Collaborate Disseminate
A US District court in California has found a Russian hacker guilty of breaking into the networks of LinkedIn, Dropbox, and the now defunct social network Formspring, and selling their user databases on the computer underground. In October 2016, Yevgen… Continue reading Man who lived luxury lifestyle after hacking LinkedIn and Dropbox is found guilty
A story published here on July 12 about a new sextortion-based phishing scheme that invokes a real password used by each recipient has become the most-read piece on KrebsOnSecurity since this site launched in 2009. And with good reason — sex sells (the second most-read piece here was my 2015 scoop about the Ashley Madison hack).
But beneath the lurid allure of both stories lies a more unsettling reality: It has never been easier for scam artists to launch convincing, targeted phishing and extortion scams that are automated on a global scale. And given the sheer volume of hacked and stolen personal data now available online, it seems almost certain we will soon witness many variations on these phishing campaigns that leverage customized data elements to enhance their effectiveness. Continue reading The Year Targeted Phishing Went Mainstream
A recent ping from a reader reminded me that I’ve been meaning to blog about the security limitations of using cell phone text messages for two-factor authentication online. The reader’s daughter had received a text message claiming to be from Google, warning that her Gmail account had been locked because someone in India had tried to access her account. The young woman was advised to expect a 6-digit verification code to be sent to her and to reply to the scammer’s message with that code. Continue reading The Limits of SMS for 2-Factor Authentication
The result of the recent LinkedIn, Tumblr and Myspace breaches will be a virtual crime wave as hackers take stolen credentials and unlock other accounts across the web, say experts. Continue reading No Simple Fix for Password Reuse
In the wake of megabreaches at some of the Internet’s most-recognized destinations, don’t be surprised if you receive password reset requests from numerous companies that didn’t experience a breach: Some big name companies — including Facebook and Netflix — are in the habit of combing through huge data leak troves for credentials that match those of their customers and then forcing a password reset for those users. Continue reading Password Re-user? Get Ready to Get Busy
Last week, LifeLock and several other identity theft protection firms erroneously alerted their customers to a breach at cloud storage giant Dropbox.com — an incident that reportedly exposed some 73 million usernames and passwords. The only problem with that notification was that Dropbox didn’t have a breach; the data appears instead to have come from another breach revealed this week at social network Tumblr. Continue reading Dropbox Smeared in Week of Megabreaches
Microsoft says enterprises need to ban common passwords and rethink outdated ideas about what makes a strong password. Continue reading Microsoft Moves Against Bad Passwords
A 2012 data breach that was thought to have exposed 6.5 million hashed passwords for LinkedIn users instead likely impacted more than 117 million accounts, the company now says. In response, the business networking giant said today that it would once again force a password reset for individual users thought to be impacted in the expanded breach. Continue reading As Scope of 2012 Breach Expands, LinkedIn to Again Reset Passwords for Some Users