crime – Page 31 – STE WILLIAMS

Staffer emails compromised and customer details exposed in T-Mobile US’s third security whoopsie in as many years

library
crime | hacking | security

T-Mobile US was hacked by miscreants who may have stolen some customer information.

The telco did not specify exactly when the intrusion took place (and has yet to respond to questions from The Register) in its Notice Of Data Breach.

The hackers gained access to employee email accounts, which contained customer account information. The data included names, addresses and phone numbers as well as rate plans. T-Mobile US was quick to reassure punters that financial information and Social Security numbers were not exposed.

Presumably its employees don’t send that sort of stuff around in email form.

The attack itself was against T-Mobile’s email vendor, and led to ne’er-do-wells gaining “unauthorized access”. The usual act of slamming the stable door long after the horse has bolted is under way with the company “reviewing” its security policies and procedures “to enhance how we protect these systems”. It has also reported itself to federal law enforcement as well as beginning the grim task of informing customers.

Far be it from us to suggest that T-Mobile US is prone to springing the odd security leak or two, but back in 2018 the personal details of 2 million customers were spaffed, again with no financial data, and more than a million prepaid account holders had their privates ogled after the carrier was compromised again in 2019.

The UK tentacle of the brand was borged into Everything Everywhere in 2010, which became the EE we all know and love today. The companies are quite separate entities and The Register understands that UK customers of the former T-Mobile brand are not affected.

T-Mobile US reported strong customer growth last year, with more than 86 million by the end of Q4 2019 and revenues for the year at $34bn (PDF), although lurking in the small print where the company disclosed factors that might hit future results it does warn that “inability to implement and maintain effective cyber security measures over critical business systems; breaches of our and/or our third-party vendors’ networks, information technology and data security, resulting in unauthorized access to customer confidential information” might cause a wobble or two. ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/05/tmobile_breach/

Let’s Encrypt: OK, maybe nuking three million HTTPS certs at once was a tad ambitious. Let’s take time out

library
crime | hacking | security

Let’s Encrypt has halted its plans to cancel all three million flawed web security certificates – after fearing the super-revocation may effectively break a chunk of the internet for netizens.

Earlier this week, the non-profit certificate authority, which issues HTTPS certs for free, announced a plan to disable some three million certificates tainted by a software bug.

The programming blunder, in Let’s Encrypt’s automated certificate management software, affects users who create a certificate for a domain and then, some days later, create more related certificates – the code bungled the rechecking process that needed to take place.

Website owners were told to fix their certs as soon as possible because mass revocation would begin on March 4, at 16:00 PT (00:00 UTC). Failure to take action meant visitors to unamended websites would see warnings of insecure connections in their browsers. The culling process actually began March 4, 00:00 PT (20:00 UTC).

The short timeline is a consequence of the Baseline Requirements that Certificate Authorities agree to follow. Even so, Let’s Encrypt only managed to make it halfway through the process before calling time.

In a forum post on Wednesday, Josh Aras, executive director of Let’s Encrypt, announced a delay to avoid undue damage to the internet.

Let’s Encrypt? Let’s revoke 3 million HTTPS certificates on Wednesday, more like: Check code loop blunder strikes

“Unfortunately, we believe it’s likely that more than one million certificates will not be replaced before the compliance deadline for revocation is upon us at March 5 19:00 PT (03:00 UTC, 21:00 US EST),” wrote Aras. “Rather than potentially break so many sites and cause concern for their visitors, we have determined that it is in the best interest of the health of the Internet for us to not revoke those certificates by the deadline.”

By the compliance deadline this evening, Aras said 1,706,505 certificates that have been replaced would have been revoked. And 445 certificates that forbid issuance by Let’s Encrypt were treated as high-priority targets for revocation.

As for the remaining 1.3 million or so, some of these will be revoked when Let’s Encrypt is certain that doing so will not cause undue disruption. Other bad certs left untreated should die of old age. Aras said that since Let’s Encrypt certificates only have 90 day lifetimes (they designed for auto-renewal), unfixed certs will expire on their own if not dealt with.

The Register asked Let’s Encrypt whether the owners of the spared certs have been told they have extra time. Evidently, they haven’t.

“The original set of affected subscribers for whom we have email addresses were sent an email letting them know of the error with their certificates,” a spokesperson said.

