STE WILLIAMS

Russian national faced multiple charges in connection with operating the marketplace for stolen credit-card credentials, and a forum for VIP criminals to offer their services.

A Russian national indicted last year for running the stolen credit-card market site CardPlanet as well as a members-only site for elite cybercriminals to advertise services for sale, has pleaded guilty to a variety of criminal charges in federal court.

Aleksei Burkov was arrested in Israel in 2015 and extradited to the US in 2019. At the time of his extradition, stolen credit card credentials purchased on CardPlanet had resulted in more than $20 million in fraudulent charges.

Burkov pleaded guilty in US District Court to access device fraud and conspiracy to commit computer intrusion, identity theft, wire and access device fraud, and money laundering. His sentencing is scheduled for May 8.

For more, read here.

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Y2K Boomerang: InfoSec Lessons Learned from a New Date-Fix Problem.”

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/vulnerabilities---threats/cardplanet-operator-pleads-guilty-in-federal-court/d/d-id/1336881?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

The DEF CON Social Engineering Capture the Flag contest inspired a new event aimed at teaching both security and non-security professionals on the fine art of hacking human behavior.

Chris Hadnagy, founder and chief human hacker for the firm that created the famed Social Engineering Capture the Flag contest at DEF CON, next month will kick off his first social engineering event geared for business, technology, security, and psychology professionals.

Social-Engineer LLC’s new Human Hacking Conference spun out of the firm’s wildly popular CTF and its training services, according to Hadnagy, and will cover techniques in human deception, body language analysis, cognitive agility, intelligence research, and best practices in security.

“There is an appetite for a more professional side of social engineering — not so much where the bad guys wearing dark hoodies” are going after the good guys, but understanding how to read and apply those skills in non-security jobs, he says. 

The event — February 20–22 in Orlando, Fla. — will feature various workshops led by experts in mental health, method acting, leadership skills, open-source intelligence, nueroscience, deception, trust, and body language and nonverbal communication. There’s even a training session by Ian Rowland, aka “The Mind Man,” on cold reading and how to apply some of its communications techniques to business and sales. 

Hadnagy says so far the event has attracted human resources, sales teams, red teams, and white-hat hackers, who want to understand security issues on a broader scale. “It’s a wide genre, which was kind of my goal,” he says.

There won’t be a DEF CON-style SE CTF, but Social-Engineer does plan to conduct a live demonstration of vishing. 

Read more about the Human Hacking Conference here. 

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Y2K Boomerang: InfoSec Lessons Learned from a New Date-Fix Problem.”

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise … View Full Bio

Article source: https://www.darkreading.com/risk/new-social-engineering-event-to-train-business-pros-on-human-hacking/d/d-id/1336880?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Far from protecting the security and privacy of Safari users as advertised, Apple’s much-vaunted Intelligent Tracking Prevention (ITP) could leave them exposed to a raft of privacy issues, including – ironically – being tracked.

That’s the surprising conclusion of a group of Google researchers who this week published a short but sharp proof-of-concept analysis of the flaws they found in ITP, some of which were recently fixed while others, they suggest, present more fundamental problems.

Based on machine learning, ITP was added to Safari in 2017, since when it has been revised several times up to the current WebKit implementation, version 2.3, released in September 2019.

Unexpectedly, in December, Apple published a blog thanking Google for suggesting some changes to ITP which they’d implemented in Safari as part of December’s iOS 13.3, and Safari for macOS 13.0.4 updates.

That offered Apple’s explanation of the changes – this week it was Google’s turn and it makes for interesting reading.

Users are prey

True to its name, one of the things ITP is supposed to do is to limit the amount of information users share with cross-site cookies (cookies set by a site that isn’t the one they’re visiting). Tracking and advertising systems typically use cross-site cookies to track and profile individuals as they move from website to website, noting what sites they visit and what they do there.

ITP tries to classify sites by watching how users interact with them, as a way of allowing some sites to track people for legitimate purposes (intentionally clicking on an ad or logging into sites using Facebook, say).

