BrianKrebs

Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07 Twitter: [@briankrebs](https://infosec.exchange/@briankrebs ) Linkedin: https://www.linkedin.com/in/bkrebs/

website: https://krebsonsecurity.com

Public Key

npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh

NIP-05 Address

[email protected]

Profile Code

nprofile1qqsxvgjseexsxl0ppxny56szxrmcn8uj9dmrgcugk0nu5ph7jjgrtrgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds7wxgyc

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh

Show more details

Last Notes

2024-06-17 17:14:51

Wired has a good story from @npub1gxm…hhnu about how the ShinyHunters group got access to Ticketmaster's Snowflake cloud account.
"Snowflake has not revealed details about how the hackers accessed the accounts, saying only that the intruders did not directly breach Snowflake’s network. This week, Google-owned security firm Mandiant, one of the companies engaged by Snowflake to investigate the breaches, revealed in a blog post that in some cases the hackers first obtained access through third-party contractors, without identifying the contractors or stating how this access aided the hackers in breaching the Snowflake accounts.
But according to one of the hackers who spoke with WIRED through a text chat, one of those firms was EPAM Systems, a publicly traded software engineering and digital services firm, founded by Belarus-born Arkadiy Dobkin, with current revenue of around $4.8 billion. The hacker says his group, which calls themselves ShinyHunters, used data found on an EPAM employee system to gain access to some of the Snowflake accounts."
https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/

2024-06-11 17:34:23

- reply

Amen! It's also a host plant for a huge number of native species, and major part of the food web.

2024-05-31 00:07:03

So, I guess we just need a constitutional amendment that says convicted felons can't hold the highest office in the land? Soonish? How hard would that be?

2024-05-30 17:25:49

Today's story: 'Operation Endgame' Hits Malware Delivery Platforms
Law enforcement agencies in the United States and Europe today announced Operation Endgame, a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware. Dubbed “the largest ever operation against botnets,” the international effort is being billed as the opening salvo in an ongoing campaign targeting advanced malware “droppers” or “loaders” like IcedID, Smokeloader and Trickbot.
https://krebsonsecurity.com/2024/05/operation-endgame-hits-malware-delivery-platforms/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/530/722/315/998/141/original/7d46d0d392a78485.png

2024-05-29 22:27:43

What a story: A former sheriff from Florida has received political asylum in Moscow, and is now a key player in Russia's disinformation operations against the West, the NYT reports.
"Working from an apartment crowded with servers and other computer equipment, Mr. Dougan has built an ever-growing network of more than 160 fake websites that mimic news outlets in the United States, Britain and France."
https://www.nytimes.com/2024/05/29/business/mark-dougan-russia-disinformation.html

2024-05-28 21:10:18

Haha, wow. Treasury just sanctioned 3 Chinese nationals for allegedly running 911S5, a giant botnet that was sold for about a decade as one of the most reliable and cheapest proxy services for routing your traffic through someone else's (infected) machine.
One of the guys sanctioned by Treasury today I named as the apparent head of 911S5 in China, in a 2022 deep dive on this venerated proxy service. 911S5 imploded less than a week later, saying it had been massively hacked and that all user data was wiped.
https://home.treasury.gov/news/press-releases/jy2375
https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/
https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/520/287/616/634/633/original/704e3a63b5f54439.png

2024-05-25 17:46:04

Finally got around to reading an important piece from @npub13d2…hgm2 in The Atlantic this month. I'm glad I did, b/c it puts a tremendous amount of sheer madness into perspective.
THE NEW PROPAGANDA WAR
Autocrats in China, Russia, and elsewhere are now making common cause with MAGA Republicans to discredit liberalism and freedom around the world.
https://infosec.exchange/@[email protected]/112394033190929944
https://www.theatlantic.com/magazine/archive/2024/06/china-russia-republican-party-relations/678271/?gift=hVZeG3M9DnxL4CekrWGK3xgKh4wbI9WqxWEqzvYfefo&utm_source=copy-link&utm_medium=social&utm_campaign=share

2024-05-25 16:34:17

Someone on Linkedin just praised a recent story and requested to connect, and in the same breath warned me that I'd somehow left clues in my writing that showed AI was used in the composition of the story. It's been a while since I wanted to reach through the interwebs and honk someone's nose.