“That email guided them to our forum to get help and the most updated information. The forum is the best place to interact with Let’s Encrypt, so we aim to drive people there as much as possible.” ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/05/lets_encrypt_halts/

Android users, if you could pause your COVID-19 panic buying for one minute to install these critical security fixes, that would be great

library
crime | hacking | security

Google has emitted its latest monthly batch of Android security fixes, addressing a total of 70 CVE-listed vulnerabilities.

The March update includes 17 patches for flaws described as critical remote code execution holes, though only one is actually documented due to the other 16 residing in closed-source Qualcomm components.

The documented flaw, CVE-2020-0032, lies within the open-source Android media framework that can be exploited by opening a booby-trapped file that Google is disturbingly vague about. Patching the bug will also require an update to a codec used by Google Play.

Perhaps the most serious issue this month, however, was not deemed to be a critical risk, even though it affects a large number of people using MediaTek chipsets, and is already being exploited in the wild. The CVE-2020-0069 elevation-of-privilege hole can be exploited by a rogue installed app to inject a rootkit into the firmware of device, which could be a Amazon Fire tablet or gear from Motorola, Sony, Xiaomi, and others.

Android owners – you’ll want to get these latest security patches, especially for this nasty Bluetooth hijack flaw

The rootkit will run beneath the security protections of the Android kernel, and can spy on you and mess with applications without you realizing what’s going on. According to the members of XDA Developer Forum who uncovered the flaw, it has been under active exploit for several months prior to being patched by Google.

Not discussed by Google were 40 flaws in various Qualcomm components that, as a rule, do not usually get any sort of detailed explanation when they are patched due to the code being closed-source. Of those, 16 were designated as critical, a label that is almost always reserved for remote code execution vulnerabilities.

The remaining fixes this month are for various elevation-of-privilege and information-disclosure vulnerabilities. Of those, one was found in the Android framework, two in the media framework, and six in the Android system software. Four elevation-of-privilege flaws were also located and patched in the Android kernel.

For those using Google-branded devices, the update is available for download and installation right now. Other Android owners will have to rely on their device vendor or carrier to test and release the fixes, a process that can take days or months or never.

IT admins managing corporate gadgets, meanwhile, will ideally want to get the fixes tested and deployed before next Tuesday, when Microsoft, Intel, Adobe, and SAP are all scheduled to emit their monthly security updates. ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/05/google_march_android_fixes/

Like a Virgin, hacked for the very first time… UK broadband ISP spills 900,000 punters’ records into wrong hands from insecure database

library
crime | hacking | security

Virgin Media, one of the UK’s biggest ISPs, on Thursday admitted it accidentally spilled 900,000 of its subscribers’ personal information onto the internet via a poorly secured database.

The cableco said it “incorrectly configured” a storage system so that at least one miscreant was able to access it and potentially siphon off customer records. The now-secured marketing database – containing names, home and email addresses, and phone numbers, and some dates of birth, plus other info – had been left open since mid-April 2019.

Crucially, the information “was accessed on at least one occasion but we do not know the extent of the access,” Virgin Media’s CEO Lutz Schüler said in a statement this evening. Said access, we speculate, could have been from an automated bot scanning the internet, or someone prowling around looking for open gear; at this stage, we don’t know.

EE, Virgin Media hit with £13.3m fine: Squeezing users for fees for early contract termination not OK

In a separate email to subscribers, shared with El Reg by dozens of readers, the telco expanded: “The database was used to manage information about our existing and potential customers in relation to some of our marketing activities. This included: contact details (such as name, home and email address and phone numbers), technical and product information, including any requests you may have made to us using forms on our website. In a very small number of cases, it included date of birth.”

The storage box, we understand, not only contained Virgin Media broadband and fixed-line subscriber records – some 15 per cent of that total customer base – but also info on some cellular users. If a punter referred a friend to Virgin Media, that pal’s details may be in the silo, too.

“Given the nature of the information involved, there is a risk you might be targeted for phishing attempts, fraud or nuisance marketing communications,” customers were told.

Below is the letter in full to Virgin Media punters:

We are very sorry to have to inform you that we recently became aware that some of your personal information, stored on one of our databases has been accessed without permission. Our investigation is ongoing but we currently understand that the database was accessible from at least 19 April 2019 and that the information has been recently accessed.

To reassure you, the database did NOT include any of your passwords or financial details, such as bank account number or credit card information.

The database was used to manage information about our existing and potential customers in relation to some of our marketing activities. This included: contact details (such as name, home and email address and phone numbers), technical and product information, including any requests you may have made to us using forms on our website. In a very small number of cases, it included date of birth. Please note that this is all of the types of information in the database, but not all of this information may have related to you.