It does this by counting what Google calls ITP ‘strikes’. Each time a cross-site request is made the domain the request is sent to acquires a strike. Once a domain has accumulated enough strikes it is classed as a ‘prevalent’ domain. Prevalent domains are subject to restrictions – cookies may be removed and Referer headers shortened – to ensure the user remains anonymous. Unfortunately:

Any site can issue cross-site requests, increasing the number of ITP strikes for an arbitrary domain and forcing it to be added to the user’s ITP list.

And that, it turns out, allows sites to interrogate a browser’s ITP list.

By checking for the side effects of ITP triggering for a given cross-site HTTP request, a website can determine whether its domain is present on the user’s ITP list; it can repeat this process and reveal ITP state for any domain.

In other words, ITP creates a “global state” for a user’s browsing history, accessible to any website a user visits. Sneaky websites can attempt to access this global state to work out if a given domain is on on the list, what websites a user has visited. Most alarmingly, the unique state of a user’s ITP database might even be used against them as a “fingerprint” useful for cross-site tracking (using a similar technique to HSTS fingerprinting).

Safari’s December updates closed most of the issues in ITP but the fact that a bunch of researchers were able to punch holes in it underlines how even the most sophisticated anti-tracking system can come unstuck.

On the other hand, some of the attack scenarios suggested by Google would have required websites to invest a fair amount of effort into defeating it. There is also no evidence that any did. If you’ve been using Safari recently, it’s unlikely your privacy was compromised by the techniques Google discusses.

However, Google believes that even after Apple’s fixes, the fundamental problem of targeting the ITP list and fingerprinting will be difficult to stop.

Apple has been here before – support for the old ‘do not track’ feature was removed last summer after it was discovered it was being used as just another fingerprint variable.

Apple will persevere with ITP, of course. All browsers need to have some answer to the privacy issue, however imperfect.

But what’s clear is that it’s taken a bigger risk with ITP than seemed evident when it launched it nearly three years ago. Creating a filter built on machine learning sounded logical but it’s that very design feature that potentially allows it to be gamed when attackers – advertisers – work out how it works and what it prioritises.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/bhI2Ftj-42Y/

The Royal Yachting Association (RYA) has told members that “an unauthorised party” may have pilfered a database containing personal information from 2015.

A statement issued by the boating organisation, which awards sailing qualifications and safety training to the Great British Public, said it had spotted the breach just over a week ago.

“On 17 January 2020 we became aware that an unauthorised party accessed and may have acquired a database created in 2015 containing personal data associated with a number of RYA user accounts,” it said.

Stolen information included names, email addresses and “hashed passwords”, including a “majority held with the salted hash function.” No payment or financial information was said to have gone walkies.

The association statement, seen by The Reg this morning, continued: “Our investigation into this matter is ongoing and we have engaged leading data security firms, including forensic specialists, to assist in our investigation.” The Information Commissioner’s Office has been informed.

All boaty people with RYA online accounts have had their passwords reset, with account access being disabled until this is done. In an email sent to RYA members and seen by The Register, the association said: “We will provide more information to those users potentially impacted by this possible breach as soon as possible.”

The standard post-breach advice is to change one’s password, particularly on other sites or services where you’ve reused the same combination of email address/username and password. This helps prevent miscreants from using the same combination elsewhere to get into your online life.

Breaches of old credentials are a cause for concern. Many people simply keep using the same username and password until forced to change it, despite the best efforts of the infosec industry to convince them not to do that. It isn’t plain sailing out on the cyber high seas. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/24/royal_yachting_association_data_breach/

Looking to change jobs? Watch out for fraudsters who use legitimate job services, slick websites, and an interview process to convince applicants to part with sensitive personal details.

Online fraudsters are increasingly targeting job seekers by posing as legitimate employers, conducting interviews, and then “hiring” the victim, at which time they request personal and financial data, according to an advisory issued by the FBI’s Internet Criminal Complain Center earlier this week.

The long con often results in victims giving up Social Security numbers, direct deposit information, and even images of driver’s licenses. The scam often ends by the “employer” asking the victim to pay fees or purchase equipment to work from home, after which the criminals break off communications. The average victim loses $3,000, according to the FBI advisory.