2024-05-25 02:59:46

So the human $#!+weasel *ucker Carlson just aired an hour long video with Pavel Durov, the CEO of Telegram.
Mu*k's recent cozying up to Durov/Telegram while making gonzo claims about Telegram security and bashing Signal as somehow less secure starts to make more sense now.

2024-05-24 01:38:16

Just published the second-longest blog post in my 14 year career as an independent reporter.
This story is the result of a ridiculous amount of research. I hope you like it, because I learned tons reporting this, and there needs to be a broader conversation about some of the issues raised by this research. The lede:
Two weeks before Russia invaded Ukraine in February 2022, a large, mysterious new Internet hosting firm called Stark Industries Solutions materialized and quickly became the epicenter of massive distributed denial-of-service (DDoS) attacks on government and commercial targets in Ukraine and Europe. An investigation into Stark Industries reveals it is being used as a global proxy network that conceals the true source of cyberattacks and disinformation campaigns against enemies of Russia.
https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/493/032/714/434/729/original/a7917ebb22ccd10b.png

2024-05-21 18:53:26

- reply

The researchers mentioned that China has some law that governs who can map stuff in China. I didn't have time to dig into that with all the other interesting stuff in their study, but would love to learn more. The rest of the blank spots were largely uninhabited places, or at least places where the inhabitants apparently don't have mobile phones.

2024-05-21 18:24:19

Today's story: Why Your Wi-Fi Router Doubles as an Apple AirTag
Apple and the satellite-based broadband service Starlink each recently took steps to address new research into the potential security and privacy implications of how their services geo-locate devices. Researchers from the University of Maryland say they relied on publicly available data from Apple to track the location of billions of devices globally -- including non-Apple devices like Starlink systems -- and found they could use this data to monitor the destruction of Gaza, as well as the movements and in many cases identities of Russian and Ukrainian troops.
https://krebsonsecurity.com/2024/05/why-your-wi-fi-router-doubles-as-an-apple-airtag/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/479/999/709/224/128/original/0f466c92fa68b266.png

2024-05-19 02:48:36

Best thing I heard all week, from @npub1d4s…ds4g podcast, in re Telegram: "It's like having the Dark Web in your pocket." LOL https://risky.biz/RB748/

2024-05-17 02:03:58

Ruh roh
https://www.nytimes.com/2024/05/16/us/justice-alito-upside-down-flag.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/453/490/177/526/845/original/7f065eebc8d1a731.png

2024-05-15 17:06:56

I would like to be part of a modest democratic experiment wherein we only elect people who really don't want to hold the office, but are nonetheless very qualified and capable.

2024-05-13 15:33:49

TIL you can quickly find your own posts by including "from:me" in the search box and then a key word or phrase you're searching for. Yes, it took me this long to figure that out.

2024-05-12 16:07:04

Reason #2,391 why revisiting security assumptions is always a good idea.
[Bimi] No cryptographic connection between VMC and DKIM key
https://mailarchive.ietf.org/arch/msg/bimi/Ba3jFfJ8K6ic7qg4DzPsIsGW5UY/
My favorite part:
"I guess some may consider what I just said as an unimportant or a merely theoretical issue, so I would like to illustrate it with an example. Let's take the domain entrust.com. It has a DKIM key
configured at "dkim._domainkey.entrust.com". The TXT record is the following:
"v=DKIM1; k=rsa;
p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyGF0xzO7Eig1H8QdIErjEKOGnIVvoLU5VjcMRBRWZK65NinL+gVnjuMD2mYdjC3f+7sQCWxGDSKIFn/bB+iXxO2x1/ktkwXHQfQ/9FcFuy+LE0Snsm0SwXN/2l1m5f9e1xdswC+dzHt6DIpDSDENsRal019YKQTqwVyB++7QORwIDAQAB"
This is a 1024 bit RSA key, which is not up to modern standards. But breaking 1024 bit RSA is still only feasible for very powerful attackers. However, this key has another problem: it is vulnerable to
the Debian OpenSSL bug (CVE-2008-0166). It is trivially possible to
find the private key (you can use my tool badkeys -
https://badkeys.info/ - to do that):
https://github.com/badkeys/debianopenssl/blob/main/rsa1024/ssl/le32/25731-rnd.key"

