@briankrebs@infosec.exchange avatar

briankrebs

@briankrebs@infosec.exchange

Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07 Twitter: @briankrebs Linkedin: https://www.linkedin.com/in/bkrebs/

This profile is from a federated server and may be incomplete. For a complete list of posts, browse on the original instance.

briankrebs , to random
@briankrebs@infosec.exchange avatar

Wired has a good story from @kimzetter about how the ShinyHunters group got access to Ticketmaster's Snowflake cloud account.

"Snowflake has not revealed details about how the hackers accessed the accounts, saying only that the intruders did not directly breach Snowflake’s network. This week, Google-owned security firm Mandiant, one of the companies engaged by Snowflake to investigate the breaches, revealed in a blog post that in some cases the hackers first obtained access through third-party contractors, without identifying the contractors or stating how this access aided the hackers in breaching the Snowflake accounts.

But according to one of the hackers who spoke with WIRED through a text chat, one of those firms was EPAM Systems, a publicly traded software engineering and digital services firm, founded by Belarus-born Arkadiy Dobkin, with current revenue of around $4.8 billion. The hacker says his group, which calls themselves ShinyHunters, used data found on an EPAM employee system to gain access to some of the Snowflake accounts."

https://www.wired.com/story/epam-snowflake-ticketmaster-breach-shinyhunters/

briankrebs , to random
@briankrebs@infosec.exchange avatar

Alleged Boss of "Scattered Spider" Hacking Group Arrested in Spain

A 22-year-old man from the United Kingdom arrested this week in Spain is allegedly the ringleader of Scattered Spider, a cybercrime group suspected of hacking into Twilio, LastPass, DoorDash, Mailchimp, and nearly 130 other organizations over the past two years.

https://krebsonsecurity.com/2024/06/alleged-boss-of-scattered-spider-hacking-group-arrested/

briankrebs , to random
@briankrebs@infosec.exchange avatar

So, I guess we just need a constitutional amendment that says convicted felons can't hold the highest office in the land? Soonish? How hard would that be?

briankrebs , to random
@briankrebs@infosec.exchange avatar

Today's story: 'Operation Endgame' Hits Malware Delivery Platforms

Law enforcement agencies in the United States and Europe today announced Operation Endgame, a coordinated action against some of the most popular cybercrime platforms for delivering ransomware and data-stealing malware. Dubbed “the largest ever operation against botnets,” the international effort is being billed as the opening salvo in an ongoing campaign targeting advanced malware “droppers” or “loaders” like IcedID, Smokeloader and Trickbot.

https://krebsonsecurity.com/2024/05/operation-endgame-hits-malware-delivery-platforms/

A still shot from one of three animated videos released on operation-endgame.com, which speak directly to Russian cybercriminals and include a good deal of Cyrillic text. In this still shot, we can see a red countdown timer in the background until the release of new videos. In the foreground two Russian speaking hackers are conversing with an English-speaking potential buyer.
ALT
  • Reply
    • briankrebs , to random
    @briankrebs@infosec.exchange avatar

    What a story: A former sheriff from Florida has received political asylum in Moscow, and is now a key player in Russia's disinformation operations against the West, the NYT reports.

    "Working from an apartment crowded with servers and other computer equipment, Mr. Dougan has built an ever-growing network of more than 160 fake websites that mimic news outlets in the United States, Britain and France."

    https://www.nytimes.com/2024/05/29/business/mark-dougan-russia-disinformation.html

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Haha, wow. Treasury just sanctioned 3 Chinese nationals for allegedly running 911S5, a giant botnet that was sold for about a decade as one of the most reliable and cheapest proxy services for routing your traffic through someone else's (infected) machine.

    One of the guys sanctioned by Treasury today I named as the apparent head of 911S5 in China, in a 2022 deep dive on this venerated proxy service. 911S5 imploded less than a week later, saying it had been massively hacked and that all user data was wiped.

    https://home.treasury.gov/news/press-releases/jy2375

    https://krebsonsecurity.com/2022/07/a-deep-dive-into-the-residential-proxy-service-911/

    https://krebsonsecurity.com/2022/07/911-proxy-service-implodes-after-disclosing-breach/

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Finally got around to reading an important piece from @anneapplebaum in The Atlantic this month. I'm glad I did, b/c it puts a tremendous amount of sheer madness into perspective.