While such employment scams are not new, the level of involvement in the latest iteration of the online scam makes it stands out, the FBI said.

“While hiring scams have been around for many years, cyber criminals’ emerging use of spoofed websites to harvest PII (personally identifiable information) and steal money shows an increased level of complexity,” the FBI stated in the advisory. “Criminals often lend credibility to their scheme by advertising alongside legitimate employers and job placement firms, enabling them to target victims of all skill and income levels.”

The increase in attacks underscores a general trend of criminals targeting business processes. Business e-mail compromise — the largest source of fraud by potential losses, for example — accounted for more than 20,300 complaints in 2018, the IC3 stated in its last annual report. The fraud put more than $1.3 billion at risk, compared to less than $4 million for ransomware that year, although the FBI has questioned whether the ransomware figure is accurate since victims frequently do not report ransomware attacks.

Employment fraud consisted of almost 15,000 incidents, accounting for more than $45 million in losses in 2018, according to that report.

The fraud has employment services and job-posting aggregators on watch. Job search site Indeed, for example, has a search-quality team who searches out fraudulent advertisements and job postings, although the company did not provide data on the number of fraudulent postings it removes each year.

“Jobseekers should never agree to send payment to a potential employer, and charging fees is a violation of Indeed’s rules for companies posting on our site,” the company said in a statement to Dark Reading. “We encourage job seekers to review our Guidelines for Safe Job Search.”

Indeed is not the only organization to urge applicants to be on the lookout. College seniors and new college graduates are often targeted, and schools issue warnings for the relatively inexperienced applicants to look out for employment fraud schemes, including verifying that postings are from legitimate companies.

The University of Southern California, for example, warns job seekers to beware of a number of signs, such as “the posting appears to be from a reputable, familiar organization — often a Fortune 500 — yet, the email handle in the contact’s email address does not match the domain used by representatives of the organization.”

Yet online fraudsters are going for longer and more involved schemes to try to work around such advice. While USC warns applicants to not provide Social Security numbers or driver’s license information in the initial application, fraudsters are now offering jobs and requesting such information during the onboarding process, the FBI stated. Interviews are increasingly conducted as part of the extended scam.

“Applicants are contacted by email to conduct an interview using a teleconference application,” the FBI stated. “According to victims, cyber criminals impersonate personnel from different departments, including recruiters, talent acquisition, human resources, and department managers.”

The FBI listed a variety of telltale signals that should tip off a job seeker that they should look deeper at their prospective employer. If interviews are not conducted in-person or through a secure video connection, that should raise red flags, the advisory stated. In addition, the job seeker should be suspicious if an employer requests financial information or a credit card to purchase startup equipment. 

Finally, work-at-home jobs that pay high initial salaries for inexperienced workers is another sign to question the job posting.

Related Content:

• Phishing Today, Deepfakes Tomorrow: Training Employees to Spot This Emerging Threat
• Anatomy of a BEC Scam
• The Cybersecurity Skill Shortage Epidemic
• Financial Impact of Cybercrime Exceeded $45B in 2018
• 6 Ways to Beat Back BEC Attacks

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Y2K Boomerang: InfoSec Lessons Learned from a New Date-Fix Problem.”

 

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/online-employment-scams-on-the-rise-says-fbi/d/d-id/1336876?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

You’ll need to add resume tactician to your skill set in order to climb up the next rung on the security job ladder. Here’s how.

Cybersecurity professionals are trained to secure, fix, and prevent security breaches and cyberattacks. To become a cybersecurity professional, you need to have your head in the game. But more than that, you also need to be an excellent resume tactician because it takes impeccable industry-relevant experience and credentials to get short-listed for the job of your dreams.

