Author Archives: BrianKrebs

Patch Tuesday Lowdown, April 2019 Edition

Posted on by

Microsoft today released fifteen software updates to fix more than 70 unique security vulnerabilities in various flavors of its Windows operating systems and supported software, including at least two zero-day bugs. These patches apply to Windows, Internet Explorer (IE) and Edge browsers, Office, Sharepoint and Exchange. Separately, Adobe has issued security updates for Acrobat/Reader and Flash Player. Continue reading Patch Tuesday Lowdown, April 2019 Edition→

A Year Later, Cybercrime Groups Still Rampant on Facebook

Posted on by

Almost exactly one year ago, KrebsOnSecurity reported that a mere two hours of searching turned up more than 100 Facebook groups with some 300,000 members openly advertising services to support all types of cybercrime, including spam, credit card fraud… Continue reading A Year Later, Cybercrime Groups Still Rampant on Facebook→

Alleged Chief of Romanian ATM Skimming Gang Arrested in Mexico

Posted on by

An alleged top boss of a Romanian crime syndicate that U.S. authorities say is responsible for deploying card-skimming devices at Automated Teller Machines (ATMs) throughout North America was arrested in Mexico last week on firearms charges. The arrest comes months after the accused allegedly ordered the execution of a former bodyguard who was trying to help U.S. authorities bring down the group’s lucrative skimming operations. Continue reading Alleged Chief of Romanian ATM Skimming Gang Arrested in Mexico→

Canadian Police Raid ‘Orcus RAT’ Author

Posted on by

Canadian police last week raided the residence of a Toronto software developer responsible for authoring and selling “Orcus RAT,” a software product that’s been marketed on underground forums and used in countless malware attacks since its creation in 2015. Its author maintains Orcus is a legitimate Remote Administration Tool that is merely being abused, but security experts say it includes multiple features more typically seen in malware known as a Remote Access Trojan. Continue reading Canadian Police Raid ‘Orcus RAT’ Author→

Annual Protest Raises $250K to Cure Krebs

Posted on by

For the second year in a row, denizens of a large German-language online forum have donated more than USD $250,000 to cancer research organizations in protest of a story KrebsOnSecurity published in 2018 that unmasked the creators of Coinhive, a now-defunct cryptocurrency mining service that was massively abused by cybercriminals. Krebs is translated as “cancer” in German. Continue reading Annual Protest Raises $250K to Cure Krebs→

Man Behind Fatal ‘Swatting’ Gets 20 Years

Posted on by

Tyler Barriss, a 26-year-old California man who admitted making a phony emergency call to police in late 2017 that led to the shooting death of an innocent Kansas resident, has been sentenced to 20 years in federal prison. Continue reading Man Behind Fatal ‘Swatting’ Gets 20 Years→

A Month After 2 Million Customer Cards Sold Online, Buca di Beppo Parent Admits Breach

Posted on by

On Feb. 21, 2019, KrebsOnSecurity contacted Italian restaurant chain Buca di Beppo after discovering strong evidence that two million credit and debit card numbers belonging to the company’s customers were being sold in the cybercrime underground. Toda… Continue reading A Month After 2 Million Customer Cards Sold Online, Buca di Beppo Parent Admits Breach→

Alleged Child Porn Lord Faces US Extradition

Posted on by

In 2013, the FBI exploited a zero-day vulnerability in Firefox to seize control over a Dark Web network of child pornography sites. The alleged owner of that ring – 33-year-old Freedom Hosting operator Eric Eoin Marques – was arrested in Ireland later that year on a U.S. warrant and has been in custody ever since. This week, Ireland’s Supreme Court cleared the way for Marques to be extradited to the United States. Continue reading Alleged Child Porn Lord Faces US Extradition→

Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years

Posted on by

Hundreds of millions of Facebook users had their account passwords stored in plain text and searchable by thousands of Facebook employees — in some cases going back to 2012, KrebsOnSecurity has learned. Facebook says an ongoing investigation has so far found no indication that employees have abused access to this data. Continue reading Facebook Stored Hundreds of Millions of User Passwords in Plain Text for Years→

Why Phone Numbers Stink As Identity Proof

Posted on by

Phone numbers stink for security and authentication. They stink because most of us have so much invested in these digits that they’ve become de facto identities. At the same time, when you lose control over a phone number — maybe it’s hijacked by fraudsters, you got separated or divorced, or you were way late on your phone bill payments — whoever inherits that number can then be you in a lot of places online. Continue reading Why Phone Numbers Stink As Identity Proof→