We take our responsibility to protect your personal information seriously. We know what happened, why it happened and as soon as we became aware we immediately shut down access to the database and launched a full independent forensic investigation. We have also informed the Information Commissioner’s Office.

Given the nature of the information involved, there is a risk you might be targeted for phishing attempts, fraud or nuisance marketing communications. We understand that you will be concerned so we are writing to everybody affected to provide reassurance, guidance and support. We have put all of the latest information on our website, including some advice on how to stay safe online, such as:

* Advice from the Information Commissioner’s Office on how you can avoid or report nuisance marketing calls, emails and texts

* How to be vigilant by not providing your personal information to anyone suspicious online, by phone, email or text. If you want more information, you can get it here

* How you can protect yourself from the risk of identity theft (which is when someone uses someone else’s personal information to obtain goods, services or money without permission) and other types of fraud. The Information Commissioner’s Office has information online here

Although no financial, banking details or account passwords were accessed, it is always a good idea to make sure that your passwords are strong and not easy to guess. There is some advice here on how to set a strong password.

If having read this email and visited our website you still have questions, you can contact us on 0800 052 2621, but please be aware our customer service advisors do not have any further information at this stage. Once again, we sincerely apologise for what has happened.

Lutz Schueler CEO, Virgin Media

If there is any good news to be had, it is that the database did not include any payment information nor passwords. As you can see above, Virgin Media said it has informed the UK’s privacy watchdog, and brought in an outside investigator to look into the blunder. ®

Sponsored:
Quit your addiction to storage

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/05/virgin_media_subscriber_data_leak/

Attackers Distributing Malware Under Guise of Security Certificate Updates

library
crime | hacking | security

Approach is a twist to the old method of using fake software, browser updates, Kaspersky says.

Cybercriminals can be an innovative bunch when it comes to finding new ways to distribute malware.

The latest example is a new campaign involving the use of a fake digital certificate “update” to try and infect systems of visitors to previously compromised websites.

Security vendor Kaspersky on Thursday reported that its researchers had recently observed visitors to various websites being greeted with a warning about the site’s security certificate having expired and being invited to download an updated one instead. Users who fell for the lure ended up downloading malware on their systems.

The campaign appears to have started around mid-January and impacted visitors to several websites, including one belonging to a zoo and another to an auto parts dealer. Kaspersky said it is not immediately clear how exactly the attackers behind the campaign might have initially infected these sites.

According to Kaspersky, the campaign is the first one its researchers have encountered where attackers are attempting to distribute malware in the guise of a website security update. The method is a slight twist on an approach that attackers have employed for a long time of hiding malware in fake software and browser updates and Adobe Flash installs. Attackers have planted such updates on legitimate sites and tried to trick users into downloading them under various pretexts — or they have tricked them to navigating to sites hosting the malicious updates.

“People are particularly susceptible to this type of attack because it appears on legitimate websites — ones they’ve possibly already visited,” says Victoria Vlasova, a malware analyst at Kaspersky.

In the latest campaign, users to infected websites are greeted with a notification through an iframe about the site’s security certificate being out of date. The contents of the iframe are from a third-party resource and are simply overlaid on top of the original page. As a result, the URL bar still displays the legitimate address of the compromised website, Kaspersky said in a report. The iframe overlay is also exactly the same size as the page so users wouldn’t have an easy way to proceed to the site if they chose to ignore the fake notification.

Because the address listed in the iframe is, in fact, the real address of the website, the natural instinct for users is to install the recommended certificate so they can view the content they want to, Vlasova says. “However, users should always be wary when prompted to download something by an online source,” she adds. “Chances are, it’s not necessary.”

Campaign Being Used to Distribute Mokes Buerak Malware
In the new campaign that Kaspersky observed, attackers are distributing Mokes and Buerak, two previously known pieces of malware, under the guise of a security certificate update.

Mokes is a backdoor from several years ago that can be used to download other malware, steal credentials, and intercept data that users might enter into a Web form. The malware, referred to by some as “Smoke Loader,” can also be used to install shell code on an infected computer, according to Kaspersky. Buerak has similar functionality and can be used to spread other malware, including crypto-mining software, ransomware, remote access Trojans, and keyloggers.

“As incidents involving certificate issuance and deployment become more well-known and mainstream, attackers have one more avenue to use in creating attacks that leverage social engineering efforts” said Pratik Savla, senior security engineer at Venafi. “Unfortunately, and also unsurprisingly, we are bound to see an uptick of this kind of campaign.”