2024-05-09 16:36:11

- reply

Dell said they recently identified the incident, and that the investigation is ongoin. They sent me a kind of boilerplate response:
"Dell Technologies has a cybersecurity program designed to limit risk to our environments, including those used by our customers and partners. Our program includes prompt assessment and response to identified threats and risks. We recently identified an incident involving a Dell portal with access to a database containing limited types of customer information including name, physical address and certain Dell hardware and order information. It did not include financial or payment information, email address, telephone number or any highly sensitive customer data. Upon discovering this incident, we promptly implemented our incident response procedures, applied containment measures, began investigating, and notified law enforcement. We have also engaged a third-party forensics firm to investigate this incident. We continue to monitor the situation and take steps to protect our customers’ information. Although we don’t believe there is significant risk to our customers given the type of information involved, we are taking proactive steps to notify them as appropriate."

2024-05-09 16:33:07

- reply

Actually, now that I'm re-reading my own story I see that scammers were mostly calling people directly and pretending to be Dell.

2024-05-09 15:31:35

So, back in 2016 I wrote a story about Dell customers getting inundated with spam spoofing the company and referencing the recipient's real name and actual Dell service tag ID for the recipient's computer. Dell responded by asking customers who receive these messages to report them.
https://krebsonsecurity.com/2016/02/dell-to-customers-report-service-tag-scams/
Today, Dell disclosed a breach involving "a Dell portal" which contained customer names, physical addresses, and Dell hardware and order information, including service tag, item description, date of order and related warranty info."
I've asked Dell when they discovered this and how long they believe the intruders had access.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/411/374/368/735/741/original/e43859a1d2a33439.png

2024-05-06 21:06:13

Basically all of the speaking requests I've received over the last six months, all any of them want to talk about is AI, b/c everyone is trying to position themselves as being the perfect partner to usher companies through the madness. I'm probably not going to be asked to do speaking much longer, b/c I find I am fairly hawkish on all the AI hype.
I guess I come from a pretty old-fashioned point of view on technology vs security, which is basically that the more you complexify something, the harder it is to secure. And most of the AI visions that companies are espousing would increase the complexity of security efforts by several orders of magnitude. The issue of data governance is just one small microcosm of that (one in which most fail at miserably already).
I think it's also safe to predict that first movers here (beyond the now entrenched big ones) are going to get clobbered by regulation soon.

2024-05-06 19:40:50

Random PSA: If you own a motor vehicle that has a spare tire, it's a good idea to check every once in a while that the spare actually has air in it enough to support the car. Had to get the spare out from under my truck (a hugely complicated maneuver that would be really unfun to do for the first time in an emergency), and found it had about 10 percent of the necessary air.
If you can't be bothered to check the pressure once a year or so, better keep an air pump in the trunk as well.

2024-05-06 16:40:46

Researchers at Leviathan Security have released some interesting findings that illustrate why your VPN service may not be as secure as it claims.
From the story:
"VPNs work by creating a virtual network interface that serves as an encrypted tunnel for communications. But researchers at Leviathan Security say they’ve discovered it’s possible to abuse an obscure feature built into the DHCP protocol so that other users on the local network are forced to connect to a rogue DHCP server.
“Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway,” Leviathan researchers Lizzie Moratti and Dani Cronce wrote. “When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it.”"
More here: https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/394/650/290/122/039/original/3bf5335e0a3e6a70.png

2024-05-04 14:44:54

Nothing like spending $1700 to fix an obnoxious noise in your car, only to hear the sound again when you're halfway home from the dealership.

