM hijacking, experts say it might be time to disconnect your mobile phone number from important accounts. We discussed options for doing just that in last week&#8217;s column, <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">Hanging Up on Mobile in the Name of Security</a>.</p>


feed_id: https://krebsonsecurity.com/?p=44787
title: Experts Urge Rapid Patching of ‘Struts’ Bug
uri: Experts-Urge-Rapid-Patching-of-Struts-Bug
url: https://krebsonsecurity.com/2018/08/experts-urge-rapid-patching-of-struts-bug/
content:
<p>In September 2017, <strong>Equifax</strong> disclosed that a failure to patch one of its Internet servers against a pervasive software flaw &#8212; in a Web component known as <strong>Apache Struts</strong> &#8212; led to a breach that <a href="https://krebsonsecurity.com/2017/09/the-equifax-breach-what-you-should-know/" target="_blank" rel="noopener">exposed personal data on 147 million Americans</a>. Now security experts are warning that blueprints showing malicious hackers how to exploit a newly-discovered Apache Struts bug are available online, leaving countless organizations in a rush to apply new updates and plug the security hole before attackers can use it to wriggle inside.</p>
<p><img class="aligncenter wp-image-44794" src="media/6cf2f819.apache.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/apache.png" alt="" width="596" height="336" /></p>
<p>On Aug. 22, the <strong>Apache Software Foundation</strong> released software updates to fix <a href="https://cwiki.apache.org/confluence/display/WW/S2-057" target="_blank" rel="noopener">a critical vulnerability</a> in Apache Struts, a Web application platform used by an estimated 65 percent of Fortune 100 companies. Unfortunately, computer code that can be used to exploit the bug has since been posted online, meaning bad guys now have precise instructions on how to break into vulnerable, unpatched servers.</p>
<p>Attackers can exploit a Web site running the vulnerable Apache Struts installation using nothing more than a Web browser. The bad guy simply needs to send the right request to the site and the Web server will run any command of the attacker&#8217;s choosing. At that point, the intruder could take any number of actions, such as adding or deleting files, or copying internal databases.</p>
<p>An <a href="https://semmle.com/news/apache-struts-CVE-2018-11776" target="_blank" rel="noopener">alert</a> about the Apache security update was posted Wednesday by <strong>Semmle</strong>, the San Francisco software company whose researchers discovered the bug.</p>
<p>&#8220;The widespread use of Struts by leading enterprises, along with the proven potential impact of this sort of vulnerability, illustrate the threat that this vulnerability poses,&#8221; the alert warns.</p>
<p>&#8220;Critical remote code execution vulnerabilities like the one that affected Equifax and the one we announced today are incredibly dangerous for several reasons: Struts is used for publicly-accessible customer-facing websites, vulnerable systems are easily identified, and the flaw is easy to exploit,&#8221; wrote Semmle co-founder <strong>Pavel Avgustinov</strong>. &#8220;A hacker can find their way in within minutes, and exfiltrate data or stage further attacks from the compromised system. It’s crucially important to update affected systems immediately; to wait is to take an irresponsible risk.&#8221;<span id="more-44787"></span></p>
<p>The timeline in the 2017 Equifax breach highlights how quickly attackers can take advantage of Struts flaws. On March 7, 2017, Apache released a patch for a similarly dangerous Struts flaw, and within 24 hours of that update security experts began tracking signs that attackers were exploiting vulnerable servers.</p>
<p>Just three days after the patch was released, attackers found Equifax&#8217;s servers were vulnerable to the Apache Struts flaw, and used the vulnerability as an initial entry point into the credit bureau&#8217;s network.</p>
<div id="attachment_44798" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/eb398194.equifaxhack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/equifaxhack.png"><img class="wp-image-44798" src="media/eb398194.equifaxhack.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/equifaxhack.png" alt="" width="598" height="276" /></a><p class="wp-caption-text">A slide from &#8220;We are all Equifax,&#8221; an RSA talk given in April 2018 by Derek Weeks.</p></div>
<p>The vulnerability affects all supported versions of Struts 2. Users of Struts <em>2.3</em> should upgrade to version <em>2.3.35;</em> users of Struts <em>2.5</em> should upgrade to <em>2.5.17</em>.</p>
<p>More technical details about this bug from its discoverer, <strong>Man Yue Mo</strong>, are <a href="https://lgtm.com/blog/apache_struts_CVE-2018-11776" target="_blank" rel="noopener">here</a>. The Apache Software Foundation&#8217;s advisory is <a href="https://cwiki.apache.org/confluence/display/WW/S2-057" target="_blank" rel="noopener">here</a>.</p>


feed_id: https://krebsonsecurity.com/?p=44825
title: Who’s Behind the Screencam Extortion Scam?