These five tips can help you elevate your professional resume to the top of the list:

Tip 1: Result-Oriented, Detailed Job Experience
A great way to do this is by crafting the details of your roles and responsibilities into one-line bullet points of your action-oriented accomplishments, which is a strategy espoused by Princeton University. For example:

● Prepared reports to document security breaches and damage caused by them, leading to a 90% reduction in security breaches
● Supervised penetration testing to locate vulnerable issues in the systems to avoid exploit

This illustrates a cause-effect relationship to showcases the reason behind the actions performed and what the results of these actions were. In the first point, the action and results are:

● Action: Report preparation
● Result: Reduction in security breach

Similarly, in the second point, the action and results are:

● Action: Supervising penetration testing
● Result: Location of system issues and avoiding exploit

Tip 2: An Impactful Summary
Most recruiters tend to browse through resumes in a jiffy because they just don’t have the time to critically analyze each and every job application. This means that job seekers need to communicate the details of their work trajectory in a short three- to five-line resume summary. The goal of your summary is to effectively communicates career highlights and key achievements. For example:

Cybersecurity professional with six years of experience and a proven track record of establishing effective security software for any system. DoD security clearance. Background in internal/external penetration testing to protect systems against breaches and fix damages caused.

Tip 3: A Distinct Skills Section
You are no one without your skills in the job market. But having skills is one thing; being able to communicate what those professional skills are is another. Consequently, if your cybersecurity resume does not highlight your functional skills under a distinct section, you’re doing it all wrong. Why? Because recruiters, in their limited capacity, would simply move on to the next resume if they have to try too hard to identify your skills.

Here’s a valuable piece of advice: Create a distinct Key Skills section in your resume and list all your relevant skills under it. Doing this will drastically help increase your short-list chances because recruiters will be able to identify your functional skills in one go, and if they match the criteria that they’re looking for, you’ll most likely be called for an interview.

Tip 4: Education and Certification Details
Something as obvious as presenting your education and certifications details is critical for demonstrating that you have attained the relevant theoretical knowledge necessary for a cybersecurity career. This should include:

● Name of school/university
● Name of the courses/certifications pursued by you
● Location of the degree/certificate-issuing body
● Enrollment and graduation dates

Tip 5: Up-to-Date Contact Details
While this may seem obvious, don’t make the surprisingly common mistake of sending out your resume without mentioning important contact details that would prevent a potential employer from getting in touch with you. So, while you’re busy polishing your resume, make sure that you’ve listed up-to-date contact information, including:

● One functional mobile number
● An email address
● Your current location

Finally, make sure that you compose this section with the precision of a surgeon because you cannot afford to make innocent blunders such as spelling mistakes. One wrong or missing letter and number, and you’ll never hear from a recruiter!

Related Content:

• 13 Security Pros Share Their Most Valuable Experiences
• Higher Degree, Higher Salary? Not for Some Security Pros
• 6 Traits to Develop for Cybersecurity Success

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “With International Tensions Flaring, Cyber Risk is Heating Up for All Businesses.”

On a quest to help professionals across the world land their dream jobs, Aditya lives and breathes Hiration — an AI-powered online resume builder and platform to help job-seekers find their way in the treacherous job market.  When Aditya is not busy disrupting the … View Full Bio

Article source: https://www.darkreading.com/careers-and-people/5-resume-basics-for-a-budding-cybersecurity-career/a/d-id/1336830?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Each day in the US, more than 3,000 15- to 18-year-olds attempt suicide. According to the US Center for Disease Control and Prevention (CDC), it’s the second most prevalent cause of death among adolescents aged 15-19 years.

Online services could help to prevent that and other types of harm that are befalling kids, but they aren’t doing enough, the UK’s data watchdog says. It’s high time that social media sites, online games and children’s streaming services start weaving protection for kids into every aspect of design, according to the UK’s Information Commissioner’s Office (ICO).

On Tuesday, the ICO published a code to ensure that online companies do just that – protect kids from harm, be it showing kids suicidal content, grooming by predators, illegal collection and profiteering off of children’s data, or all the “smart” toys and gadgets that enable children’s locations to be tracked and for creeps to eavesdrop on them.

Elizabeth Denham, the UK’s Information Commissioner, said that future generations will look back on these days and wonder how in the world we could have lacked such a code. Here’s what she told the Press Association, according to the BBC:

I think in a generation from now when my grandchildren have children they will be astonished to think that we ever didn’t protect kids online. I think it will be as ordinary as keeping children safe by putting on a seat belt.