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s featured story: “The Perfect Travel Security Policy for a Globe-Trotting Laptop.”

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/attackers-distributing-malware-under-guise-of-security-certificate-updates/d/d-id/1337250?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

3 Data Breaches Disclosed This Week: J.Crew, T-Mobile, and Carnival

library
crime | hacking | security

The separate incidents show how data theft knows no market-based limits.

A series of enterprise data breaches disclosed this week underscores how criminals target various industries to steal and monetize data. The breaches at J.Crew, T-Mobile, and two units of cruise-line operator Carnival Corp., show that millions of customers can feel the effect of even the simplest exploit.

In its disclosure letter to customers, J.Crew said that customers’ email addresses and passwords were obtained by an unauthorized third party and that significant additional personal information could have been accessed in the April 2019 incident. No information was provided on the number of customers affected, but the notification noted that the breached accounts had been de-activated pending a customer telephone call and password re-set.

T-Mobile disclosed a breach affecting an unknown number of customers, though gaining that information is complicated because of the path taken to the customer information: Employee data was breached, some of which contained customer information. In a notification document, the wireless carrier said, “Information accessed illegally may have included names and addresses, phone numbers, account numbers, rate plans and features, and billing information.”

Finally, Holland America Line and Princess Cruises, two units of Carnival Corp, disclosed a breach from May 2019 in which personal information including mail accounts, names, Social Security numbers, and credit card information of some employees and customers were illegally accessed. While no numbers were given regarding victims, a notice with the California Attorney General’s office indicates that more than 500 individuals were affected. Carnival said that when the breach was discovered, it acted quickly to shut down the unauthorized access.

For more, read here, here, and here.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/attacks-breaches/3-data-breaches-disclosed-this-week-jcrew-t-mobile-and-carnival/d/d-id/1337251?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Staffer emails compromised and customer details exposed in T-Mobile US’s third data whoopsie in as many years

library
crime | hacking | security

US telco giant T-Mobile has suffered an attack that could have spaffed customer information far and wide.

The company did not specify exactly when the attack took place (and has yet to respond to questions from The Register) in its Notice Of Data Breach.

The attack gave miscreants access to employee email accounts, which contained customer account information. The data included names, addresses and phone numbers as well as rate plans. T-Mobile was quick to reassure customers that financial information and Social Security numbers were not exposed.

Presumably its employees don’t send that sort of stuff around in email form.

Sponsored:
Detecting cyber attacks as a small to medium business

Article source: https://go.theregister.co.uk/feed/www.theregister.co.uk/2020/03/05/tmobile_breach/

Advanced Tech Needs More Ethical Consideration & Security

library
crime | hacking | security

Unintended consequences and risks need board-level attention and action.

Even the best inventions and intentions can result in unintended consequences. Email vastly improved many forms of communication and information sharing — but it also begat spam, phishing, and an entire industry in cybersecurity. Social media connected billions of people and spread democratic ideals — but it also wrought hacked accounts, stolen data, “fake news,” and election meddling.

The same is true with today’s “advanced technologies” that promise to revolutionize information gathering, data analytics, workplace mobility, and much more during the coming decade. The ethical considerations and possible regulation of artificial intelligence (AI), machine learning, robotics, and other advanced technologies are playing catch-up once again. Boards and C-suites need to pay more attention and take action to avoid bad outcomes.

The recent confrontation between the US and Iran is a case in point. Threats of cyber warfare along with conventional military action put security executives at every major organization on high alert and questioning what to do in the event of a breach. There are worries of vulnerabilities to the infrastructure and that attackers could be impossible to identify. Very few organizations are fully prepared to respond to an incident at an enterprise or organizational level. An effective response to a major cyber incident requires current, effective IT-focused cyber plans, but also participation from all lines of business and operational support areas to ensure a successful integrated, orchestrated recovery.

The benefits of advanced technologies to industry and commerce are manifold. In healthcare, robotic surgeries improve recovery rates and reduce days spent in the hospital. AI and machine learning boost productivity in the data-dependent financial services industry, increasing analytical efficiency while reducing manual work and human errors. The same goes for most industries.

But along with the benefits come the risks. Robotic surgery can result in errors, just as in manual surgery, because there is always a human element involved. The healthcare industry has shown itself particularly vulnerable to ransomware attacks, which continue to proliferate. In finance, bad data input can thwart the best AI. In transportation, we’ve already seen manifestations of the inherent risks of the highly touted “autonomous” vehicles. All of these examples contain cybersecurity risks because of their network connections.