uri: Who-s-Behind-the-Screencam-Extortion-Scam
url: https://krebsonsecurity.com/2018/08/whos-behind-the-screencam-extortion-scam/
content:
<p>The <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener">sextortion email scam last month</a> that invoked a real password used by each recipient and threatened to release embarrassing Webcam videos almost certainly was not the work of one criminal or even one group of criminals. Rather, it&#8217;s likely that additional spammers and scammers piled on with their own versions of the phishing email after noticing that some recipients were actually paying up. The truth is we may never find out who&#8217;s responsible, but it&#8217;s still fun to follow some promising early leads and see where they take us.</p>
<p><img class="aligncenter wp-image-44412" src="media/4f452cd1.sextortion.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/07/sextortion.png" alt="" width="520" height="93" /></p>
<p>On Aug. 7, 2018 &#8212; <em>five days</em> before <a href="https://krebsonsecurity.com/2018/07/sextortion-scam-uses-recipients-hacked-passwords/" target="_blank" rel="noopener">my story about the sextortion scam innovation</a> went viral &#8212; a user <a href="https://www.hmailserver.com/forum/viewtopic.php?f=7&amp;p=205651" target="_blank" rel="noopener">on the forum of free email service hMailServer</a> posted a copy of the sextortion email he received, noting that it included a password he&#8217;d formerly used online.</p>
<p>Helpfully, this user pasted a great deal of information from the spam email message, including the domain name from which it was sent (<strong>williehowell-dot-com</strong>) and the Internet address of the server that sent the message (46.161.42.91).</p>
<p>A look at the other domain names registered to this IP address block 46.161.42.x reveals some interesting patterns:</p>
<p>46.161.42.51 mail25.uscourtsgov[.]com<br />
46.161.42.52 mail24.uscourtsgov[.]com<br />
46.161.42.53 mail23.uscourtsgov[.]com<br />
46.161.42.54 mail22.uscourtsgov[.]com<br />
46.161.42.55 mail21.uscourtsgov[.]com<br />
46.161.42.56 mail20.uscourtsgov[.]com<br />
46.161.42.57 mail19.uscourtsgov[.]com<br />
46.161.42.58 mail18.uscourtsgov[.]com<br />
46.161.42.59 mail17.uscourtsgov[.]com<br />
46.161.42.60 mail16.uscourtsgov[.]com<br />
46.161.42.61 mail15.uscourtsgov[.]com<br />
46.161.42.62 mail14.uscourtsgov[.]com<br />
46.161.42.63 mail13.uscourtsgov[.]com<br />
46.161.42.64 mail12.uscourtsgov[.]com<br />
46.161.42.65 mail11.uscourtsgov[.]com<br />
46.161.42.66 mail10.uscourtsgov[.]com<br />
46.161.42.67 mail9.uscourtsgov[.]com<br />
46.161.42.68 mail8.uscourtsgov[.]com<br />
46.161.42.69 mail7.uscourtsgov[.]com<br />
46.161.42.70 mail6.uscourtsgov[.]com<br />
46.161.42.71 mail5.uscourtsgov[.]com<br />
46.161.42.72 mail4.uscourtsgov[.]com<br />
46.161.42.73 mail3.uscourtsgov[.]com<br />
46.161.42.74 mail2.uscourtsgov[.]com<br />
46.161.42.75 mail1.uscourtsgov[.]com<br />
46.161.42.76 mail[.]commarysmith[.]com<br />
46.161.42.77 mail.joancooper[.]com<br />
46.161.42.78 mail.florencewoods[.]com<br />
46.161.42.79 mail.ednawest[.]com<br />
46.161.42.80 mail.ethelwebb[.]com<br />
46.161.42.81 mail.eleanorhunt[.]com<br />
46.161.42.82 mail.sallypierce[.]com<br />
46.161.42.83 mail.reginaberry[.]com<br />
46.161.42.84 mail.junecarroll[.]com<br />
46.161.42.85 mail.robertaharper[.]com<br />
46.161.42.86 mail.reneelane[.]com<br />
46.161.42.87 mail.almaaustin[.]com<br />
46.161.42.88 mail.elsiekelley[.]com<br />
46.161.42.89 mail.vickifields[.]com<br />
46.161.42.90 mail.ellaoliver[.]com<br />
46.161.42.91 mail.williehowell[.]com<br />
46.161.42.92 mail.veramccoy[.]com<br />
46.161.42.93 mail.agnesbishop[.]com<br />
46.161.42.94 mail.tanyagilbert[.]com<br />
46.161.42.95 mail.mattiehoffman[.]com<br />
46.161.42.96 mail.hildahopkins[.]com<br />
46.161.42.97 beckymiles[.]com<br />
46.161.42.98 mail.fayenorris[.]com<br />
46.161.42.99 mail.joannaleonard[.]com<br />
46.161.42.100 mail.rosieweber[.]com<br />
46.161.42.101 mail.candicemanning[.]com<br />
46.161.42.102 mail.sherirowe[.]com<br />
46.161.42.103 mail.leticiagoodman[.]com<br />
46.161.42.104 mail.myrafrancis[.]com<br />
46.161.42.105 mail.jasminemaxwell[.]com<br />
46.161.42.106 mail.eloisefrench[.]com</p>
<p>Search Google for <a href="https://scamwarners.com/forum/viewtopic.php?f=9&amp;p=371314" target="_blank" rel="noopener">any of those two-name domains above</a> (e.g., fayenorris-dot-com) and you&#8217;ll see virtually all of them were used in these sextortion emails, and most were registered at the end of May 2018 through domain registrar <strong>Namecheap</strong>.</p>
<p>Notice the preponderance of the domain <strong>uscourtsgov-dot-com </strong>in the list above. <em>All of those two-name domains used <a href="https://www.geeksforgeeks.org/dns-domain-name-server/" target="_blank" rel="noopener">domain name servers</a> (DNS servers) from uscourtsgov-dot-com at the time these emails were sent</em>. In early June 2018, uscourtsgov-dot-com was associated with <a href="https://blog.comodo.com/pc-security/subpoena-new-variant-of-sigma-ransomware/" target="_blank" rel="noopener">a Sigma ransomware scam delivered via spam</a>. Victims who wanted their files back had to pay a bitcoin ransom.</p>
<p>In the months just before either the password-laced sextortion scam or the uscourtsgov-dot-com ransomware scam, uscourtsgov-com was devoid of content, aside from a message promoting the spamming services of the web site <strong>mtaexpert-dot-info</strong>. Uscourtsgov-dot-com is now offline, but it was active as of two weeks ago. Here&#8217;s what its homepage looked like:</p>
<div id="attachment_44828" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/6447149c.uscourtsgov4-18.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/uscourtsgov4-18.png"><img class="wp-image-44828" src="media/6447149c.uscourtsgov4-18.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/uscourtsgov4-18.png" alt="" width="595" height="97" /></a><p class="wp-caption-text">The domain uscourtsgov-dot-com was redirecting visitors to mtaexpert-dot-info for many months up to and including the sextortion email campaign. Image: Domaintools.com</p></div>
<p>Interestingly, this same message promoting mtaexpert-dot-info appeared on the homepages of many other two-name domain names mentioned above (including fayenorris-dot-com):</p>
<div id="attachment_44830" style="width: 603px" class="wp-caption aligncenter"><a class="lightbox" href="media/b666dfd2.fayenorris.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/fayenorris.png"><img class="wp-image-44830" src="media/b666dfd2.fayenorris.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/fayenorris.png" alt="" width="593" height="60" /></a><p class="wp-caption-text">Like uscourtsgov-dot-com, Fayenorris-dot-com also urged visitors to go to mtaexpert-dot-info.</p></div>