2024-05-03 18:08:52

What a surprise.
"The auditor for former president Donald Trump’s media company was charged with “massive fraud” Friday by the Securities and Exchange Commission, which accused the firm of being a “sham audit mill” whose failures put investors at risk."
https://www.washingtonpost.com/technology/2024/05/03/trump-media-auditor-borgers-suspended-permanently/

2024-05-02 21:13:53

- reply

How about this? Lawmakers pass a law (gasp!) that says if you're a private company providing services to the entire populace on behalf of .gov, your site will use com/net/org only when it is interacting with the government. Full stop.
Probably even the extreme wingnuts in the GOP could get behind this, in a kind of "buy American" way.

2024-05-02 21:06:58

- reply

To be clear, I have nothing against private companies or citizens using whatever TLD they want. But we need to stop doing this on important .gov stuff. And I would consider the IRS to easily qualify there.

2024-05-02 21:05:11

- reply

IDK anything about Montengegrin IT capabilities, so I'll take your word for it. But it's worth pointing out that poorly secured or maintained IT resources can be commandeered to do crazy stuff. So your statement fills me with more dread. Thank you.

2024-05-02 20:50:41

It's always amazed me that ID.me, which you have to use in order to interact w/ the IRS online these days, has a top level domain from the country of Montenegro. Ublock Origin says they're injecting tracking links from Italy's TLD when you login at the irs.gov website.
What's next? Cookies from Colombia? AI from Anguilla?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/372/995/552/070/905/original/31a6646662b111f1.png

2024-05-01 23:32:52

Dropbox has disclosed a cybersecurity incident, in filing with the SEC:
https://www.board-cybersecurity.com/incidents/tracker/20240501-dropbox-inc-cybersecurity-incident/#8-k-filed-on-2024-05-01
On April 24, 2024, Dropbox, Inc. (“Dropbox” or “we”) became aware of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. We immediately activated our cybersecurity incident response process to investigate, contain, and remediate the incident. Upon further investigation, we discovered that the threat actor had accessed data related to all users of Dropbox Sign, such as emails and usernames, in addition to general account settings. For subsets of users, the threat actor also accessed phone numbers, hashed passwords, and certain authentication information such as API keys, OAuth tokens, and multi-factor authentication. Based on what we know as of the date of this filing, there is no evidence that the threat actor accessed the contents of users’ accounts, such as their agreements or templates, or their payment information. Additionally, we believe this incident was limited to Dropbox Sign infrastructure and there is no evidence that the threat actor accessed the production environments of other Dropbox products. We are continuing our investigation.

2024-05-01 14:45:00

Scenario: The (non chaotic evil) sysadmins of the world band together to go on strike. What's on their list of demands?
*Correct answers optional.

2024-04-30 17:27:55

- reply

I've decided that if I have to buy another new vehicle again, it will be a much older, lightly used or completely rebuilt car, preferably circa 2010 or before absolutely everything was connected to a CPU.

2024-04-30 17:17:19

Say what you will about Tesla, but they were the only car company who said they both require a court-ordered warrant before sharing your vehicle's location data AND tell customers about demands for their data.
This finding comes from the office of Sen. Ron Wyden, which asked the association representing automakers how their members respond to law enforcement requests for location information collected from internet-connected cars and trucks.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/360/825/775/989/184/original/7c2290419e5613ea.png

2024-04-30 15:40:23

A 26-year-old Finnish man was sentenced to more than six years in prison today after being convicted of hacking into an online psychotherapy clinic, leaking tens of thousands of patient therapy records, and attempting to extort the clinic and patients.
https://krebsonsecurity.com/2024/04/man-who-mass-extorted-psychotherapy-patients-gets-six-years/
Even though Julius "Zeekill" Kivimaki has a cybercrime rap sheet thicker than a dictionary, he will end up serving roughly half that time, because all that stuff he did before he turned 18 doesn't count toward first-time offender status.
BTW, the CEO of the now-bankrupt psychotherapy practice was prosecuted as well (database credentials "root/root") but received a suspended sentence.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/360/445/355/836/738/original/77405254350245bb.jpeg

