Author Archives: BrianKrebs

‘Badlock’ Bug Tops Microsoft Patch Batch

Posted on by

Microsoft released fixes on Tuesday to plug critical security holes in Windows and other software. The company issued 13 patches to tackle dozens of vulnerabilities, including a much-hyped “Badlock” file-sharing bug that appears ripe for exploitation. Also, Adobe updated its Flash Player release to address at least two-dozen flaws — in addition to the zero-day vulnerability Adobe patched last week. Continue reading ‘Badlock’ Bug Tops Microsoft Patch Batch→

New Threat Can Auto-Brick Apple Devices

Posted on by

If you use an Apple iPhone, iPad or other iDevice, now would be an excellent time to ensure that the machine is running the latest version of Apple’s mobile operating system — version 9.3.1. Failing to do so could expose your devices to automated threats capable of rendering them unresponsive and perhaps forever useless. Continue reading New Threat Can Auto-Brick Apple Devices→

FBI: $2.3 Billion Lost to CEO Email Scams

Posted on by

The U.S. Federal Bureau of Investigation (FBI) this week warned about a “dramatic” increase in so-called “CEO fraud,” e-mail scams in which the attacker spoofs a message from the boss and tricks someone at the organization into wiring funds to the fraudsters. The FBI estimates that these scams have cost organizations more than $2.3 billion in losses over the past three years. Continue reading FBI: $2.3 Billion Lost to CEO Email Scams→

After Tax Fraud Spike, Payroll Firm Greenshades Ditches SSN/DOB Logins

Posted on by

Online payroll management firm Greenshades.com is an object lesson in how not to do authentication. Until very recently, the company allowed corporate payroll administrators to access employee payroll data online using nothing more than an employee’s date of birth and Social Security number. That is, until criminals discovered this and began mass-filing fraudulent tax refund requests with the IRS on large swaths of employees at firms that use the company’s services. Continue reading After Tax Fraud Spike, Payroll Firm Greenshades Ditches SSN/DOB Logins→

Sources: Trump Hotels Breached Again

Posted on by

Banking industry sources tell KrebsOnSecurity that the Trump Hotel Collection — a string of luxury properties tied to business magnate and Republican presidential candidate Donald Trump — appears to be dealing with another breach of its credit card systems. If confirmed, this would be the second such breach at the Trump properties in less than a year. Continue reading Sources: Trump Hotels Breached Again→

Crooks Steal, Sell Verizon Enterprise Customer Data

Posted on by

Verizon Enterprise Solutions, a division of the telecommunications giant that gets called in to help organizations respond to some of the world’s largest data breaches, is reeling from its own data breach involving the theft and resale of customer data, KrebsOnSecurity has learned. Continue reading Crooks Steal, Sell Verizon Enterprise Customer Data→

Phishing Victims Muddle Tax Fraud Fight

Posted on by

Many U.S. citizens are bound to experience delays in getting their tax returns processed this year, thanks largely to more stringent controls enacted by Uncle Sam and the states to block fraudulent tax refund requests filed by identity thieves. A steady drip of corporate data breaches involving phished employee W-2 information is adding to the backlog, as is an apparent mass adoption by ID thieves of professional tax services for processing large numbers of phony refund requests. Continue reading Phishing Victims Muddle Tax Fraud Fight→

Hospital Declares ‘Internal State of Emergency’ After Ransomware Infection

Posted on by

A Kentucky hospital says it is operating in an “internal state of emergency” after a ransomware attack rattled around inside its networks, encrypting files on computer systems and holding the data on them hostage unless and until the hospital pays up. Continue reading Hospital Declares ‘Internal State of Emergency’ After Ransomware Infection→

Carders Park Piles of Cash at Joker’s Stash

Posted on by

A steady stream of card breaches at retailers, restaurants and hotels has flooded underground markets with a historic glut of stolen debit and credit card data. Today there are at least hundreds of sites online selling stolen account data, yet only a handful of them actively court bulk buyers and organized crime rings. Faced with a buyer’s market, these elite shops set themselves apart by focusing on loyalty programs, frequent-buyer discounts, money-back guarantees and just plain old good customer service. Continue reading Carders Park Piles of Cash at Joker’s Stash→