<p><span id="more-44825"></span>In the email delivery space, MTA stands for mail transfer agent, and this MTA Expert company is essentially an anonymous spamming service. The screen shot below is from an Internet Archive <a href="https://web.archive.org/web/20180212055137/http://www.mtaexpert.info:80/" target="_blank" rel="noopener">cached copy of mtaexpert-dot-info</a>:</p>
<div id="attachment_44829" style="width: 604px" class="wp-caption aligncenter"><a class="lightbox" href="media/d5c5a0f0.mtaexpert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/mtaexpert.png"><img class="wp-image-44829" src="media/d5c5a0f0.mtaexpert.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/mtaexpert.png" alt="" width="594" height="218" /></a><p class="wp-caption-text">Mtaexpert-dot-info, as it appeared in Feb 2018. Source: Archive.org.</p></div>
<p>Mtaexpert-dot-info doesn&#8217;t disclose who owns the site, and current WHOIS registration records for the domain are obscured by privacy services. But thanks to a historic WHOIS record lookup at <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools.com</a> [full disclosure: Domaintools is an advertiser on this site], we can see that for about a week in May 2018 the WHOIS privacy veil briefly dropped off and revealed the following record:</p>
<p>Registrant Name: HICHAM AALLAM<br />
Registrant Organization: investissonsorg<br />
Registrant Street: RED ANASS BLOC 26 N 3 ROUTE DE TETOUANE<br />
Registrant City: TANGER<br />
Registrant State/Province: Tanger-Tetouan<br />
Registrant Postal Code: 90001<br />
Registrant Country: MA<br />
Registrant Phone: +212.626280317<br />
Registrant Phone Ext:<br />
Registrant Fax:<br />
Registrant Fax Ext:<br />
Registrant Email: hicham.aallam60@gmail.com</p>
<p>Who is <strong>Hicham Aallam</strong>? According to <a href="https://www.linkedin.com/in/hicham-aallam-264271a7/" target="_blank" rel="noopener">his LinkedIn page</a>, he is an email marketer living in Morocco and working for a company called <strong>Active Sun Network</strong>. His resume says he also works for <strong>AdGenics</strong>, which according to anti-spam group <a href="https://en.wikipedia.org/wiki/The_Spamhaus_Project" target="_blank" rel="noopener">Spamhaus</a> is a well-known spamming operation with a long, sordid history. AdGenics, a.k.a. <strong>Cabo Networks</strong> a.k.a <strong>SIFT Logic</strong>, is <a href="https://www.spamhaus.org/rokso/evidence/ROK10200/adgenics-cabo-networks/main-info" target="_blank" rel="noopener">currently Number Six</a> on Spamhaus&#8217; <a href="https://www.spamhaus.org/statistics/spammers/" target="_blank" rel="noopener">Top Ten Worst Spammers list.</a></p>
<p>Contacted via LinkedIn, Aallam said he was unaware that his email service was used in the either the sextortion or ransomware campaigns linked to the above-mentioned domains. He said an ad for Mtaexpert-dot-info automatically gets shown on the home page of any site that is configured to use his email-sending scripts.</p>
<p>Aallam says he charges customers to use these scripts, but that he only had one semi-recent customer: A person who contacted him using the Skype name &#8220;brian.ortega_4&#8221; paid roughly $250 worth of the cryptocurrency <strong>Ethereum</strong> (ETH) on Apr. 3, 2018 for a license to MTA Experts&#8217; mailing script. <a href="https://etherscan.io/tx/0x49bd964caa6cce2049785fe51118323d2e7881a937211f5672322e4a68f53f38" target="_blank" rel="noopener">Here is a record of that transaction</a>. All of the ETH transactions attributed to and from that account can be seen <a href="https://etherscan.io/txs?a=0x2e30c1cc487b7de18784fec20c1190920e92ce63" target="_blank" rel="noopener">here</a>.</p>
<p>Okay, so we still might not know who&#8217;s responsible for sending some of these sextortion emails, and it could well be one of Aallam&#8217;s other clients behind these two schemes. Nevertheless, it&#8217;s always fascinating to see how far one can get just by following a few breadcrumbs.</p>
<p>One final breadcrumb to follow: The Internet address space occupied by the uscourtsgov-dot-com and the sextortion-related domains &#8212; 46.161.42.0/24. In May 2018, <strong>RiskIQ</strong> published <a href="media/aa964eee.MEWKit-Cryptotheft-Newest-Weapon-RiskIQ-Research.pdf" data-original-source="https://cdn.riskiq.com/wp-content/uploads/2018/05/MEWKit-Cryptotheft-Newest-Weapon-RiskIQ-Research.pdf" target="_blank" rel="noopener">a detailed report</a> (PDF) about a complex phishing scheme that used <a href="https://mailman.nanog.org/pipermail/nanog/2018-April/095105.html" target="_blank" rel="noopener">an address adjacent to uscourtsgov-dot-com</a> in a bid to steal Ethereum from <a href="https://www.myetherwallet.com/" target="_blank" rel="noopener">MyEtherWallet</a> users.</p>
<p>The registered owner of the Internet address space is a &#8220;<strong>Barbarich_Viacheslav_Yuryevich</strong>,&#8221; which is the same name as the owner of the network <a href="https://bgp.he.net/AS41995#_whois" target="_blank" rel="noopener">AS41995</a>, a.k.a. <strong>web-shield-dot-biz</strong>. <img class="aligncenter wp-image-44845" src="media/83cbd7f6.webshield.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/webshield.png" alt="" width="598" height="231" /></p>
<p>A different block of addresses that we can see in the graphic above assigned to Web-Shield &#8212; 146.185.241.0/24 &#8212; contains a metric truckload of domains involved in selling stolen credit cards.</p>
<p><a class="lightbox" href="media/113ed2b9.websiteshosted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/websiteshosted.png"><img class="aligncenter wp-image-44847" src="media/113ed2b9.websiteshosted.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/websiteshosted.png" alt="" width="598" height="281" /></a></p>
<p>Loyal readers of this site will notice a familiar domain there: <strong>Rescator</strong>. It belongs to a seasonsed cybercriminal by the same name who has been <a href="https://krebsonsecurity.com/2013/12/whos-selling-credit-cards-from-target/" target="_blank" rel="noopener">closely linked to the Target</a> and <a href="https://krebsonsecurity.com/2015/05/deconstructing-the-2014-sally-beauty-breach/" target="_blank" rel="noopener">Sally Beauty breaches</a>, among many others. To this day &#8212; almost four years after the Target breach &#8212; the home page to Rescator&#8217;s stolen card shop includes a picture of Yours Truly as a postage stamp that reads, &#8220;As advertised by Brian Krebs.&#8221;</p>
<p><a class="lightbox" href="media/441c3542.rescator.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/rescator.png"><img class="aligncenter wp-image-44846" src="media/441c3542.rescator.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/rescator.png" alt="" width="592" height="227" /></a></p>
<p>KrebsOnSecurity would like to thank security researcher <a href="https://www.twitter.com/bad_packets" target="_blank" rel="noopener">Troy Mursch</a> and anti-spam crusader <a href="https://krebsonsecurity.com/tag/ron-guilmette/" target="_blank" rel="noopener">Ron Guilmette</a> for their assistance in this research.</p>