    THE NEW PROPAGANDA WAR
    Autocrats in China, Russia, and elsewhere are now making common cause with MAGA Republicans to discredit liberalism and freedom around the world.

    https://infosec.exchange/@anneapplebaum@journa.host/112394033190929944

    https://www.theatlantic.com/magazine/archive/2024/06/china-russia-republican-party-relations/678271/?gift=hVZeG3M9DnxL4CekrWGK3xgKh4wbI9WqxWEqzvYfefo&utm_source=copy-link&utm_medium=social&utm_campaign=share

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Someone on Linkedin just praised a recent story and requested to connect, and in the same breath warned me that I'd somehow left clues in my writing that showed AI was used in the composition of the story. It's been a while since I wanted to reach through the interwebs and honk someone's nose.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    So the human $#!+weasel *ucker Carlson just aired an hour long video with Pavel Durov, the CEO of Telegram.

    Mu*k's recent cozying up to Durov/Telegram while making gonzo claims about Telegram security and bashing Signal as somehow less secure starts to make more sense now.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Just published the second-longest blog post in my 14 year career as an independent reporter.

    This story is the result of a ridiculous amount of research. I hope you like it, because I learned tons reporting this, and there needs to be a broader conversation about some of the issues raised by this research. The lede:

    Two weeks before Russia invaded Ukraine in February 2022, a large, mysterious new Internet hosting firm called Stark Industries Solutions materialized and quickly became the epicenter of massive distributed denial-of-service (DDoS) attacks on government and commercial targets in Ukraine and Europe. An investigation into Stark Industries reveals it is being used as a global proxy network that conceals the true source of cyberattacks and disinformation campaigns against enemies of Russia.

    https://krebsonsecurity.com/2024/05/stark-industries-solutions-an-iron-hammer-in-the-cloud/

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    BTW if it teases the story more, the first longest story I wrote was the one about the unveiling of the authors of the Mirai DDoS malware

    https://krebsonsecurity.com/2017/01/who-is-anna-senpai-the-mirai-worm-author/

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    Just added a very interesting wrinkle from the DNS guru Doug Madory over at Kentik, regarding the top sources and destinations for Stark Industries' traffic:

    Doug Madory, director of Internet analysis at Kentik, was able to see at a high level the top sources and destinations for traffic traversing Stark's network.

    "Based on our aggregate NetFlow, we see Iran as the top destination (35.1%) for traffic emanating from Stark (AS44477)," Madory said. "Specifically, the top destination is MTN Irancell, while the top source is Facebook. This data supports the theory that AS44477 houses proxy services as Facebook is blocked in Iran."

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    Malwarebytes has published a writeup on an extensive campaign that targets corporate users with malicious ads. Among the sites used as lures are fake Wall Street Journal and CNN websites that tell visitors they're required to install a WSJ or CNN-branded browser extension.

    tl;dr: A key domain used in this campaign is hosted at Stark Industries Solutions.

    https://www.threatdown.com/blog/corporate-users-targeted-via-malicious-ads-and-modals/

    ThreatDOWfl Products Pricing Partners Why Threatl ~ 9 y Powered by Malwarebytes Home > Blog Requires Browser Extension The fake WSJ homepage had message reading: wsj.com now requires the use of a special browser extension to access its content. This update is aimed at enhancing the user experience and providing additional security during interactions with the website. Users must install the tension to access all the features and services available on the site. INSTALL THREAT INTELLIGENCE Corporate users targeted via malicious ads and modals Posted: April 30,2024 by Jerome Segura
    ALT
  • Reply
    • briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    It has been brought to my attention that I left two important details about Stark out of my story.

    1. Stark's contact details with RIPE, which manages Internet address space for Europe, the Middle East and Central Asia, include a choice "leet" designation and possibly a dig at RIPE: "SICK1337-RIPE"

    Also, I can't believe I forgot to include the bit of movie trivia (I thought it was obvious): In the Marvel storyline, the head of Stark Industries, Tony, was an international arms dealer. Funny enough, Ivan Neculiti, or his brother Yuri who also runs Stark/PQ Hosting, consistently used the email address tony@stark.industries.

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    BTW this was just posted by the pro-Russian DDoS group NoName, wherein they rub it in that people in Europe are just now figuring out that they've been launching DDoS from hosting providers in Europe, not in Russia.