Government is usually playing catch-up in the ethics, security, and regulation of advanced tech. Cybersecurity and data privacy were growing concerns and breaches were rampant long before the EU’s General Data Protection Regulation (GDPR) took effect in Europe in 2018 to try to plug the holes in the proverbial security and privacy dikes. We still have no federal data privacy regulation in the US, although the California Consumer Privacy Act (CCPA) will affect most companies in 2020. With advanced tech, we can expect unintended consequences that we may not be able to imagine.

Most federal lawmakers and regulators have only had exposure to advanced tech for maybe 20% of their lives and are hesitant to act before understanding the regulatory consequences in depth. So, it’s generally left to the cognoscenti in business and the tech community to self-regulate, at least in the early days of any new technology.

As risk managers, we must think three steps ahead of the implementation of many advanced technologies. What could be the unintended consequences of deploying this technology? What are the business security and reputational risks to our organization? Is it legal and/or ethical if the tech helps us make our earnings look better than they may otherwise? Do the benefits sufficiently outweigh the risks to our enterprise?

I would like to recommend some best practices in assessing the ethical, security, and risk implications of advanced tech:

Involve boards and C-suites early. Appoint a board-level committee to examine the risk, ethical, and beneficial implications of new tech. Don’t delegate it to line managers, who lack the time, expertise, and incentives to do a strategic examination.
Know your security environment and data. Build, maintain, and share your environment data model and security protocols with your executive team, operational team, and cyber incident response team.
Avoid silos. Make sure your ethics review includes every department within your organization to demonstrate the risks and business impacts on the entire enterprise.
Keep it simple. There is no need to dissect each line of code. Keep your focus on the key ethical and regulatory implications of any technology under review.
Appoint an “ethics champion.” Give him or her access to senior leadership and include the champion in all high-level discussions and actions on the ethics of advanced tech.

Examining the security and ethical standards of advanced tech can be a slippery slope. Self-regulation only works if self-regulators follow legal and ethical standards. As noted, GDPR and CCPA only came about in reaction to widespread cybersecurity breaches and threats. With any regulation, whistleblowers must not only be tolerated but listened to, protected, and sometimes encouraged.

To date, the results of self-regulation of data management and advanced technologies in many industries have been, at best, mixed. Witness the continuing data breaches and threats of nation-state cyber warfare. We have the guidelines and tools needed to do better. By carefully examining all of the potential consequences of implementing a new technology — and considering all of its ethical and security implications — we have the ability to minimize the risks associated with advanced technology.

Related Content:

As Chief Revenue Officer at Fusion Risk Management, Paul Ybarra leads and oversees all revenue generation processes in the organization, including sales, marketing, and customer care functions. Paul has more than 25 years of management experience, with 20 years of success in … View Full Bio

Article source: https://www.darkreading.com/risk/advanced-tech-needs-more-ethical-consideration-and-security/a/d-id/1337134?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Search Engine Aims to Make Dark Markets More Accessible

library
crime | hacking | security

Two years after the administrator of the Grams search engine shuttered the service, another search engine for finding questionable and illegal goods on the Dark Web has opened up shop.

An anonymous developer has created a search engine for the Dark Web that will make searching for questionable and illegal goods and services easier, borrowing from the previously popular Grams search engine that shut down two years ago, according to an analysis of the service published today by Digital Shadows.

The search engine, dubbed Kilos, borrows a lot of design elements from and improves on the functionality of the Grams search engine, extensively indexing six different dark markets. While other search engines have appeared over the past few years — such as Ahmia, Onion Search Engine, and Fresh Onions — Kilos appears to trump them in terms of functionality, says Alex Guirakhoo, strategy and research analyst at Digital Shadows, a provider of risk protection solutions.

“Since 2017 there have been several Dark Web search engines that each offer varying levels of functionality … many of these have been fairly basic and incomprehensive in their coverage,” he says. “Kilos has received a lot of attention on both cybercriminal and mainstream platforms due to its customizability and range of sources.”

The Grams search engine used custom APIs to collect information on products and services sold in a handful of major dark markets. Such markets are made up of sellers of gray market and black market goods and services on the Dark Web, which uses TOR or another anonymization service to keep users identities and the source of transactions a secret. In addition, the developers had paired the service with a bitcoin “tumbler” or “mixer,” a method of combining bitcoin transactions into pools to anonymize the identities of the buyers.