feed_id: https://krebsonsecurity.com/?p=44744
title: Fiserv Flaw Exposed Customer Data at Hundreds of Banks
uri: Fiserv-Flaw-Exposed-Customer-Data-at-Hundreds-of-Banks
url: https://krebsonsecurity.com/2018/08/fiserv-flaw-exposed-customer-data-at-hundreds-of-banks/
content:
<p><strong>Fiserv, Inc.,</strong> a major provider of technology services to financial institutions, just fixed a glaring weakness in its Web platform that exposed personal and financial details of countless customers across hundreds of bank Web sites, KrebsOnSecurity has learned.</p>
<p>Brookfield, Wisc.-based Fiserv [<a href="https://www.nasdaq.com/symbol/fisv" target="_blank" rel="noopener">NASDAQ:FISV</a>] is a Fortune 500 company with 24,000 employees and $5.7 billion in earnings last year. Its account and transaction processing systems power the Web sites for hundreds of financial institutions &#8212; mostly small community banks and credit unions.</p>
<p><img class="aligncenter wp-image-44816" src="media/f469fe28.fiserve.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/fiserve.png" alt="" width="597" height="302" /></p>
<p>Two weeks ago this author heard from security researcher <a href="https://www.linkedin.com/in/kristianhermansen/" target="_blank" rel="noopener">Kristian Erik Hermansen</a>, who said he&#8217;d discovered something curious while logged in to an account at a tiny local bank that uses Fiserv&#8217;s platform.</p>
<p>Hermansen had signed up to get email alerts any time a new transaction posted to his account, and he noticed the site assigned his alert a specific &#8220;event number.&#8221; Working on a hunch that these event numbers might be assigned sequentially and that other records might be available if requested directly, Hermansen requested the same page again but first edited the site&#8217;s code in his browser so that his event number was decremented by one digit.</p>
<p>In an instant, he could then view and edit alerts previously set up by another bank customer, and could see that customer&#8217;s email address, phone number and the last four digits of their bank account number.</p>
<p>Hermansen said a cybercriminal could abuse this access to enumerate all other accounts with activity alerts on file, and to add or delete phone numbers or email addresses to receive alerts about account transactions.</p>
<p>This would allow any customer of the bank to spy on the daily transaction activity of other customers, and perhaps even target customers who signed up for high minimum balance alerts (e.g., &#8220;alert me when the available balance goes below $5,000&#8221;).</p>
<p><span class="pullquote pqleft">&#8220;I shouldn&#8217;t be able to see this data,&#8221; Hermansen said. &#8220;Anytime you spend money that should be a private transaction between you and your bank, not available for everyone else to see.&#8221;</span></p>
<p>Hermansen said he told his bank about what he found, and that he tried unsuccessfully to get the attention of different Fiserv employees, including the company&#8217;s CEO via LinkedIn. But he wasn&#8217;t sure whether the flaw he found existed in all bank sites running on Fiserv&#8217;s ebanking platform, or just his bank&#8217;s installation.</p>
<p>Naturally, KrebsOnSecurity offered to help figure that out, and to get Fiserv&#8217;s attention, if warranted. Over the past week I signed up for accounts at two small local banks that each use Fiserv&#8217;s online banking platform.</p>
<p>In both cases I was able to replicate Hermansen&#8217;s findings and view email addresses, phone numbers, partial account numbers and alert details for other customers of each bank just by editing a single digit in a Web page request. I was relieved to find I could not use my online account access at one bank to view transaction alerts I&#8217;d set up at a different Fiserv affiliated bank.</p>
<p><div id="attachment_44822" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/d00d40fc.web13.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/web13.png"><img class="wp-image-44822" src="media/d00d40fc.web13.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/web13.png" alt="" width="598" height="277" /></a><p class="wp-caption-text">A single digit changed in a Web browser request caused someone else&#8217;s alerts to pop up in my account at this small local bank in Virginia.</p></div><span id="more-44744"></span></p>
<p>But it was not difficult to find <a href="https://www.google.com/search?q=site:secureinternetbank.com&amp;ei=iiaAW7uCOMG4jwT9i72AAQ&amp;start=40&amp;sa=N&amp;biw=1745&amp;bih=922" target="_blank" rel="noopener">hundreds of other Fiserv-affiliated banks</a> that would be just as vulnerable. If a bank is using Fiserv&#8217;s platform, it usually says so somewhere at the bottom of the bank&#8217;s home page. Another giveaway is that most of the bank sites using Fiserv display the same root domain name in the browser address bar after login: <a href="https://www.google.com/search?q=site:secureinternetbank.com&amp;ei=giaAW8mnJciijwS36L6IDg&amp;start=30&amp;sa=N&amp;biw=1745&amp;bih=922" target="_blank" rel="noopener"><strong>secureinternetbank.com</strong></a>.</p>
<p>Fiserv said in a statement that the problem stemmed from an issue with &#8220;a messaging solution available to a subset of online banking clients.&#8221; Fiserv declined to say exactly how many financial institutions may have been impacted overall. But experts tells KrebsOnSecurity that some 1,700 banks currently use Fiserv&#8217;s retail (consumer-focused) banking platform alone. </p>
<p>&#8220;Fiserv places a high priority on security, and we have responded accordingly,&#8221; Fiserv spokesperson <strong>Ann Cave</strong> said. &#8220;After receiving your email, we promptly engaged appropriate resources and worked around the clock to research and remediate the situation. We developed a security patch within 24 hours of receiving notification and deployed the patch to clients that utilize a hosted version of the solution. We will be deploying the patch this evening to clients that utilize an in-house version of the solution.&#8221;</p>
<p>This author confirmed that Fiserv no longer shows a sequential event number in their banking sites and has replaced them with a pseudo-random string.</p>
<p><strong>Julie Conroy</strong>, research director with market analyst firm <a href="https://www.aitegroup.com" target="_blank" rel="noopener">Aite Group</a>, said the kinds of banks that use Fiserv&#8217;s platform mostly are those that can&#8217;t afford to build and maintain their own.</p>
<p>&#8220;These financial institutions use a core banking provider like Fiserv because they don&#8217;t have the wherewithal to do it on their own, so they&#8217;re really trusting Fiserv to do this on their behalf,&#8221; Conroy said. &#8220;This will not only reflect on Fiserv&#8217;s brand, but also it will impact customer&#8217;s perception about their small local bank, which is already struggling to compete with the larger, nationwide institutions.&#8221;</p>