    We recently told how European "experts” were completely blown away when they found out that we were crashing their sites by placing our software right next to them - in Europe & The story continues - now they are indignant that despite their "investigation”, we have put down European sites and continue to put them down! &g Glory to Russia!ma We are working, brothers! [, Follow usRussian version|DDoSia Project|Reserve channel &a @2 W2 @
    ALT
  • Reply
    • briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    @bontchev I paid attention to them because the networks supporting them are also doing a lot more bad stuff than ddos vs UA.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Ah, restaurants. One of the few businesses that actually answer the phone these days. Today, I was presented with what sounded like an automated (AI?) reservation assistant. No shaming. Just asking for someone who hasn't made a dinner reservation in a while: Is this common?

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    Just realized this entire thread makes me sound old af. GET OFF MY LAWN!

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Today's story: Why Your Wi-Fi Router Doubles as an Apple AirTag

    Apple and the satellite-based broadband service Starlink each recently took steps to address new research into the potential security and privacy implications of how their services geo-locate devices. Researchers from the University of Maryland say they relied on publicly available data from Apple to track the location of billions of devices globally -- including non-Apple devices like Starlink systems -- and found they could use this data to monitor the destruction of Gaza, as well as the movements and in many cases identities of Russian and Ukrainian troops.

    https://krebsonsecurity.com/2024/05/why-your-wi-fi-router-doubles-as-an-apple-airtag/

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Best thing I heard all week, from @riskybusiness podcast, in re Telegram: "It's like having the Dark Web in your pocket." LOL https://risky.biz/RB748/

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Ruh roh

    An upside-down flag, adopted by Trump supporters contesting the Biden victory, flew over the justice’s front lawn as the Supreme Court was considering an election case. After the 2020 presidential election, as some Trump supporters falsely claimed that President Biden had stolen the office, many of them displayed a startling symbol outside their homes, on their cars and in online posts: an upside-down American flag. One of the homes flying an inverted flag during that time was the residence of Supreme Court Justice Samuel A. Alito Jr., in Alexandria, Va., according to photographs and interviews with neighbors. The upside-down flag was aloft on Jan. 17, 2021, the images showed. President Donald J. Trump’s supporters, including some brandishing the same symbol, had rioted at the Capitol a little over a week before. Mr. Biden’s inauguration was three days away. Alarmed neighbors snapped photographs, some of which were recently obtained by The New York Times. Word of the flag filtered back to the court, people who worked there said in interviews. While the flag was up, the court was still contending with whether to hear a 2020 election case, with Justice Alito on the losing end of that decision. In coming weeks, the justices will rule on two climactic cases involving the storming of the Capitol on Jan. 6, including whether Mr. Trump has immunity for his actions.
    ALT
  • Reply
  • Expand (8)
  • Collapse (8)
    • + Npars01
    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    The worst part about this is the least horrible thing is the disrespect for everything the flag stands for.

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    I think we are owed a litmus test from all of the Supremes. i.e.: Do you believe the 2020 election was fairly decided? Fsck the presidential "debates." Let's have the Supremes all answer this question on the record.

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    Here is the response NYT got from Justice Alito:

    "I had no involvement whatsoever in the flying of the flag,” Justice Alito said in an emailed statement to The Times. “It was briefly placed by Mrs. Alito in response to a neighbor’s use of objectionable and personally insulting language on yard signs.”

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    I would like to be part of a modest democratic experiment wherein we only elect people who really don't want to hold the office, but are nonetheless very qualified and capable.

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    Seems like there should be a set of decision trees that could accomplish this, or at least dramatically whittle down the possible candidate pool. Someone mentioned the term selective service and that sounds like a fairly apt description of what I mean.

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    Also, probably some latter part of this process would involve a battery of psychological tests, mainly just to minimize the chances that our country is run by psychopaths, narcissists, etc.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    TIL you can quickly find your own posts by including "from:me" in the search box and then a key word or phrase you're searching for. Yes, it took me this long to figure that out.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Last week, the United States joined the U.K. and Australia in sanctioning and charging a Russian man named Dmitry Yuryevich Khoroshev as the leader of the infamous LockBit ransomware group. LockBit's leader "LockBitSupp" claims the feds named the wrong guy, saying the charges don't explain how they connected him to Khoroshev. This post examines the activities of Khoroshev's many alter egos on the cybercrime forums, and tracks the career of a gifted malware author who has written and sold malicious code for the past 14 years.

    https://krebsonsecurity.com/2024/05/how-did-authorities-identify-the-alleged-lockbit-boss/

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Reason #2,391 why revisiting security assumptions is always a good idea.

