krebs

Ransomware hackers steal a hospital. Again.

methodhop

A month after a hospital in Hollywood was shut down by a ransomware infection that encrypted all the files on its computers and computer-controlled instruments and systems, another hospital, this one in Kentucky, has suffered a similar fate. Read the rest

Phishers make off with W2 tax forms for several thousand Seagate employees

w-2-red

Seagate has emailed its employees and ex-employees to warn them that someone in the company sent their W2 tax data to a criminal who pulled off a successful phishing fraud. Read the rest

Crapgadget apocalypse: the IoT devices that punch through your firewall and expose your network

FI9286P.png

Cheap Internet of Things devices like Foscam's home CCTVs are designed to covertly tunnel out of your home network, bypassing your firewall, so they can join a huge P2P network of 7 million other devices that is maintained and surveilled by their Chinese manufacturer. Read the rest

How fraudsters' call centers work

callme

Say you've just scammed someone out of all their financial details using an online fraud, but now you need to call up their bank and impersonate them, and you don't speak their language, have the wrong accent, or are of a different gender -- what do you do? Read the rest

Paypal rolls out the welcome mat for hackers

online_payment (2)

It's not bad enough that Paypal is prone to shutting down your account and seizing your dough if you have a particularly successful fundraiser -- they also have virtually no capacity to prevent hackers from changing the email address, password and phone numbers associated with your account, even if you're using their two-factor authentication fob. Read the rest

Someone snuck skimmers into Safeway stores

884e7ccba94f425b100ff63eca072ae1

Some Safeway customers in California and Colorado who used debit/credit cards have had their card numbers and PINs slurped up by criminals who then took the cards out for spending sprees. Read the rest

Stolen-card crime sites use "cop detection" algorithms to flag purchases

pigdetectionoccurednopigsallowedonpremises-580x562

Cops covertly buy stolen cards from underground sites to figure out where they came from, and so these sites implement security measures that try to figure out whether a purchaser is an undercover cop, and refuse to sell to them if they trip a positive result. Read the rest

US Senate passes CISA, a very bad spying bill dressed up as a cybersecurity bill

rt

CISA won't make you and I any more secure, and it threatens what's left of our online privacy. The very helpful sounding “Cybersecurity Information Sharing Act” will definitely help the government, though: it'll make it a lot easier for technology companies to share your personal data with the government, and everyone knows that this data never ends up in the wrong hands, so you're fine.

The gaping privacy flaws in CISA didn't stop the Senate from passing it by a wide margin today: 74 to 21. CISA now goes to a conference committee between House and Senate.

Here's the EFF's take, by Mark Jaycox:

CISA passed the Senate today in a 74-21 vote. The bill is fundamentally flawed due to its broad immunity clauses, vague definitions, and aggressive spying authorities. The bill now moves to a conference committee despite its inability to address problems that caused recent highly publicized computer data breaches, like unencrypted files, poor computer architecture, un-updated servers, and employees (or contractors) clicking malware links.

The conference committee between the House of Representatives and the Senate will determine the bill's final language. But no amount of changes in conference could fix the fact that CISA doesn't address the real cybersecurity problems that caused computer data breaches like Target and the U.S. Office of Personnel Management (OPM).

Read the rest

Ukrainian botmaster who tried to frame Brian Krebs extradited to US

flypostcardfront-580x417

When security-researcher/hornet-nest-kicker Brian Krebs outed Sergey "Flycracker" Vovnenko as administrator of a darknet crime site and botmaster of a 13,000-PC-strong botnet used to attack sites and launder stolen data, Vovnenko allegedly masterminded a plot to frame Krebs by mailing him heroin. Read the rest

What the barcode on your discarded boarding-pass reveals

bpdecoded-580x263

Mostly it's your record locator and frequent flier number, but with that, an attacker can access the ticket record, see your future flights, your email address, and the details of the emergency contacts you'd added to the reservation. Read the rest

Mystery twitterer linked to Ashley Madison dump

ashley-madison

Security blogger Brian Krebs is among those hot on the trail, and he "may have a new lead," according to the New York Times.

On Wednesday, Brian Krebs, the well-known security blogger posited a new theory about who may have hacked the site, which helps arrange extramarital affairs. Mr. Krebs zeroed in on a Twitter user named Thadeus Zu (@deuszu), who posted a link to Ashley Madison’s stolen, proprietary source code before the information was made public this month.

Some apparent problems with this hypothesis have already been noted, but the operator of the @deuszu account is doing his or her best to look guilty.