<p><strong>Allen Weinberg</strong>, partner and co-founder at <a href="https://www.glenbrook.com" target="_blank" rel="noopener">Glenbrook Partners LLC</a>, said the ability of fraudsters to edit account transaction alerts somewhat negates the value of these alerts in helping consumers fight fraud tied to their online banking accounts.</p>
<p>&#8220;If a fraudster can just turn off the alerts, there&#8217;s one less protection that consumers think they have,&#8221; Weinberg said. &#8220;I think consumers do rely in large part on these alerts to help them detect fraudulent activity.&#8221;</p>
<p>The weaknesses in Fiserv&#8217;s platform is what&#8217;s known as an &#8220;information disclosure&#8221; vulnerability. While these are among the most common types of security issues with Web sites, they are also perhaps the most preventable and easily fixed. </p>
<p>Nevertheless, disclosure flaws can be just as damaging to a company&#8217;s brand as other more severe types of security errors. Other notable security incidents involving recent information disclosure issues include <a href="https://krebsonsecurity.com/2018/04/panerabread-com-leaks-millions-of-customer-records/" rel="noopener" target="_blank">a weakness at Panera Bread&#8217;s site</a> that exposed tens of millions of customer records, and <a href="https://krebsonsecurity.com/2018/07/lifelock-bug-exposed-millions-of-customer-email-addresses/" rel="noopener" target="_blank">a bug in identity protection service LifeLock&#8217;s site</a> that revealed email addresses for millions of customers. </p>


feed_id: https://krebsonsecurity.com/?p=44889
title: Instagram’s New Security Tools are a Welcome Step, But Not Enough
uri: Instagram-s-New-Security-Tools-are-a-Welcome-Step-But-Not-Enough
url:
https://krebsonsecurity.com/2018/08/instagrams-new-security-tools-are-a-welcome-step-but-not-enough/

content:
<p><strong>Instagram</strong> users should soon have more secure options for protecting their accounts against Internet bad guys.  On Tuesday, the <strong>Facebook</strong>-owned social network said it is in the process of rolling out support for third-party authentication apps. Unfortunately, this welcome new security offering does nothing to block Instagram account takeovers when thieves manage to hijack a target&#8217;s mobile phone number &#8212; an increasingly common crime.</p>
<div id="attachment_44899" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/5010f0af.insta2fa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/insta2fa.png"><img class="wp-image-44899" src="media/5010f0af.insta2fa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/insta2fa.png" alt="" width="595" height="513" /></a><p class="wp-caption-text">New two-factor authentication options Instagram says it is rolling out to users over the next few weeks.</p></div>
<p>For years, security experts have warned that hackers are exploiting weak authentication at Instagram to commandeer accounts. Instagram has long offered users a security option to have a one-time code sent via text message to a mobile device, but these codes can be intercepted via several methods (more on that in a bit).</p>
<p>The new authentication offering requires users to download a third-party app like <a href="https://www.authy.com" target="_blank" rel="noopener">Authy</a>, <a href="https://www.duo.com" target="_blank" rel="noopener">Duo</a> or <a href="https://www.google.com/landing/2step/" target="_blank" rel="noopener">Google Authenticator</a>, which generates a one-time code that needs to be entered after the user supplies a password.</p>
<p>In <a href="https://instagram-press.com/blog/2018/08/28/new-tools-to-help-keep-instagram-safe/" target="_blank" rel="noopener">a blog post Tuesday</a>, Instagram said support for third-party authenticator apps &#8220;has begun to roll out and will be available to the global community in the coming weeks.</p>
<p>Instagram put me on a whitelist of accounts to get an early peek at the new security feature, so these options probably aren&#8217;t yet available to most users. But there&#8217;s a screenshot below that shows the multi-factor options available in the mobile app. When these options do become more widely available, Instagram says people can use a third-party app to receive a one-time code. To do this:</p>
<ol style="font-weight: 400;">
<li>Go to your Settings.</li>
<li>Scroll down and tap Two-Factor Authentication.</li>
<li>If you haven&#8217;t already turned two-factor authentication on, tap Get Started.</li>
<li>Tap next to Authentication App, then follow the on-screen instructions.</li>
<li>Enter the confirmation code from the third party authentication app to complete the process.</li>
</ol>
<p>Note that if you have previously enabled SMS-based authentication, it is likely still enabled unless and until you disable it. The app also prompts users to save a series of recovery codes, which should be kept in a safe place in case one&#8217;s mobile device is ever lost.</p>
<p><img class="aligncenter size-full wp-image-44912" src="media/40a236cb.ig2fa.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/08/ig2fa.png" alt="" width="472" height="498" /></p>
<h4>WHAT IT DOESN&#8217;T FIX</h4>
<p>Instagram has received quite a lot of bad press lately from publications reporting numerous people who had their accounts hijacked even though they had Instagram&#8217;s SMS authentication turned on. The thing is, many of those stories have been about people having their Instagram accounts hijacked because fraudsters were able to hijack their mobile phone number.</p>
<p>In these cases, the fraudsters were able to hijack the Instagram accounts because <em>Instagram allows</em> <em>users to reset their account passwords with a single factor &#8212; using nothing more than a text message sent to a mobile number on file</em>. <em>And nothing in these new authentication offerings will change that for people who have shared their mobile number with Instagram.</em></p>
<p>Criminals can and do exploit SMS-based password reset requests to hijack Instagram accounts by executing unauthorized &#8220;<a href="https://krebsonsecurity.com/?s=sim+swap&amp;x=0&amp;y=0" target="_blank" rel="noopener">SIM swaps</a>,&#8221; i.e., tricking the target&#8217;s mobile provider into transferring the phone number to a device or account they control and intercepting the password reset link sent via SMS. Once they hijack the target&#8217;s mobile number, they can then reset the password for the associated Instagram account.</p>
<p>I asked Instagram if there was any way for people who have supplied the company with their phone number to turn off SMS-based password reset requests. I received this response from their PR folks:</p>
<p>&#8220;I can confirm that disabling SMS two factor will not disable the ability to reset a password via SMS,&#8221; a spokesperson said via email. &#8220;We recommend that the community use a third-party app for authentication, in place of SMS authentication. We&#8217;ll continue to iterate and improve on this product to keep people safe on our platform.&#8221;<span id="more-44889"></span></p>