2024-04-29 23:01:13

Well this has been a long time coming: The FCC today levied fines totaling nearly $200 million against the four major carriers -- including AT&T, Sprint, T-Mobile and Verizon -- for illegally sharing access to customers' location information without consent.
Some highlights: "The FCC's findings against AT&T, for example, show that AT&T sold customer location data directly or indirectly to at least 88 third-party entities. The FCC found Verizon sold access to customer location data (indirectly or directly) to 67 third-party entities. Location data for Sprint customers found its way to 86 third-party entities, and to 75 third-parties in the case of T-Mobile customers."
..."The fine amounts vary because they were calculated based in part on each day that the carriers continued sharing customer location data after being notified that doing so was illegal (the agency also considered the number of active third-party location data sharing agreements). The FCC notes that AT&T and Verizon took more than 320 days from the publication of the Times story to wind down their data sharing agreements; T-Mobile took 275 days; Sprint kept sharing customer location data for 386 days."
More here: https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wireless-carriers-for-selling-customer-location-data/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/356/517/639/037/736/original/3e29e58c3b3a01ce.jpg

2024-04-23 22:06:14

See, the problem is we need MORE guns in school.
"Tennessee passes bill to let teachers carry guns, a year after mass shooting"
https://www.washingtonpost.com/nation/2024/04/23/tennessee-bill-arming-teachers-guns-passes/

2024-04-22 21:45:11

The Brazilian news outlet Folha de S. Paulo reports that cybercriminals have breached the country's national treasury, and were able to issue bank orders and "divert resources." Details, such as what and how much may have been diverted, or how the attackers got in, are scant at the moment.
https://www.metropoles.com/brasil/sistema-do-tesouro-e-invadido-e-ha-suspeita-de-desvio-de-recursos
The original report seems to be behind a paywall
https://www1.folha.uol.com.br/mercado/2024/04/sistema-de-pagamentos-do-governo-e-invadido-e-ha-suspeita-de-desvio-de-recursos.shtml

2024-04-22 14:32:27

There is a newly discovered zero-day being used in the wild in yet another file transfer application -- in CrushFTP. It doesn't appear there is a CVE yet for this flaw.
https://www.crushftp.com/crush11wiki/Wiki.jsp?page=Update
Latest release that includes a patch is 11.1.0_3. Release notes:
https://crushftp.com/version11_build.html
Discussion on Reddit: https://old.reddit.com/r/crowdstrike/comments/1c88788/situational_awareness_20240419_crushftp_virtual/?ref=news.risky.biz

2024-04-19 23:47:48

MITRE, a not-for-profit that does important tech research for the U.S. federal government, has disclosed a breach involving the exploitation of two recent zero-day flaws in Ivanti devices. Their disclosure is worth reading.
https://www.mitre.org/news-insights/news-release/mitre-response-cyber-attack-one-its-rd-networks
From the recommendations:
-Anomaly Detection: Monitor VPN traffic for unusual patterns, such as spikes in connections (DS0029) or unusual geographic locations.
-Behavior Analysis: Look for deviations in user behavior, such as unusual login times (DS0002 or DS0028) or accessing unfamiliar resources.
-Network Segmentation: Segmenting networks can limit lateral movement (DS0029), making anomalous activities more apparent.
-Threat Intelligence Feeds: Stay updated with threat intelligence feeds to identify known malicious IP addresses (DS0029), domains, or file hashes (DS0022).
-Adversary Engagement: Deploy adversary engagement resources in your environment, such as deception environments and honey tokens that not only trigger detection but provide deeper insights into adversary TTPs.
h/t [@simontsui](https://infosec.exchange/@simontsui)

2024-04-18 14:50:08

Did AI write this headline? Free, my a$$. Glad my gear isn't "eligible" for this "free" upgrade.
"Logitech mouse and keyboard users are getting a free AI upgrade"
"Accessing ChatGPT just got a whole lot easier, and Logitech even made a new mouse for the new feature."
Via: https://news.ycombinator.com/item?id=40061731

2024-04-16 20:04:55

NBD. Not like it's a time-sensitive issue or anything.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/282/218/093/574/742/original/956ab8c1654493fd.png

