Author Archives: BrianKrebs

Credit Union Sues Fintech Giant Fiserv Over Security Claims

Posted on by

A Pennsylvania credit union is suing financial industry technology giant Fiserv, alleging that “baffling” security vulnerabilities in the company’s software are “wreaking havoc” on its customers. The credit union said the investigation that fueled the lawsuit was prompted by a 2018 KrebsOnSecurity report about a glaring security weakness a Fiserv platform that exposed personal and financial details of customers across hundreds of bank Web sites. Continue reading Credit Union Sues Fintech Giant Fiserv Over Security Claims→

Data: E-Retail Hacks More Lucrative Than Ever

Posted on by

For many years and until quite recently, credit card data stolen from online merchants has been worth far less in the cybercrime underground than cards pilfered from hacked brick-and-mortar stores. But new data suggests that over the past year, the economics of supply-and-demand have helped to double the average price fetched by card-not-present data, meaning cybercrooks now have far more incentive than ever to target e-commerce stores. Continue reading Data: E-Retail Hacks More Lucrative Than Ever→

P2P Weakness Exposes Millions of IoT Devices

Posted on by

A peer-to-peer (P2P) communications technology built into millions of security cameras and other consumer electronics includes several critical security flaws that expose the devices to eavesdropping, credential theft and remote compromise, new research has found. Continue reading P2P Weakness Exposes Millions of IoT Devices→

Who’s Behind the RevCode WebMonitor RAT?

Posted on by

The owner of a Swedish company behind a popular remote administration tool (RAT) implicated in thousands of malware attacks shares the same name as a Swedish man who pleaded guilty in 2015 to co-creating the Blackshades RAT, a similar product that… Continue reading Who’s Behind the RevCode WebMonitor RAT?→

Marcus “MalwareTech” Hutchins Pleads Guilty to Writing, Selling Banking Malware

Posted on by

Marcus Hutchins, a 24-year-old blogger and malware researcher arrested in 2017 for allegedly authoring and selling malware designed to steal online banking credentials, has pleaded guilty to criminal charges of conspiracy and to making, selling or advertising illegal wiretapping devices. Continue reading Marcus “MalwareTech” Hutchins Pleads Guilty to Writing, Selling Banking Malware→

Wipro Intruders Targeted Other Major IT Firms

Posted on by

The criminals responsible for launching phishing campaigns that netted dozens of employees and more than 100 computer systems last month at Wipro, India’s third-largest IT outsourcing firm, also appear to have targeted a number of other competing providers, including Infosys and Cognizant — two other large technology consulting companies, new evidence suggests. Continue reading Wipro Intruders Targeted Other Major IT Firms→

How Not to Acknowledge a Data Breach

Posted on by

I’m not a huge fan of stories about stories, or those that explore the ins and outs of reporting a breach. But occasionally it seems necessary to publish such accounts when companies respond to a breach report in such a way that it’s crystal clear that… Continue reading How Not to Acknowledge a Data Breach→

Experts: Breach at IT Outsourcing Giant Wipro

Posted on by

Indian information technology (IT) outsourcing and consulting giant Wipro [NYSE:WIT] is investigating reports from multiple security experts that Wipro’s systems have been hacked and are being used to launch attacks against the company’s customers, multiple sources tell KrebsOnSecurity. The company has refused to respond to questions about the alleged incident. Continue reading Experts: Breach at IT Outsourcing Giant Wipro→

‘Land Lordz’ Service Powers Airbnb Scams

Posted on by

Scammers who make a living swindling Airbnb.com customers have a powerful new tool at their disposal: A software-as-a-service offering called “Land Lordz,” which helps automate the creation and management of fake Airbnb Web sites and the sending o… Continue reading ‘Land Lordz’ Service Powers Airbnb Scams→

Android 7.0+ Phones Can Now Double as Google Security Keys

Posted on by

Google this week made it easier for Android users to enable strong 2-factor authentication (2FA) when logging into Google’s various services. The company announced that all phones running Android 7.0 and higher can now be used as Security Keys, an additional authentication layer that helps thwart phishing sites and password theft. Continue reading Android 7.0+ Phones Can Now Double as Google Security Keys→