The set of 15 standards – named the Age Appropriate Design Code – will be “transformational,” she said.

The code

The Age Appropriate Design Code includes 15 standards that companies behind online services are expected to comply with to protect children’s privacy.

They cover online services including internet-connected toys and devices: for example, the internet-enabled, speech recognizing, joke-telling Hello, Barbie, or fitness bands that record children’s physical activity and then send the data back to servers.

Another one of the standards dictates that geolocation data options are turned off by default, while others pertain to parental controls, profiling and nudge techniques. Nudging is leading users to follow a designer’s preferred path, such as when a “Yes” button is far bigger and more prominent than a “No” button, or when a preferred choice is played up, like in this example from the code:

Other online services covered by the code include apps, social media platforms, online games, educational websites and streaming services.

The ICO first introduced a draft of the code in April 2019. It’s hoping for the code to come into effect by autumn 2021, once Parliament approves it. The code will enable sanctions to be issued, such as orders to stop processing data, as well as fines for violations that could run high as £17 million (USD $22.28 million) or 4% of global turnover.

Molly Russell’s mourners: adopt it ‘in full and without delay’

Ian Russell welcomed the new standards. His daughter, Molly Russell, was 14 when she committed suicide in 2017 after entering what her father called the “dark rabbit hole of suicidal content” online, where she encountered what her family described as distressing material about depression and suicide – including communities that discourage users from seeking treatment. Molly’s father said that Instagram “helped kill my daughter,” as it was making it easy for people to search on social media for imagery relating to suicide.

Following the death of Molly and other minors, pressure grew on Instagram to do something about bullying. One of its responses came in July 2019, when it announced that it had started to use artificial intelligence (AI) to detect speech that looks like bullying and that it would interrupt users before they post, asking if they might want to stop and think about it first. In October 2019, it also extended its ban on self-harm content to include images, drawings and even cartoons that depict methods for self-harm or suicide.

These steps have been piecemeal, though. What’s needed instead is a comprehensive plan such as this code presents, Russell said:

Although small steps have been taken by some social media platforms, there seems little significant investment and a lack of commitment to a meaningful change, both essential steps required to create a safer world wide web.

The Age Appropriate Design Code demonstrates how the technology companies might have responded effectively and immediately.

Russell’s Molly Rose Foundation (MRF) for suicide prevention urged the government and tech companies to adopt the code without delay and to stop prioritizing data-gathering profits over children’s safety:

MRF call on tech companies and Government to act on the ICO’s Age Appropriate Design Code in full and without delay… twitter.com/i/web/status/1…

—
Molly Rose Foundation (@mollyroseorg) January 22, 2020

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/85dspOTlfAY/

New York police have arrested yet another man suspected of running the clickfraud factory known as Methbot: a farm of 1,900 data servers rented to host 5,000 bogus websites and to concoct fictional traffic coming from fake visitors, thereby running up profits from advertising fraud.

Methbot got its name from White Ops, the bot mitigation firm that discovered the Russian/Kazakhstani cyberforgery ring in 2016.

In 2018, the US busted eight men from Russia and Kazakhstan, accusing them of running the vast ad-fraud scheme, which milked a total of $36 million from advertisers.

Two of the eight – Sergey Ovysannikov and Yevgeniy Timchenko – have since pleaded guilty. The alleged ringleader, Aleksandr Zhukov, plans to fight the charges. The rest of the suspects remain at large.

Now, more than a year after the eight men were arrested, the US has busted a ninth man, Sergey Denisoff. The affidavit supporting Denisoff’s arrest warrant was filed in US District Court in the Eastern District of New York on Friday. Here’s the court document, first spotted by Seamus Hughes and then posted courtesy of CyberScoop’s Jeff Stone.

According to White Ops, the scheme was controlled by a single group based in Russia that operated out of data centers in the US and Netherlands. They brought in $3 million to $5 million in counterfeit inventory per day by targeting the premium video advertising ecosystem.

Methbot was an illusion factory. As the affidavit describes, between September 2014 and December 2016, Denisoff’s alleged part was to operate an advertising network that purported to place ads on real webpages seen by real, human visitors. In fact, they were dummy webpages allegedly created by Denisoff and his buddies. They allegedly directed automated computers to visit those pages, so as to register ad views.