    [Bimi] No cryptographic connection between VMC and DKIM key

    https://mailarchive.ietf.org/arch/msg/bimi/Ba3jFfJ8K6ic7qg4DzPsIsGW5UY/

    My favorite part:

    "I guess some may consider what I just said as an unimportant or a merely theoretical issue, so I would like to illustrate it with an example. Let's take the domain entrust.com. It has a DKIM key
    configured at "dkim._domainkey.entrust.com". The TXT record is the following:

    "v=DKIM1; k=rsa;
    p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQCyGF0xzO7Eig1H8QdIErjEKOGnIVvoLU5VjcMRBRWZK65NinL+gVnjuMD2mYdjC3f+7sQCWxGDSKIFn/bB+iXxO2x1/ktkwXHQfQ/9FcFuy+LE0Snsm0SwXN/2l1m5f9e1xdswC+dzHt6DIpDSDENsRal019YKQTqwVyB++7QORwIDAQAB"

    This is a 1024 bit RSA key, which is not up to modern standards. But breaking 1024 bit RSA is still only feasible for very powerful attackers. However, this key has another problem: it is vulnerable to
    the Debian OpenSSL bug (CVE-2008-0166). It is trivially possible to
    find the private key (you can use my tool badkeys -
    https://badkeys.info/ - to do that):

    https://github.com/badkeys/debianopenssl/blob/main/rsa1024/ssl/le32/25731-rnd.key"

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    So, back in 2016 I wrote a story about Dell customers getting inundated with spam spoofing the company and referencing the recipient's real name and actual Dell service tag ID for the recipient's computer. Dell responded by asking customers who receive these messages to report them.

    https://krebsonsecurity.com/2016/02/dell-to-customers-report-service-tag-scams/

    Today, Dell disclosed a breach involving "a Dell portal" which contained customer names, physical addresses, and Dell hardware and order information, including service tag, item description, date of order and related warranty info."

    I've asked Dell when they discovered this and how long they believe the intruders had access.

    An important message about your Dell information Hello, Dell Technologies takes the privacy and confidentiality of your information seriously. We are currently investigating an incident involving a Dell portal, which contains a database with limited types of customer information related to purchases from Dell. We believe there is not a significant risk to our customers given the type of information involved. What data was accessed? At this time, our investigation indicates limited types of customer information was accessed, including: * Name « Physical address « Dell hardware and order information, including service tag, item description, date of order and related warranty information The information involved does not include financial or payment information, email address, telephone number or any highly sensitive customer information. What is Dell doing? Upon identifying the incident, we promptly implemented our incident response procedures, began investigating, took steps to contain the incident and notified law enforcement. We have also engaged a third-party forensics firm to investigate this incident. We will continue to monitor the situation. What can | do? Our investigation indicates vour information was accessed during this incident. but we do not
    ALT
  • Reply
    • briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Wow, the US govt finally made good on its doxing threat against the Lockbit ransomware group administrator LockbitSupp. This just released by OFAC:

    SPECIALLY DESIGNATED NATIONALS LIST UPDATE
    The following individual has been added to OFAC's SDN List:
    KHOROSHEV, Dmitry Yuryevich (a.k.a. KHOROSHEV, Dmitrii Yuryevich; a.k.a. KHOROSHEV, Dmitriy Yurevich; a.k.a. YURIEVICH, Dmitry; a.k.a. "LOCKBITSUPP"), Russia; DOB 17 Apr 1993; POB Russian Federation; nationality Russia; citizen Russia; Email Address khoroshev1@icloud.com; alt. Email Address sitedev5@yandex.ru; Gender Male; Digital Currency Address - XBT bc1qvhnfknw852ephxyc5hm4q520zmvf9maphetc9z; Secondary sanctions risk: Ukraine-/Russia-Related Sanctions Regulations, 31 CFR 589.201; Passport 2018278055 (Russia); alt. Passport 2006801524 (Russia); Tax ID No. 366110340670 (Russia) (individual) [CYBER2].