2024-04-16 13:29:06

For nearly a dozen years, residents of South Carolina have been kept in the dark by state and federal investigators over who was responsible for hacking into the state's revenue department in 2012 and stealing tax and bank account information for 3.6 million people. The answer may no longer be a mystery: KrebsOnSecurity found compelling clues suggesting the intrusion was carried out by the same Russian hacking crew that stole of millions of payment card records from big box retailers like Home Depot and Target in the years that followed.
https://krebsonsecurity.com/2024/04/who-stole-3-6m-tax-records-from-south-carolina/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/280/659/775/019/030/original/769baa13b00453ec.png

2024-04-15 22:28:40

There are a few important preconditions necessary for this attack to work, but interesting story from Wired on Google recalling some Titan 2FA security keys due to a "misconfiguration" could allow an attacker who gets w/in 30 feet of someone holding one of these keys to communicate with that key or with the device the key is paired to.
https://www.wired.com/story/google-titan-security-key-recall-ble/

2024-04-15 16:53:34

The U.S. government is warning that smart locks securing entry to an estimated 50,000 dwellings nationwide contain hard-coded credentials that can be used to remotely open any of the locks. The lock's maker Chirp Systems remains unresponsive, even though it was first notified about the critical weakness in March 2021. Meanwhile, Chirp's parent company, RealPage, Inc., is being sued by multiple U.S. states for allegedly colluding with landlords to illegally raise rents.
https://krebsonsecurity.com/2024/04/crickets-from-chirp-systems-in-smart-lock-key-leak/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/275/801/103/714/169/original/19fbf6e64456f747.png

2024-04-15 14:49:39

So psyched to see 60 Minutes last night airing an interview w/ my friend and brilliant security expert [@nixonnixoff](https://infosec.exchange/@nixonnixoff), in a segment about Scattered Spider and the Las Vegas intrusions.
If you look real closely, you might notice KrebsOnSecurity briefly appears on the screen in some B-roll footage of Nixon surfing the web. :)
https://www.cbsnews.com/news/cybersecurity-investigators-worry-ransomware-attacks-may-worsen-as-young-hackers-in-us-work-with-russians-60-minutes-transcript/?ftag=CNM-00-10aab7d&linkId=396748575
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/275/305/578/073/947/original/14b67044c56b7313.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/275/309/933/979/603/original/f4865639b8a5ccf6.png

2024-04-14 03:22:09

I know who did it
https://apnews.com/article/south-carolina-hacking-tax-returns-2012-5984ce1c6f47938da7a671d0fccadd22
Why didn't anyone ask me?

2024-04-10 16:50:58

- reply

Some of the domains registered recently and ending in “twitter.com” currently do not resolve and contain no useful contact information in their registration records. Those include firefotwitter[.]com (firefox.com), ngintwitter[.]com (nginx.com), and webetwitter[.]com (webex.com).

2024-04-10 16:32:27

Today's story includes a well-boosted post from [@mjg59](https://nondeterministic.computer/@mjg59) about Twitter/X's colossal and hilarious screw-up trying to truncate all links ending in "twitter.com" to "x.com."
Twitter's Clumsy Pivot to X.com is a Gift to Phishers
On April 9, Twitter/X began automatically modifying links that mention "twitter.com" to redirect to "x.com" instead. But over the past 48 hours, dozens of new domain names have been registered that demonstrate how this change could be used to craft convincing phishing links -- such as fedetwitter[.]com, which is currently rendered as fedex.com in tweets.
https://krebsonsecurity.com/2024/04/twitters-clumsy-pivot-to-x-com-is-a-gift-to-phishers/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/247/405/662/684/309/original/5549734ff4e0f3c5.png

2024-04-09 22:30:14

If only Patch Tuesdays came around infrequently -- like total solar eclipse rare -- instead of just creeping up on us each month like The Man in the Moon. Although to be fair, it would be tough for Microsoft to eclipse the number of vulnerabilities fixed in this month's patch batch -- a record 147 flaws in Windows and related software.
https://krebsonsecurity.com/2024/04/aprils-patch-tuesday-brings-record-number-of-fixes/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/243/151/380/088/826/original/2c822b0fc8227ad4.png

2024-04-09 14:27:57

- reply

I can't stop laughing at this. Am I a bad person? It's just la la la [pleasing ukulele music floating on tranquil waters] GAAHHARRRRRRR!