<p>Fraudulent SIM swaps illustrate the value of moving away from SMS-based authentication when more secure options are available. Doing so makes one less likely to be targeted by these phone number hijacks, which are generally perpetrated by determined, well-organized attackers.</p>
<p>The hard truth is that if an attacker wants control over your mobile number badly enough, he will get it. And if he does, he will likely gain access to far more than your Instagram account: Someone who hacks your phone number can then compromise <em>any account</em> that allows authentication or password resets via text message or automated phone call.</p>
<p>In May, KrebsOnSecurity documented the case of a Boston man who had his Instagram account hijacked <a href="https://krebsonsecurity.com/2018/05/t-mobile-employee-made-unauthorized-sim-swap-to-steal-instagram-account/" target="_blank" rel="noopener">after a crooked T-Mobile employee transferred his phone number</a> to another device without authorization. Additionally, authorities in <a href="https://krebsonsecurity.com/2018/08/alleged-sim-swapper-arrested-in-california/" target="_blank" rel="noopener">California</a> and <a href="https://krebsonsecurity.com/2018/08/florida-man-arrested-in-sim-swap-conspiracy/" target="_blank" rel="noopener">Florida</a> have recently arrested several men accused of conducting similar attacks, and according to charging documents all of these individuals routinely worked with associates at mobile phone stores to carry out their heists.</p>
<p>In case you missed it, KrebsOnSecurity <a href="https://krebsonsecurity.com/2018/08/hanging-up-on-mobile-in-the-name-of-security/" target="_blank" rel="noopener">ran a story earlier this month</a> about the sound security advice allegedly offered by one of the most accomplished SIM swappers of late, who recommended using Internet-based phone services like <strong>Google Voice</strong> in lieu of relying on mobile phone providers for multi-factor authentication.</p>
<p><em>Standard disclaimer:</em> If SMS-based authentication is the strongest form of extra security a Web site offers, this is still far better than relying on just passwords for login security. If app-based options are available, take advantage of that. If the site in question offers <a href="https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-employee-phishing/" target="_blank" rel="noopener">hardware-based security keys</a>, even better. <a href="https://www.twofactorauth.org" target="_blank" rel="noopener">Twofactorauth.org</a> lists multi-factor authentication options for hundreds of sites, including probably many that you use on a daily basis. Take a moment this week to strengthen your login options.</p>


feed_id: https://krebsonsecurity.com/?p=44930
title: Alleged ‘Satori’ IoT Botnet Operator Sought Media Spotlight, Got Indicted
uri: Alleged-Satori-IoT-Botnet-Operator-Sought-Media-Spotlight-Got-I
url:
https://krebsonsecurity.com/2018/09/alleged-satori-iot-botnet-operator-sought-media-spotlight-got-indicted/

content:
<p>A 20-year-old from Vancouver, Washington was indicted last week on federal hacking charges and for allegedly operating the &#8220;<strong>Satori</strong>&#8221; botnet, a malware strain unleashed last year that infected hundreds of thousands of wireless routers and other &#8220;Internet of Things&#8221; (IoT) devices. This outcome is hardly surprising given that the accused&#8217;s alleged alter ego has been relentless in seeking media attention for this global crime machine.</p>
<div id="attachment_44948" style="width: 259px" class="wp-caption alignright"><img class=" wp-image-44948" src="media/bb642a44.schuchman.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/schuchman.png" alt="" width="249" height="220" /><p class="wp-caption-text">Schuchman, in an undated photo posted online and referenced in a &#8220;dox,&#8221; which alleged in Feb. 2018 that Schuchman was Nexus Zeta.</p></div>
<p><em>The Daily Beast</em>&#8216;s <strong>Kevin Poulsen</strong> broke the <a href="https://www.thedailybeast.com/newbie-hacker-fingered-for-monster-botnet?ref=home" target="_blank" rel="noopener">news</a> last week that federal authorities in Alaska indicted <strong>Kenneth Currin Schuchman</strong> of Washington on two counts of violating the Computer Fraud and Abuse Act by using malware to damage computers between August and November 2017.</p>
<p>The <a href="media/f3d2737c.Schuchman.pdf" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/Schuchman.pdf" target="_blank" rel="noopener">3-page indictment</a> (PDF) is incredibly sparse, and includes few details about the meat of the charges against Schuchman. But according to Poulsen, the charges are related to Schuchman&#8217;s alleged authorship and use of the Satori botnet. Satori is a variant of <a href="https://en.wikipedia.org/wiki/Mirai_(malware)" target="_blank" rel="noopener">the Mirai botnet</a>, a powerful IoT malware strain that first came online in July 2016.</p>
<p>&#8220;Despite the havoc he supposedly wreaked, the accused hacker doesn’t seem to have been terribly knowledgeable about hacking,&#8221; Poulsen notes.</p>
<p>Schuchman reportedly went by the handle &#8220;<strong>Nexus Zeta</strong>,&#8221; the nickname used by a fairly inexperienced and clumsy ne&#8217;er-do-well who has tried on multiple occasions to get KrebsOnSecurity to write about the Satori botnet. In January 2018, Nexus Zeta changed the login page for his <a href="https://blog.newskysecurity.com/masuta-satori-creators-second-botnet-weaponizes-a-new-router-exploit-2ddc51cc52a7?gi=8e5a55eb1727" target="_blank" rel="noopener">botnet control panel</a> that he used to remotely control his hacked routers to include a friendly backhanded reference to this author:</p>
<div id="attachment_44942" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/b0731728.masuta-krebs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/masuta-krebs.png"><img class="wp-image-44942" src="media/b0731728.masuta-krebs.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/masuta-krebs.png" alt="" width="598" height="462" /></a><p class="wp-caption-text">The login prompt for Nexus Zeta&#8217;s IoT botnet included the message &#8220;Masuta is powered and hosted on Brian Kreb&#8217;s [sic] 4head.&#8221; To be precise, it&#8217;s a 5head.</p></div>
<p>This wasn&#8217;t the first time Nexus Zeta said hello. In late November 2017, he chatted me up on on Twitter and Jabber instant message for several days. Most of the communications came from two accounts: &#8220;<strong>9gigs_ProxyPipe</strong>&#8221; on Twitter, and <strong>ogmemes123@jabber.ru</strong> (9gigs_ProxyPipe would later change its Twitter alias to Nexus Zeta, and <a href="media/86432b8d.imnexuszeta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/imnexuszeta.png" target="_blank" rel="noopener">Nexus Zeta himself admitted</a> that 9gigs_ProxyPipe was his Twitter account.)</p>
