Author Archives: BrianKrebs

Supply Chain Security is the Whole Enchilada, But Who’s Willing to Pay for It?

Posted on by

From time to time, there emerge cybersecurity stories of such potential impact that they have the effect of making all other security concerns seem minuscule and trifling by comparison. Yesterday was one of those times. Bloomberg Businessweek on Thursday published a bombshell investigation alleging that Chinese cyber spies had used a U.S.-based tech firm to secretly embed tiny computer chips into electronic devices purchased and used by almost 30 different companies. There aren’t any corroborating accounts of this scoop so far, but it is both fascinating and terrifying to look at why threats to the global technology supply chain can be so difficult to detect, verify and counter. Continue reading Supply Chain Security is the Whole Enchilada, But Who’s Willing to Pay for It?→

When Security Researchers Pose as Cybercrooks, Who Can Tell the Difference?

Posted on by

A ridiculous number of companies are exposing some or all of their proprietary and customer data by putting it in the cloud without any kind of authentication needed to read, alter or destroy it. When cybercriminals are the first to discover these missteps, usually the outcome is a demand for money in return for the stolen data. But when these screw-ups are unearthed by security professionals seeking to make a name for themselves, the resulting publicity often can leave the breached organization wishing they’d instead been quietly extorted by anonymous crooks. Continue reading When Security Researchers Pose as Cybercrooks, Who Can Tell the Difference?→

Voice Phishing Scams Are Getting More Clever

Posted on by

Most of us have been trained to be wary of clicking on links and attachments that arrive in emails unexpected, but it’s easy to forget scam artists are constantly dreaming up innovations that put a new shine on old-fashioned telephone-based phishing scams. Think you’re too smart to fall for one? Think again: Even technology experts are getting taken in by some of the more recent schemes (or very nearly). Continue reading Voice Phishing Scams Are Getting More Clever→

Facebook Security Bug Affects 90M Users

Posted on by

Facebook said today some 90 million of its users may get forcibly logged out of their accounts after the company fixed a rather glaring security vulnerability in its Web site that may have let attackers hijack user profiles. In short blog post published this afternoon, Facebook said hackers have been exploiting a vulnerability in Facebook’s […] Continue reading Facebook Security Bug Affects 90M Users→

Secret Service Warns of Surge in ATM ‘Wiretapping’ Attacks

Posted on by

The U.S. Secret Service is warning financial institutions about a recent uptick in a form of ATM skimming that involves cutting cupcake-sized holes in a cash machine and then using a combination of magnets and medical devices to siphon customer account data directly from the card reader inside the ATM. Continue reading Secret Service Warns of Surge in ATM ‘Wiretapping’ Attacks→

Beware of Hurricane Florence Relief Scams

Posted on by

If you’re thinking of donating money to help victims of Hurricane Florence, please do your research on the charitable entity before giving: A slew of new domains apparently related to Hurricane Florence relief efforts are now accepting donations on behalf of victims without much accountability for how the money will be spent.

For the past two weeks, KrebsOnSecurity has been monitoring dozens of new domain name registrations that include the terms “hurricane” and/or “florence” and some word related to support (e.g., “relief,” “assistance,” etc. Most of these domains have remained parked or dormant since their creation earlier this month; however, several of them became active only in the past few days, directing visitors to donate money through private PayPal accounts without providing any information about who is running the site or what will be done with donated funds. Continue reading Beware of Hurricane Florence Relief Scams→

Credit Freezes are Free: Let the Ice Age Begin

Posted on by

It is now free in every U.S. state to freeze and unfreeze your credit file and that of your dependents, a process that blocks identity thieves and others from looking at private details in your consumer credit history. If you’ve been holding out because you’re not particularly worried about ID theft, here’s another reason to reconsider: The credit bureaus profit from selling copies of your file to others, so freezing your file also lets you deny these dinosaurs a valuable revenue stream. Continue reading Credit Freezes are Free: Let the Ice Age Begin→

Mirai Botnet Authors Avoid Jail Time

Posted on by

Citing “extraordinary cooperation” with the government, a court in Alaska on Tuesday sentenced three men to probation, community service and fines for their admitted roles in authoring and using “Mirai,” a potent malware strain used in countless attacks designed to knock Web sites offline — including an enormously powerful attack in 2016 that sidelined this Web site for nearly four days. Continue reading Mirai Botnet Authors Avoid Jail Time→

GovPayNow.com Leaks 14M+ Records

Posted on by

Government Payment Service Inc. — a company used by thousands of U.S. state and local governments to accept online payments for everything from traffic citations and licensing fees to bail payments and court-ordered fines — has leaked more than 14 million customer records dating back at least six years, including names, addresses, phone numbers and the last four digits of the payer’s credit card. Continue reading GovPayNow.com Leaks 14M+ Records→

U.S. Mobile Giants Want to be Your Online Identity

Posted on by

The four major U.S. wireless carriers today detailed a new initiative that may soon let Web sites eschew passwords and instead authenticate visitors by leveraging data elements unique to each customer’s phone and mobile subscriber account, such as location, customer reputation, and physical attributes of the device. Here’s a look at what’s coming, and the potential security and privacy trade-offs of trusting the carriers to handle online authentication on your behalf. Continue reading U.S. Mobile Giants Want to be Your Online Identity→