2024-04-08 16:38:10

Really not appreciating the cloud cover and haze that is creeping in the DC area right now. Fingers crossed.

2024-04-08 16:20:29

Remember that time Change Healthcare paid $22M to the ALPHV ransomware group, which then stiffed affiliates and exit scammed? We only know they exit scammed because the affiliate who claimed responsibility for the intrusion at Change said they still had the data that ALPHV was paid to "delete".
https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/
Well, what goes around comes around. The stolen Change data may once again be up for sale. h/t [@AlvieriD](https://infosec.exchange/@AlvieriD)
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/236/029/758/015/096/original/57d7250278996c39.png

2024-04-07 20:15:24

Microsoft can build powerful and voracious AI products that are supposed to solve all of humanity's hard problems (like employees). But somehow this is a company that can't stop its hacked business customer accounts from sending me malware spam at least once a day.

2024-04-03 15:44:45

I guess we can all have a few laughs on our way to humanity's early grave. The deepfakes promoting the venerable HOPE hacker conference are priceless.
Xitter CEO:
https://twitter.com/hopeconf/status/1774829155227504915
MTG:
https://x.com/josephmenn/status/1775363327293792522

2024-04-01 21:18:00

- reply

Sometimes you get gems from LinkedIn:
From Chris Wysopal:
https://www.linkedin.com/in/wysopal/
"It would be interesting to run this analysis across all open source committers. I'm keen to understand if we can root out other backdoors by detecting signals like these learned from the XZ backdoor incident."
THIS!

2024-04-01 20:10:15

Some thoughts about attribution in the XZ backdoor, having just wasted so many hours digging into the details.
The email addresses used for a couple of years at least by the parties involved have absolutely *zero* trace in any kind data breach or database beyond Github/Gitlab, and maybe Tukaani and Debian and a few mailing lists.
Normally when I see this, the assumption is that we're dealing with a single-use or single-purpose email address that was created either for fraud or b/c someone is super paranoid about privacy.
The people in the latter camp who do this tend to have other tells that give them away, or at least *some* trace or home base in the online world. Especially if we're talking on the order of years using that address.
Either way, very few people do opsec well, and for every year you're operating under the same name, nick, number, email, etc you dramatically increase the risk of screwing up that opsec. And almost everyone does, eventually.
To see this complete lack of presence in breached databases once or twice in the course of an investigation is rare, but to find it multiple times suggests we're dealing with an operation that was set up carefully from the beginning. And that almost certainly means a group project (state-sponsored).

2024-03-31 18:05:08

- reply

Two names that are mentioned as entities that sped this backdoor along -- Hans Jensen and Jia Tan -- both worked on a fork of lz4, a compression algorithm. I'm guessing anything either of these guys touched is getting the fine-toothed comb treatment now, but this one stood out for me b/c of the overlap.
https://github.com/JiaT75?tab=repositories
https://github.com/hansjans162?tab=repositories

2024-03-30 16:49:46

This is the best timeline I've seen so far on what we know about the Xz backdoor. Some good info here for researchers: https://boehs.org/node/everything-i-know-about-the-xz-backdoor

2024-03-27 18:13:22

Apple is an innovative company that is widely emulated around the world. But the advanced security of its products and their associated user accounts remain highly vulnerable to compromise because AFAICT Apple will not let you remove a mobile phone number from your account.
I've long advised readers to move away from relying on phone numbers for ANY form of authentication, and I've written time again about how many companies require a mobile number on signup, but allow you to remove the number from your profile after the account is set up. This is advisable if you have the option for more robust forms of 2FA, like security keys, app-based or OTP/push authentication.
The reason for this advice is that phone numbers are not great for security or authentication (they are transient and not property you control) and your phone company will not help you if one of their employees is tricked into navigating to a phishing page and giving away credentials that allow thieves to sim-swap your number to a device they control, and then request password reset links via SMS to all your important accounts.
But it doesn't seem like you can do that with Apple. And it's leading to stuff like this, without giving victims much in the way of anything they can do about it -- except maybe change their number to another number that isn't already tied to their identity.
https://krebsonsecurity.com/2024/03/recent-mfa-bombing-attacks-targeting-apple-users/
As a heavy Apple user, I hope I am wrong about this and that someone will set me straight. Because this is really bothering me right now.