<p>In each case, this person wanted to talk about a new IoT botnet that he was &#8220;researching&#8221; and that he thought deserved special attention for its size and potential disruptive impact should it be used in a massive Distributed Denial-of-Service (DDoS) attack aimed at knocking a Web site offline &#8212; something for which Satori would soon become known.</p>
<div id="attachment_44949" style="width: 608px" class="wp-caption aligncenter"><a class="lightbox" href="media/46f9f836.ogmemes-jab.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/ogmemes-jab.png"><img class="wp-image-44949" src="media/46f9f836.ogmemes-jab.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/ogmemes-jab.png" alt="" width="598" height="252" /></a><p class="wp-caption-text">A Jabber instant message conversation with Nexus Zeta on Nov. 29, 2017.</p></div>
<p>Nexus Zeta&#8217;s Twitter nickname initially confused me because both 9gigs and ProxyPipe are names claimed by <strong>Robert Coelho</strong>, owner of <a href="https://www.proxypipe.com" target="_blank" rel="noopener">ProxyPipe</a> hosting (9gigs is a bit from one of Coelho&#8217;s Skype account names). Coelho&#8217;s sleuthing was quite instrumental in helping to <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">unmask 21-year-old New Jersey resident <strong>Paras Jha</strong> as the author of the original Mirai IoT botnet</a> (Jha later <a href="https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/" target="_blank" rel="noopener">pleaded guilty to co-authoring and using Mirai</a> and is due to be sentenced this month in Alaska and New Jersey). &#8220;Ogmemes&#8221; is from a nickname used by Jha and his Mirai botnet co-author.</p>
<p>On Nov. 28, 2017, 9gigs_ProxyPipe sent a <a href="https://twitter.com/9gigs_ProxyPipe/status/935543081549537281" target="_blank" rel="noopener">message</a> to the <a href="https://twitter.com/briankrebs" target="_blank" rel="noopener">KrebsOnSecurity Twitter account</a>:</p>
<p>&#8220;I have some information in regards to an incredibly dangerous IoT botnet you may find interesting,&#8221; the Twitter message read. &#8220;Let me know how you would prefer to communicate assuming you are interested.&#8221;</p>
<p>We connected on Jabber instant message. In our chats, Ogmemes123 said he couldn&#8217;t understand why nobody had noticed a botnet powered by a Mirai variant that had infected hundreds of thousands of IoT devices (he estimated the size of the botnet to be about 300,000-500,000 at the time). He also talked a lot about how close he was with Jha. <a href="https://twitter.com/9gigs_ProxyPipe/" target="_blank" rel="noopener">Nexus Zeta&#8217;s Twitter account profile photo</a> is a picture of Paras Jha. He also said he knew this new botnet was being used to attack ProxyPipe.</p>
<p>Less than 24 hours after that tweet from Nexus Zeta, I heard from ProxyPipe&#8217;s Coelho. They were under attack from a new Mirai variant.<span id="more-44930"></span></p>
<p>&#8220;We&#8217;ve been mitigating attacks recently that are about 270 gigabits [in volume],&#8221; Coelho wrote in an email. &#8220;Looks like <a href="https://twitter.com/9gigs_ProxyPipe/status/935543081549537281" target="_blank" rel="noopener">somebody tagged you on Twitter</a> pretending to be from ProxyPipe &#8212; likely the attacker? Just wanted to give you a heads up since that is not us, or anyone that works with ProxyPipe.&#8221;</p>
<p>From reviewing Nexus Zeta&#8217;s myriad postings on the newbie-friendly hacker forum <a href="https://krebsonsecurity.com/?s=hackforums&amp;x=0&amp;y=0" target="_blank" rel="noopener">Hackforums-dot-net</a>, it was clear that Nexus Zeta was an inexperienced, impressionable young man who wanted to associate himself with people closely tied to <a href="https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/" target="_blank" rel="noopener">the 2017 whodunnit over the original Mirai IoT botnet variant</a>. He also asked other Hackforums members for assistance in assembling his Mirai botnet:</p>
<div id="attachment_44952" style="width: 605px" class="wp-caption aligncenter"><a class="lightbox" href="media/50483fce.nz-hf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/nz-hf.png"><img class="wp-image-44952" src="media/50483fce.nz-hf.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/nz-hf.png" alt="" width="595" height="158" /></a><p class="wp-caption-text">Some of Nexus Zeta&#8217;s posts on Hackforums, where he asks for help in setting up a Mirai botnet variant. Click to enlarge.</p></div>
<p>In one conversation with Ogmemes123, I lost my cool and told him to quit running botnets or else go bore somebody else with his quest for publicity. He mostly stopped bugging me after that. That same day, Nexus Zeta spotted <a href="https://twitter.com/9gigs_ProxyPipe/status/936443244547751936" target="_blank" rel="noopener">a tweet</a> from security researcher <a href="https://www.twitter.com/bad_packets" target="_blank" rel="noopener">Troy Mursch</a> about the rapid growth of a new Mirai-like botnet.</p>
<p>&#8220;This is an all-time record for the most new unique IP addresses that I&#8217;ve seen added to the botnet in one day,&#8221; Mursch tweeted of the speed with which this new Mirai strain was infecting devices.</p>
<p>For weeks after that tweet, Nexus Zeta exchanged private twitter messages with Mursch and his team of botnet hunters at <a href="https://badpackets.net/" target="_blank" rel="noopener">Bad Packets LLC</a> in a bid to get them to Tweet or write about Satori/Masuta.</p>
<p>The following screenshots from their private Twitter discussions, republished with Mursch&#8217;s permission, showed that Nexus Zeta kept up the fiction with Mursch about his merely &#8220;researching&#8221; the activities of Satori. Mursch played along, and asked gently probing questions about the size, makeup and activities of a rapidly growing Satori botnet.</p>
<div id="attachment_44946" style="width: 487px" class="wp-caption aligncenter"><a class="lightbox" href="media/e56c5d4f.mirai-like.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/mirai-like.png"><img class="wp-image-44946 size-full" src="media/e56c5d4f.mirai-like.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/mirai-like.png" alt="" width="477" height="779" /></a><p class="wp-caption-text">9gigs_ProxyPipe (a.k.a. Nexus Zeta allegedly a.k.a Kenneth Schuchman) reaches out to security researcher Troy Mursch of Bad Packets LLC.</p></div>
<p>Early in their conversations, Nexus Zeta says he is merely following the visible daily Internet scanning that Satori generated each day in a constant search for newly infectable IoT devices. But as their conversations continue over several weeks, Nexus Zeta intimates that he has much deeper access to Satori.</p>