In December 2017, the search engine shut down due to the difficulty in collecting information and the burden of maintaining the site, Digital Shadows stated in the analysis. Yet the bitcoin mixer service, named Helix, attracted the attention of US federal prosecutors, which led to the indictment of 36-year-old Larry Harmon of Akron, Ohio, in February on three counts of money laundering and financial crimes for anonymizing more than $300 million in transactions.

“The sole purpose of Harmon’s operation was to conceal criminal transactions from law enforcement on the Darknet, and because of our growing expertise in this area, he could not make good on that promise,” said Don Fort, chief, IRS Criminal Investigation, in a statement announcing the charges on Feb. 13. “Working in tandem with other sites, he sought to be the ‘go-to’ money launderer on the Darknet, but our investigators once again played the role of criminal disrupters, unraveling the interlinked web from one tentacle to another.”

Kilos’ developer appears to be following Harmon’s playbook. In addition to the search engine functionality, the developer also announced its own bitcoin mixing service, dubbed “Krumble.”

“According to the Kilos administrator, Krumble takes great effort in ensuring user anonymity compared with other Bitcoin mixers by randomizing the transaction and commission fees, enforcing a randomized transaction delay, and only operating over TOR,” stated Digital Shadows in its advisory.

The company theorizes that the two projects may have some of the same backers or developers. The similarities extend just beyond the design of the sites and the pairing of a search engine with a cryptocurrency mixer, says Digital Shadows’ Guirakhoo.

“If the two do not share the same creator, it’s also possible that Kilos’ design seeks to capitalize on the popularity of Grams,” he says. “This is common with cybercriminal marketplaces.”

In addition, to help prevent denial-of-service attacks and competitors from scraping, the developers of Kilos have implemented a CAPTCHA that asks users to rank product and vendor feedback by whether the review is positive or negative. The CAPTCHA serves a secondary function as well, giving the developers additional data to train the software’s machine learning algorithm and improve the search function, Guirakhoo says.

“The site’s administrator uses the responses to train the search engine’s sentiment classifier, which rates results based on an assigned sentiment value to help ensure the highest quality listings are prioritized,” he says.

The service gives defenders a view into how illegal and gray market sellers and services continue to improve. Digital Shadows predicts that the service will continue to improve, but given US investigators’ takedown of the Grams and Helix services, Kilos and Krumble tempt a similar fate, Guirakhoo says.

“Unlike legitimate software, there is little incentive for the creators of ethically questionable services to be transparent in their development,” he says. “These are typically homegrown projects, managed by a select few individuals.”

Related Content:

Check out The Edge, Dark Reading’s new section for features, threat data, and in-depth perspectives. Today’s top story: “The Perfect Travel Security Policy for a Globe-Trotting Laptop.”

Veteran technology journalist of more than 20 years. Former research engineer. Written for more than two dozen publications, including CNET News.com, Dark Reading, MIT’s Technology Review, Popular Science, and Wired News. Five awards for journalism, including Best Deadline … View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/search-engine-aims-to-make-dark-markets-more-accessible/d/d-id/1337243?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Researchers Find 670+ Microsoft Subdomains Vulnerable to Takeover

library
crime | hacking | security

The now-fixed flaw could have enabled attackers to trick users into downloading malicious content or sharing credentials.

Security researchers discovered more than 670 Microsoft subdomains vulnerable to account takeover, potentially giving attackers the ability to trick users into sharing their usernames and passwords or downloading malicious files.

Subdomain takeover occurs when a subdomain can be controlled by anyone other than system admins, explain Numan Ozdemir and Ozan Agdepe of security alert service Vullnerability, in a blog post. This can happen due to expired hosting services or DNS misconfigurations, and it can allow an adversary to upload files, create databases, track data traffic, or create a clone of a primary website. If a subdomain seems legitimate, users will likely enter their information.

This discovery means attackers could have potentially accessed the subdomains of hundreds of Microsoft services and used them in phishing and malware campaigns. Victims can’t tell whether a subdomain has been compromised. As a result, if they visit a hijacked subdomain and are prompted to enter their credentials or download a malicious file, they’ll likely do it.

Ozdemir and Agdepe created an automated system to scan all subdomains of some Microsoft domains and found the vulnerable subdomains. These included identityhelp.microsoft.com, mybrowser.microsoft.com, web.visualstudio.com, and dev.social.microsoft.com, among others. The researchers shared their findings with Microsoft, which fixed the affected subdomains.