Author Archives: BrianKrebs

Inside ‘The Attack That Almost Broke the Internet’

Posted on by

In March 2013, a coalition of spammers and spam-friendly hosting firms pooled their resources to launch what would become the largest distributed denial-of-service (DDoS) attack the Internet had ever seen. The assault briefly knocked offline the world’s largest anti-spam organization, and caused a great deal of collateral damage to innocent bystanders in the process. Here’s a never-before-seen look at how that attack unfolded, and a rare glimpse into the shadowy cybercrime forces that orchestrated it. Continue reading Inside ‘The Attack That Almost Broke the Internet’→

United Airlines Sets Minimum Bar on Security

Posted on by

United Airlines has rolled out a series of updates to its Web site that the company claims will help beef up the security of customer accounts. But at first glance, the core changes — moving from a 4-digit PINs to password and requiring customers to pick five different security questions and answers — may seem like a security playbook copied from Yahoo.com, circa 2009. Here’s a closer look at what’s changed in how United authenticates customers, and hopefully a bit of insight into what the nation’s fourth-largest airline is trying to accomplish with its new system. Continue reading United Airlines Sets Minimum Bar on Security→

A Life or Death Case of Identity Theft?

Posted on by

Identity thieves have perfected a scam in which they impersonate existing customers at retail mobile phone stores, pay a small cash deposit on pricey new phones, and then charge the rest to the victim’s account. In most cases, switching on the new phones causes the victim account owner’s phone(s) to go dead. This is the story of a Pennsylvania man who allegedly died of a heart attack because his wife’s phone was switched off by ID thieves and she was temporarily unable to call for help. Continue reading A Life or Death Case of Identity Theft?→

Malware Infected All Eddie Bauer Stores in U.S., Canada

Posted on by

Clothing store chain Eddie Bauer said today it has detected and removed malicious software from point-of-sale systems at all of its 350+ stores in North America, and that credit and debit cards used at those stores during the first six months of January may have been compromised in the breach. The acknowledgement comes nearly six weeks after KrebsOnSecurity first notified the clothier about a possible intrusion at stores nationwide. Continue reading Malware Infected All Eddie Bauer Stores in U.S., Canada→

Massive Email Bombs Target .Gov Addresses

Posted on by

Over the weekend, unknown assailants launched a massive cyber attack aimed at flooding .gov email inboxes with subscription requests to thousands of email lists. According to experts, the attack was successful largely thanks to the staggering number of email newsletters that don’t take the basic step of validating new signup requests. Continue reading Massive Email Bombs Target .Gov Addresses→

SSA: Ixnay on txt msg reqmnt 4 e-acct, sry

Posted on by

The U.S. Social Security Administration says it is reversing a newly enacted policy that required a cell phone number from all Americans who wished to manage their retirement benefits at ssa.gov. The move comes after a policy rollout marred by technical difficulties and criticism that the new requirement did little to prevent identity thieves from siphoning benefits from Americans who hadn’t yet created accounts at ssa.gov for themselves. Continue reading SSA: Ixnay on txt msg reqmnt 4 e-acct, sry→

Visa Alert and Update on the Oracle Breach

Posted on by

Credit card industry giant Visa on Friday issued a security alert warning companies using point-of-sale devices made by Oracle’s MICROS retail unit to double-check the machines for malicious software or unusual network activity, and to change passwords on the devices. Visa also published a list of Internet addresses that may have been involved in the Oracle breach and are thought to be closely tied to an Eastern European organized cybercrime gang. Continue reading Visa Alert and Update on the Oracle Breach→

Road Warriors: Beware of ‘Video Jacking’

Posted on by

A little-known feature of many modern smartphones is their ability to duplicate video on the device’s screen so that it also shows up on a much larger display — like a TV. However, new research shows that this feature may quietly expose users to a simple and cheap new form of digital eavesdropping.
Dubbed “video jacking” by its masterminds, the attack uses custom electronics hidden inside what appears to be a USB charging station. As soon as you connect a vulnerable phone to the appropriate USB charging cord, the spy machine hijacks the phone’s video display and records a video of everything you tap, type or view on it as long as it’s plugged in — including PINs, passwords, account numbers, emails, texts, pictures and videos. Continue reading Road Warriors: Beware of ‘Video Jacking’→

Got Microsoft? Time to Patch Your Windows

Posted on by

Microsoft churned out a bunch of software updates today fix some serious security problems with Windows and other Microsoft products like Internet Explorer (IE), Edge and Office. If you use Microsoft, here are some details about what needs fixing. Continue reading Got Microsoft? Time to Patch Your Windows→

Data Breach At Oracle’s MICROS Point-of-Sale Division

Posted on by

A Russian organized cybercrime group known for hacking into banks and retailers appears to have breached more than 700 computer systems at software giant Oracle Corp., KrebsOnSecurity has learned. More alarmingly, the attackers appear to have compromised a customer support portal for companies using Oracle’s MICROS point-of-sale credit card payment systems. Continue reading Data Breach At Oracle’s MICROS Point-of-Sale Division→