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Basically all of the speaking requests I've received over the last six months, all any of them want to talk about is AI, b/c everyone is trying to position themselves as being the perfect partner to usher companies through the madness. I'm probably not going to be asked to do speaking much longer, b/c I find I am fairly hawkish on all the AI hype.

    I guess I come from a pretty old-fashioned point of view on technology vs security, which is basically that the more you complexify something, the harder it is to secure. And most of the AI visions that companies are espousing would increase the complexity of security efforts by several orders of magnitude. The issue of data governance is just one small microcosm of that (one in which most fail at miserably already).

    I think it's also safe to predict that first movers here (beyond the now entrenched big ones) are going to get clobbered by regulation soon.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Random PSA: If you own a motor vehicle that has a spare tire, it's a good idea to check every once in a while that the spare actually has air in it enough to support the car. Had to get the spare out from under my truck (a hugely complicated maneuver that would be really unfun to do for the first time in an emergency), and found it had about 10 percent of the necessary air.

    If you can't be bothered to check the pressure once a year or so, better keep an air pump in the trunk as well.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Researchers at Leviathan Security have released some interesting findings that illustrate why your VPN service may not be as secure as it claims.

    From the story:

    "VPNs work by creating a virtual network interface that serves as an encrypted tunnel for communications. But researchers at Leviathan Security say they’ve discovered it’s possible to abuse an obscure feature built into the DHCP protocol so that other users on the local network are forced to connect to a rogue DHCP server.

    “Our technique is to run a DHCP server on the same network as a targeted VPN user and to also set our DHCP configuration to use itself as a gateway,” Leviathan researchers Lizzie Moratti and Dani Cronce wrote. “When the traffic hits our gateway, we use traffic forwarding rules on the DHCP server to pass traffic through to a legitimate gateway while we snoop on it.”"

    More here: https://krebsonsecurity.com/2024/05/why-your-vpn-may-not-be-as-secure-as-it-claims/

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Nothing like spending $1700 to fix an obnoxious noise in your car, only to hear the sound again when you're halfway home from the dealership.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    What a surprise.

    "The auditor for former president Donald Trump’s media company was charged with “massive fraud” Friday by the Securities and Exchange Commission, which accused the firm of being a “sham audit mill” whose failures put investors at risk."

    https://www.washingtonpost.com/technology/2024/05/03/trump-media-auditor-borgers-suspended-permanently/

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    It's always amazed me that ID.me, which you have to use in order to interact w/ the IRS online these days, has a top level domain from the country of Montenegro. Ublock Origin says they're injecting tracking links from Italy's TLD when you login at the irs.gov website.

    What's next? Cookies from Colombia? AI from Anguilla?

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    @alex @eb IDK anything about Montengegrin IT capabilities, so I'll take your word for it. But it's worth pointing out that poorly secured or maintained IT resources can be commandeered to do crazy stuff. So your statement fills me with more dread. Thank you.

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    To be clear, I have nothing against private companies or citizens using whatever TLD they want. But we need to stop doing this on important .gov stuff. And I would consider the IRS to easily qualify there.

    briankrebs OP ,
    @briankrebs@infosec.exchange avatar

    How about this? Lawmakers pass a law (gasp!) that says if you're a private company providing services to the entire populace on behalf of .gov, your site will use com/net/org only when it is interacting with the government. Full stop.

    Probably even the extreme wingnuts in the GOP could get behind this, in a kind of "buy American" way.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Dropbox has disclosed a cybersecurity incident, in filing with the SEC:

    https://www.board-cybersecurity.com/incidents/tracker/20240501-dropbox-inc-cybersecurity-incident/#8-k-filed-on-2024-05-01

    On April 24, 2024, Dropbox, Inc. (“Dropbox” or “we”) became aware of unauthorized access to the Dropbox Sign (formerly HelloSign) production environment. We immediately activated our cybersecurity incident response process to investigate, contain, and remediate the incident. Upon further investigation, we discovered that the threat actor had accessed data related to all users of Dropbox Sign, such as emails and usernames, in addition to general account settings. For subsets of users, the threat actor also accessed phone numbers, hashed passwords, and certain authentication information such as API keys, OAuth tokens, and multi-factor authentication. Based on what we know as of the date of this filing, there is no evidence that the threat actor accessed the contents of users’ accounts, such as their agreements or templates, or their payment information. Additionally, we believe this incident was limited to Dropbox Sign infrastructure and there is no evidence that the threat actor accessed the production environments of other Dropbox products. We are continuing our investigation.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Scenario: The (non chaotic evil) sysadmins of the world band together to go on strike. What's on their list of demands?