Reminder: the site was probably just a scam with only a handful of legitimate female participants. Little can be implied about its users beyond stupidity. Read the rest

Claim: Ashley Madison exec "hacked competitor" and stole personal data

NoelBiderman

Emails sent by the "have an affair" dating network's CEO suggest the firm "hacked" rival Nerve.com in 2012, taking its user database.

Brian Krebs:

“They did a very lousy job building their platform. I got their entire user base,” [Ashley Madison CTO Raja] Bhatia told [CEO Noel] Biderman via email, including in the message a link to a Github archive with a sample of the database. “Also, I can turn any non paying user into a paying user, vice versa, compose messages between users, check unread stats, etc.”

Neither Bhatia nor Biderman could be immediately reached for comment. KrebsOnSecurity.com spoke with Bhatia last week after the Impact Team made good on its threat to release the Ashley Madison user database. At the time, Bhatia was downplaying the leak, saying that his team of investigators had found no signs that the dump of data was legitimate,

Alas, it was for real. Ashley Madison charged its users to have their personal data wiped, but did not do so, and now that data is out in the wild. Read the rest

Ashley Madison data dump confirmed

ashleymadison-580x370

A vast data dump, purportedly exposing millions of users of a hookup service for cheating spouses, has been confirmed.

In a statement, Ashley Madison spokesman Anthony Macri (right) said the dump was a criminal act. He didn't mention that the company had kept the data, for reasons unknown, after charging its users to have it permanently deleted.

This event is not an act of hacktivism, it is an act of criminality. It is an illegal action against the individual members of AshleyMadison.com, as well as any freethinking people who choose to engage in fully lawful online activities. The criminal, or criminals, involved in this act have appointed themselves as the moral judge, juror, and executioner, seeing fit to impose a personal notion of virtue on all of society. We will not sit idly by and allow these thieves to force their personal ideology on citizens around the world. We are continuing to fully cooperate with law enforcement to seek to hold the guilty parties accountable to the strictest measures of the law.

The 10GB tranche exposes 37m accounts from a site marketed explicitly at people who wanted to cheat on their partners. It includes names, addresses, emails, card numbers, transactions and other personally-identifying information. Security researcher Brian Krebs says that it's the real deal.

I’ve now spoken with three vouched sources who all have reported finding their information and last four digits of their credit card numbers in the leaked database. Also, it occurs to me that it’s been almost exactly 30 days since the original hack.

Read the rest

Love cheats' hookup site hacked, user data purloined

ashleymadison-580x370

Ashley Madison is a social network for people who want to cheat on their spouses. It's been hacked and "large caches of user data posted online," reports Krebs on Security.

The privacy of some 37 million account-holders is at stake, though the bulk of the dataset is apparently being withheld and its contents remain uncharted territory.

The social network's boss, bless his stupid nylon socks, thinks that he'll be able to take their "intellectual property" off the 'net.

Reached by KrebsOnSecurity late Sunday evening, ALM Chief Executive Noel Biderman confirmed the hack, and said the company was “working diligently and feverishly” to take down ALM’s intellectual property. Indeed, in the short span of 30 minutes between that brief interview and the publication of this story, several of the Impact Team’s Web links were no longer responding.

“We’re not denying this happened,” Biderman said. “Like us or not, this is still a criminal act.”

The claimed hackers say they were motivated by the site's hypocrisy. Ashley Madison apparently had a "remove your data from our servers for a fee" wheeze going on—a practice unnervingly reminiscent of some revenge porn operators.

The Next Web's Abhimanyu Ghoshal.

The Impact Team said that the ‘full delete’ feature didn’t actually wipe profiles as advertised and that it brought ALM $1.7 million in revenue last year.

The hackers said:

Users almost always pay with credit card; their purchase details are not removed as promised, and include real name and address, which is of course the most important information the users want removed.

Read the rest

Crowdfunding medical MDMA and magic mushrooms

An activist couple (she's a neurscientist, he's a psychologist who successfully treated his depression with psychedelics) (they fight crime!) are raising $1M on Indiegogo to fund production of medical-grade MDMA and psilocybin. Read the rest

Sony Hack: Could secretive group of ethnic North Koreans in Japan be to blame?

"A group of ethnic North Koreans residing in Japan known as the Chongryon are critical to North Korea’s cyber and intelligence programs, and help generate hard currency for the regime. "

Brian Krebs's "Spam Nation"

In Spam Nation: The Inside Story of Organized Cybercrime-from Global Epidemic to Your Front Door, Brian Krebs offers a fascinating look at the mass-scale cybercrime that underpins the spam in your inbox and provides an inside peek at a violent fight among its principle players. Cory Doctorow reviews.

Next page