The Methbot operators ran what they claimed to be an advertising network which they dubbed Mediamethane. Meanwhile, Denisoff and others allegedly operated a purported advertising network called Plexious. Mediamethane was getting paid by other advertising networks – including Plexious – to place ad tags with publishers on behalf of those ad networks. Instead of putting those ad tags on real publishers’ sites, however, the defendants allegedly stuck them on computers on a server farm in Dallas.

Those servers were programmed to ape human internet activity, being programmed to automatically do things like move a mouse and scroll on a webpage. The Methbot defendants allegedly also created fraudulent entries in a global IP registry to hide the fact that its fake humans were all really computers in a server farm.

After White Ops – working for clients in the advertising industry – uncovered the fakery behind the traffic and the IP registrations, search warrants turned up programming code, allegedly shared by the defendants, for making sure their computers were using the right “browser” parameters. That’s “browser”, quote-unquote: an FBI agent said in the affidavit that it looked like the conspirators custom-designed an automatic web browser that could mimic signals sent by typical internet browsers run by real humans.

As the affidavit tells it, there was a lot of back and forth about that “browser”: How many clicks per hour? This many? What about per day? 10 clicks per day per IP? Argh! It downloaded 300 clicks in an hour! They’re clicking too fast! It has to be a bug. It should be 50-60 clicks per hour, total.

They also mastered the mimicry of humans watching videos: each video had to be clicked on and watched for 60-90 seconds in order to ensure that enough advertising was “watched” so they’d earn cuts of ad revenue.

The defendants allegedly used their ability to slip past fraud detection software as a selling point, advertising Mediamethane’s ability to provide “100% USA traffic” that could pass through cybersecurity “filters.”

Denisoff allegedly supplied the Methbot crew with fake domains and helped them slip past fraud-detection security software. He was in regular communication with alleged ringleader Zhukov.

When investigators interviewed him in October 2019, Denisoff voluntarily told them that he learned all about the advertising ecosystem when he was in college in 2011-2012. During that time, he and a friend launched an ad network they named Plexious that worked with other ad networks to source and resell ad traffic.

Plexious earned between $10 million and $12 million from 2012 to 2016, mostly from video traffic, Denisoff said during the interview.

When asked about the domains he sent to Zhukov, Denisoff said that c’mon, the advertising agencies and ad networks should have known that most people wouldn’t visit such domains to search for information. He kind of has a point: some of those dummy webpages had nothing but content copied from legitimate pages, and some had only the text that appears by default in webpage editors: “lorem ipsum.”

Does that make clickfraud OK? Nope, and Denisoff knew it. According to the affidavit, at one point, when discussing how to slip past security software, he allegedly suggested to Zhukov that they switch to instant-messaging on Jabber “before they put me in jail” – as in, “something without logs and access from the American law enforcement.”

Well, so much for the plan to go covert: after the FBI arrested Zhukov, during a raid in Bulgaria in November 2018, investigators found multiple Jabber conversations on Zhukov’s computer, dating back years, including with Denisoff.

Denisoff’s next hearing is scheduled for 3 February.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/M-uuNM1-C74/

The street outside ICAAN’s offices in Playa Vista, California, may be a little more crowded than normal. People worried about the .org top-level domain will be there protesting its sale to a private equity firm.

They’ll be handing over a petition signed by over 21,000 people to the Internet Corporation for Assigned Names and Numbers (ICAAN). They’re worried about the sale of .org to Ethos Capital, a new private equity firm that could profit from a new-found ability to increase the price that it charges for .org domains.

Created in 1985, .org is one of the internet’s oldest top-level domains (TLDs). It has traditionally been the home of non-profits and advocacy groups with non-commercial messages.

When you register a website with a registrar company, they then have to tell the registry company that handles the TLD to add that entry to a database. Registries control how TLDs are assigned by signing a license agreement with ICAAN, the organization that co-ordinates the various TLD registries.