    *Correct answers optional.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Say what you will about Tesla, but they were the only car company who said they both require a court-ordered warrant before sharing your vehicle's location data AND tell customers about demands for their data.

    This finding comes from the office of Sen. Ron Wyden, which asked the association representing automakers how their members respond to law enforcement requests for location information collected from internet-connected cars and trucks.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    A 26-year-old Finnish man was sentenced to more than six years in prison today after being convicted of hacking into an online psychotherapy clinic, leaking tens of thousands of patient therapy records, and attempting to extort the clinic and patients.

    https://krebsonsecurity.com/2024/04/man-who-mass-extorted-psychotherapy-patients-gets-six-years/

    Even though Julius "Zeekill" Kivimaki has a cybercrime rap sheet thicker than a dictionary, he will end up serving roughly half that time, because all that stuff he did before he turned 18 doesn't count toward first-time offender status.

    BTW, the CEO of the now-bankrupt psychotherapy practice was prosecuted as well (database credentials "root/root") but received a suspended sentence.

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    Well this has been a long time coming: The FCC today levied fines totaling nearly $200 million against the four major carriers -- including AT&T, Sprint, T-Mobile and Verizon -- for illegally sharing access to customers' location information without consent.

    Some highlights: "The FCC's findings against AT&T, for example, show that AT&T sold customer location data directly or indirectly to at least 88 third-party entities. The FCC found Verizon sold access to customer location data (indirectly or directly) to 67 third-party entities. Location data for Sprint customers found its way to 86 third-party entities, and to 75 third-parties in the case of T-Mobile customers."

    ..."The fine amounts vary because they were calculated based in part on each day that the carriers continued sharing customer location data after being notified that doing so was illegal (the agency also considered the number of active third-party location data sharing agreements). The FCC notes that AT&T and Verizon took more than 320 days from the publication of the Times story to wind down their data sharing agreements; T-Mobile took 275 days; Sprint kept sharing customer location data for 386 days."

    More here: https://krebsonsecurity.com/2024/04/fcc-fines-major-u-s-wireless-carriers-for-selling-customer-location-data/

    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    One of these days I'm going to sit down and catalog all the times I've been an IoC.

    This is from a CircleID story about the origins of the Glupteba botnet, which as Internet threats go is about as ubiquitous and long-lived as they come.

    https://circleid.com/posts/20240425-digging-deep-to-examine-the-roots-of-the-glupteba-uefi-bootkit

    More on maybe why my name keeps showing up in Glupteba stuff:

    https://krebsonsecurity.com/2022/06/the-link-between-awm-proxy-the-glupteba-botnet/

    https://krebsonsecurity.com/2022/12/judge-orders-u-s-lawyer-in-russian-botnet-case-to-pay-google/

    It is also interesting to note that threat actors could have chosen at least 24 of the malicious registrant-connected domains for use in attacks since they contained popular text strings or closely resembled those belonging to famous brands that could lure more users into clicking them. These strings include: adobe (adobe-plugin[.]bid) brian-krebs (brian-krebs-erectile-dysfunction[.]com) and krebs (krebsonsecurity[.]top) dell (dell1[.]ug) facebook (facebook-cdn[.]net) kaspersky (kasperskygay-formula[.]in) linkedim (linkedim[.]in) windows (micro-windows[.]in), microsoft (microsoft-office-free-templates[.]in), office (officecloud[.]top), and win (win7-update[.]com) mozilla (mozillaupdates[.]us)
    ALT
  • Reply
    • + Npars01
    briankrebs , to random
    @briankrebs@infosec.exchange avatar

    See, the problem is we need MORE guns in school.

    "Tennessee passes bill to let teachers carry guns, a year after mass shooting"

    https://www.washingtonpost.com/nation/2024/04/23/tennessee-bill-arming-teachers-guns-passes/

  • All
  • Subscribed
  • Moderated
  • Favorites
  • •
  • random
  • test
  • worldmews
  • mews
  • All magazines
    •