<div id="attachment_44947" style="width: 607px" class="wp-caption aligncenter"><a class="lightbox" href="media/f8885679.satori-cta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/satori-cta.png"><img class="wp-image-44947 " src="media/f8885679.satori-cta.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/satori-cta.png" alt="" width="597" height="500" /></a><p class="wp-caption-text">In this conversation from Nov. 29, 2017 between Nexus Zeta/9gigs_Proxypipe and Troy Mursch, the former says he is seeing lots of Satori victims from Argentina, Columbia and Egypt.</p></div>
<p>Although it long ago would have been easy to write a series of stories about this individual and his exploits, I had zero interest in giving him the attention he clearly craved. But thanks to naivete and apparently zero sense of self-preservation, Nexus Zeta didn&#8217;t have to wait long for others to start connecting his online identities to his offline world.</p>
<p>On Dec. 5, Chinese cybersecurity firm <strong>Netlab360</strong> released <a href="https://blog.netlab.360.com/wa-a-new-mirai-variant-is-spreading-in-worm-style-on-port-37215-and-52869/" target="_blank" rel="noopener">a report on Satori</a> noting that the IoT malware was spreading rapidly to Chinese-made <strong>Huawei</strong> routers with the help of two security vulnerabilities, including one &#8220;zero day&#8221; flaw that was unknown to researchers at the time. The report said a quarter million infected devices were seen scanning for vulnerable systems, and that much of the scanning activity traced back to infected systems in Argentina, Columbia and Egypt, the same hotspots that Nexus Zeta cited in his Nov. 29 Twitter chat with Troy Mursch (see screen shot directly above).</p>
<p>In a taunting post published Dec. 29, 2017 titled &#8220;<a href="https://research.checkpoint.com/good-zero-day-skiddie/" target="_blank" rel="noopener">Good Zero Day Kiddie</a>,&#8221; researchers at Israeli security firm <strong>CheckPoint</strong> pointed out that the domain name used as a control server to synchronize the activities of the Satori botnet &#8212; <strong>nexusiotsolutions-dot-net</strong> &#8212; was registered in 2016 to the email address <strong>nexuszeta1337@gmail.com. </strong>The CheckPoint report noted the name supplied in the original registration records for that domain was a &#8220;Caleb Wilson,&#8221; although the researchers correctly noted that this could be a pseudonym.</p>
<p>Perhaps the CheckPoint folks also knew the following tidbit, but chose not to publish it in their report: The email address nexuszeta1337@gmail.com was only ever used to register a single domain name (nexusiotsolutions-dot-net), according to a historic WHOIS record search at <a href="https://www.domaintools.com" target="_blank" rel="noopener">Domaintools.com</a> [full disclosure: DomainTools is an advertiser on this site.] But the phone number in that original domain name record was used to register one other domain: <strong>zetastress-dot-net</strong> (a &#8220;stresser&#8221; is another name for a DDoS-for-hire-service). The registrant name listed in that original record? You guessed it:</p>
<p>Registrant Name: kenny Schuchman<br />
Registrant Organization: ZetaSec Inc.<br />
Registrant Street: 8709 Ne Mason Dr, No. 4<br />
Registrant City: Vancouver<br />
Registrant State/Province: Washington<br />
Registrant Postal Code: 98662<br />
Registrant Country: US<br />
Registrant Phone: +1.3607267966<br />
Registrant Phone Ext:<br />
Registrant Fax:<br />
Registrant Fax Ext:<br />
Registrant Email: kenny.windwmx79@outlook.com</p>
<p>In April 2018 I heard from a source who said he engaged Nexus Zeta in a chat about his router-ravaging botnet and asked what kind of router Nexus Zeta trusted. According to my source, Nexus Zeta shared a screen shot of the output from his wireless modem&#8217;s Web interface, which revealed that he was connecting from <a href="https://whois.domaintools.com/96.60.80.101" target="_blank" rel="noopener">an Internet service provider</a> in Vancouver, Wash., where Schuchman lives.</p>
<div id="attachment_44943" style="width: 609px" class="wp-caption aligncenter"><a class="lightbox" href="media/5c499ece.satoriauthor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/satoriauthor.png"><img class="wp-image-44943" src="media/5c499ece.satoriauthor.png" data-original-source="https://krebsonsecurity.com/wp-content/uploads/2018/09/satoriauthor.png" alt="" width="599" height="338" /></a><p class="wp-caption-text">The Satori botnet author shared this screen shot of his desktop, which indicated he was using an Internet connection in Vancouver, Washington &#8212; where Schuchman currently lives with his father.</p></div>
<p>&#8220;During our discussions, I learned we have the same model of router,&#8221; the source said. &#8220;He asked me my router model, and I told him. He shared that his router was also an ActionTec model, and sent a picture. This picture contains his home internet address.&#8221;</p>
<p>This matched a comprehensive &#8220;dox&#8221; that someone published on <strong>Pastebin</strong> in Feb. 2018, declaring Nexus Zeta to be 20-year-old Kenneth Currin Schuchman from Vancouver, Washington. The dox said Schuchman used the aliases Nexus Zeta and Caleb Wilson, and listed all of the email addresses tied to Nexus Zeta above, plus his financial data and physical address.</p>
<p>&#8220;Nexus is known by many to be autistic and a compulsive liar,&#8221; the dox begins.</p>
<blockquote><p>&#8220;He refused to acknowledge that he was wrong or apologize, and since he has extremely poor opsec (uses home IP on everything), we have decided to dox him.</p>
<p>He was only hung around by few for the servers he had access to.<br />
He lies about writing exploits that were made before his time, and faking bot counts on botnets he made.<br />
He&#8217;s lied about having physical contact with Anna Senpai (Author of Mirai Botnet).&#8221;</p></blockquote>
<p>As detailed in the <em>Daily Beast</em> story and Nexus Zeta&#8217;s dox, Schuchman was diagnosed with <a href="https://en.wikipedia.org/wiki/Asperger_syndrome" target="_blank" rel="noopener">Asperger Syndrome</a> and autism disorder, and at one point when he was 15 Schuchman reportedly wandered off while visiting a friend in Bend, Ore., briefly prompting a police search <a href="https://www.bendbulletin.com/home/1972201-151/missing-teen-found-in-vancouver-wash" target="_blank" rel="noopener">before he was found near his mother&#8217;s home in Vancouver, Wash.</a></p>
<p>Nexus Zeta clearly had limited hacking skills initially and almost no <a href="https://en.wikipedia.org/wiki/Operations_security" target="_blank" rel="noopener">operational security</a>. Indeed, his efforts to gain notoriety for his illegal hacking activities eventually earned him just that, as it usually does.</p>
<p>But it&#8217;s clear he was a quick learner; in the span of about a year, Nexus Zeta was able to progress from a relatively clueless newbie to the helm of an international menace that launched powerful DDoS attacks while ravaging hundreds of thousands of systems.</p>