If you register a .com or .net domain, for example, your registrar has to log that with Verisign, which is the registry for those TLDs. Verisign used to handle the .org domain until its license ran out in 2002, and ICAAN then gave the licence to the Public Internet Registry (PIR), which has operated .org since 2003.

PIR is a subsidiary of the Internet Society (ISOC), a non-profit formed in 1992 to handle the evolution of the internet and many of its standards (ISOC incorporates the Internet Engineering Task Force, or IETF, among other things).

PIR set out to protect .org for its non-profit and other users, capping the price of .org domains at $8.25 but allowing a 10% annual increase on that price. However, on 30 June 2019, ICAAN signed a renewal agreement for .org that allowed PIR to hike its rates as much as it wanted (section 2.10). This followed a consultation period on the proposed agreement which drew lots of negative comment from the community, as people worried about the ability to raise prices for a venerable non-commercial TLD like .org. One person said:

Having one company able to control pricing for an entire TLD, and to have no restrictions, controls or guidelines on their ability to increase the pricing: is in my opinion creating a monopoly, with all that implies – definitely counter to the idea of a free market. Especially in the area of .org, which is traditionally – and branded – to be the domain for not-for-profits.

Hackles were already up when on 13 November 2019 ISOC announced that it had sold PIR along with its .org registry license to a newly formed private equity company called Ethos Capital and its affiliate, Purpose Domains Direct LLC, for $1.135bn.

The money that PIR made from operating .org went to its parent company ISOC, which says it used it for projects that benefited the internet community. That income will cease with the sale, and PIR will become a for-profit LLC.

People are concerned that with Ethos Capital’s purchase of PIR, a for-profit company with free range to invest in any commercial concern will have ultimate control over the pricing of domains registered under .org. This was one of the last price-protected TLDs, and was also home to non-profit organisations, many of whom speak out on sensitive issues that might not sit well with the values of a for-profit investment firm.

Ethos has said, however, that it won’t quash free speech, and will create a stewardship council to help preserve it for .org domains. Nora Abusitta-Ouri of Ethos Capital has also tried to reassure people that the company won’t hike prices any more than the previous agreement allowed. She said:

Ethos will maintain PIR’s historical practices on pricing. We committed to limiting any potential increase in the price of a .ORG domain registration to no more than 10% per year on average, even though today there are no regulatory pricing constraints on PIR or virtually any other domain name registry.

---

Latest Naked Security podcast

LISTEN NOW

Click-and-drag on the soundwaves below to skip to any point in the podcast.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/zDN1XRuZuFg/

A 29-year-old Russian scumbag has admitted masterminding the Cardplanet underworld marketplace as well as a second forum for elite fraudsters.

Aleksei Burkov appeared in a US federal district court in Virginia this week to plead guilty [PDF] to access device fraud, and conspiracy to commit computer intrusion, identity theft, wire and access device fraud, and money laundering.

Cardplanet was an internet souk in which crooks bought and sold stolen bank card details. When he was cuffed and charged last November, prosecutors estimated the website accounted for roughly $20m in fraud.

Burkov also ran, we’re told, an exclusive invite-only cybercrime den in which malware, money laundering, and hacking-for-hire were touted by top-tier miscreants as well as credit cards.

“To obtain membership in Burkov’s cybercrime forum, prospective members needed three existing members to ‘vouch’ for their good reputation among cybercriminals and to provide a sum of money, normally $5,000, as insurance,” Uncle Sam’s legal eagles said of the secret den on Thursday.

“These measures were designed to keep law enforcement from accessing Burkov’s cybercrime forum and to ensure that members of the forum honored any deals made while conducting business on the forum.”

For the Feds, this has been a long time coming. US authorities sought Burkov’s extradition back in 2017 after he was collared in Israel in 2015.

After exhausting his opportunities to appeal the extradition in the Israeli legal system, Burkov was sent to the US to face trial in November of last year, and has now finally coughed to his crimes.

Burkov faces a maximum of 15 years behind bars when he is sentenced on May 8, though courts typically hand down much lighter sentences when perps skip lengthy trials and go straight to pleading guilty. ®

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/01/24/cardplanet_admin_guilty/