Author Archives: BrianKrebs

Microsoft Patches Dozens of Security Holes

Posted on by

Microsoft today released updates to address more than three dozen security holes in Windows and related software. Meanwhile, Adobe — which normally releases fixes for its ubiquitous Flash Player alongside Microsoft’s monthly Patch Tuesday cycle — said it’s putting off today’s expected Flash patch until the end of this week so it can address an unpatched Flash vulnerability that already is being exploited in active attacks. Continue reading Microsoft Patches Dozens of Security Holes→

ATM Insert Skimmers In Action

Posted on by

KrebsOnSecurity has featured several recent posts on “insert skimmers,” ATM skimming devices made to fit snugly and invisibly inside a cash machine’s card acceptance slot. I’m revisiting the subject again because I’ve recently acquired how-to videos produced by two different insert skimmer peddlers, and these silent movies show a great deal more than words can tell about how insert skimmers do their dirty work. Continue reading ATM Insert Skimmers In Action→

IRS Re-Enables ‘Get Transcript’ Feature

Posted on by

The Internal Revenue Service has re-enabled a service on its Web site that allows taxpayers to get a copy of their previous year’s tax transcript. The renewed effort to beef up taxpayer authentication methods at irs.gov comes more than a year after the agency disabled the transcript service because tax refund fraudsters were using it to steal sensitive data on consumers. Continue reading IRS Re-Enables ‘Get Transcript’ Feature→

There’s the Beef: Wendy’s Breach Numbers About to Get Much Meatier

Posted on by

When news broke last month that the credit card breach at fast food chain Wendy’s impacted fewer than 300 out of the company’s 5,800 locations, the response from many readers was, “Where’s the Breach?” Today, Wendy’s said the number of stores impacted by the breach is “significantly higher” and that the intrusion may not yet be contained. Continue reading There’s the Beef: Wendy’s Breach Numbers About to Get Much Meatier→

Slicing Into a Point-of-Sale Botnet

Posted on by

Last week, KrebsOnSecurity broke the news of an ongoing credit card breach involving CiCi’s Pizza, a restaurant chain in the United States with more than 500 locations. What follows is an exclusive look at a point-of-sale botnet that appears to have enslaved dozens of hacked payment terminals inside of CiCi’s locations that are being relieved of customer credit card data in real time. Continue reading Slicing Into a Point-of-Sale Botnet→

Password Re-user? Get Ready to Get Busy

Posted on by

In the wake of megabreaches at some of the Internet’s most-recognized destinations, don’t be surprised if you receive password reset requests from numerous companies that didn’t experience a breach: Some big name companies — including Facebook and Netflix — are in the habit of combing through huge data leak troves for credentials that match those of their customers and then forcing a password reset for those users. Continue reading Password Re-user? Get Ready to Get Busy→

Banks: Credit Card Breach at CiCi’s Pizza

Posted on by

CiCi’s Pizza, an American fast food business based in Coppell, Texas with more than 500 stores in 35 states, appears to be the latest restaurant chain to struggle with a credit card breach. It appears that hackers obtained access to card data at affected restaurants by posing as technical support specialists for the company’s point-of-sale provider, and that multiple retailers have been targeted by this cybercrime gang. Continue reading Banks: Credit Card Breach at CiCi’s Pizza→

Dropbox Smeared in Week of Megabreaches

Posted on by

Last week, LifeLock and several other identity theft protection firms erroneously alerted their customers to a breach at cloud storage giant Dropbox.com — an incident that reportedly exposed some 73 million usernames and passwords. The only problem with that notification was that Dropbox didn’t have a breach; the data appears instead to have come from another breach revealed this week at social network Tumblr. Continue reading Dropbox Smeared in Week of Megabreaches→

Mir Islam – the Guy the Govt Says Swatted My Home – to be Sentenced June 22

Posted on by

On March 14, 2013 our humble home in Annandale, Va. was “swatted” — that is to say, surrounded by a heavily-armed police force that was responding to fraudulent reports of a hostage situation at our residence. Later this month the government will sentence 21-year-old hacker named Mir Islam for that stunt and for leading a criminal conspiracy allegedly engaged in a pattern of swatting, identity theft and wire fraud. Continue reading Mir Islam – the Guy the Govt Says Swatted My Home – to be Sentenced June 22→

Got $90,000? A Windows 0-Day Could Be Yours

Posted on by

How much would a cybercriminal, nation state or organized crime group pay for blueprints on how to exploit a serious, currently undocumented, unpatched vulnerability in all versions of Microsoft Windows? That price probably depends on the power of the exploit and what the market will bear at the time, but here’s a look at one convincing recent exploit sales thread from the cybercrime underworld where the current asking price for a Windows-wide bug that allegedly defeats all of Microsoft’s current security defenses is USD $90,000. Continue reading Got $90,000? A Windows 0-Day Could Be Yours→