2024-03-26 20:31:46

- reply

Here's a question I really want to know the answer to: The spoofed calls are spoofing Apple's REAL customer support number as displayed on Apple's iPhone. I realize Apple isn't the phone company and doesn't technically have that relationship with the customer, but it seems like they could build something into their phones that would only allow calls that are actually from that number to display as the Apple Support number, which is (800) 275-2273

2024-03-26 16:43:23

Several Apple customers recently reported being targeted in elaborate phishing attacks that involve what appears to be a bug in Apple’s password reset feature. In this scenario, a target’s Apple devices are forced to display dozens of system-level prompts that prevent the devices from being used until the recipient responds “Allow” or “Don’t Allow” to each prompt. Assuming the user manages not to fat-finger the wrong button on the umpteenth password reset request, the scammers will then call the victim while spoofing Apple support in the caller ID, saying the user’s account is under attack and that Apple support needs to “verify” a one-time code.
https://krebsonsecurity.com/2024/03/recent-mfa-bombing-attacks-targeting-apple-users/
From the story:
“This recently happened to me in the middle of the night at 12:30 a.m.,” Ken said. “And even though I have my Apple watch set to remain quiet during the time I’m usually sleeping at night, it woke me up with one of these alerts. Thank god I didn’t press ‘Allow,’ which was the first option shown on my watch. I had to scroll watch the wheel to see and press the ‘Don’t Allow’ button.”
Unnerved by the idea that he could have rolled over on his watch while sleeping and allowed criminals to take over his Apple account, Ken said he contacted the real Apple support and was eventually escalated to a senior Apple engineer
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/162/748/796/893/172/original/94d1c6b623d24c6b.png

2024-03-25 12:50:55

I didn't realize this until very recently, but if you post here and then make edits to that post, what you changed isn't really gone but stored in the post's history, a kind of wiki which is accessible to others. Feeling dumb, I asked a couple of users if they knew this and they were like "duh," but it was news to me and I suspect many people likewise didn't read the manual.
And then there's the question of how/whether your update to the post is going to be reflected on all of the other servers that federate with this one.
While I understand and admire the radical transparency of this setup, it can be problematic to try and redact something from a post. This happened to me recently and the best advice was delete and repost, as opposed to the built-in "delete and re-draft" option on a post.

2024-03-24 17:56:12

Interesting and scary thread over at Xitter describing what appears to be a series of targeted attacks designed to hijack iCloud accounts by doing something that causes the user's device to be inundated with push OTP requests. The idea seems to be that if they send enough requests, the target might eventually click yes -- either by accident after denying it the 59th time, or because they just want to make the prompts stop.
It's worth noting that in the end game of this attack, the scammers apparently relied on data from people-search services to gather the target's data and contact the user directly posing as Apple. And when you ask them info about yourself to verify you, they can usually read off enough details to fool people into thinking they're actually talking to Apple. And then they ask you to verify a one-time code, and if you do that, your account is toast.
https://twitter.com/parth220_/status/1771589795334287844
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/151/713/336/236/834/original/7d7504ef68fae89f.png

2024-03-21 18:24:37

NBC reports: UnitedHealth Group said Monday that it’s paid out more than $2 billion to help health-care providers who have been affected by the cyberattack on subsidiary Change Healthcare.
“We continue to make significant progress in restoring the services impacted by this cyberattack,” UnitedHealth CEO Andrew Witty said in a press release. “We know this has been an enormous challenge for health care providers and we encourage any in need to contact us.”
https://www.nbclosangeles.com/news/business/money-report/unitedhealth-group-has-paid-more-than-2-billion-to-providers-following-cyberattack/3366212/
Kind of makes the $22M ransom payment they made to BlackCat/ALPHV seem like a rounding error.
https://krebsonsecurity.com/2024/03/blackcat-ransomware-group-implodes-after-apparent-22m-ransom-payment-by-change-healthcare/