• Search for:
    28 Oct, 2021
    Zales.com Leaked Customer Data, Just Like Sister Firms Jared, Kay Jewelers Did in 2018
    Cybersecurity , , , , , ,

    In December 2018, bling vendor Signet Jewelers fixed a weakness in their Kay Jewelers and Jared websites that exposed the order information for all of their online customers. This week, Signet subsidiary Zales.com updated its website to remediate a nearly identical customer data exposure. …

    Read MoreZales.com Leaked Customer Data, Just Like Sister Firms Jared, Kay Jewelers Did in 2018

    26 Oct, 2021
    FBI Raids Chinese Point-of-Sale Giant PAX Technology
    Cybersecurity , , , , , ,

    U.S. federal investigators today raided the U.S. offices of PAX Technology, a Chinese provider of point-of-sale devices used by millions of businesses and retailers globally. KrebsOnSecurity has learned the raid is tied to reports that PAX’s systems may have been involved in cyberattacks on U.S. and E.U. organizations. …

    Read MoreFBI Raids Chinese Point-of-Sale Giant PAX Technology

    25 Oct, 2021
    Conti Ransom Gang Starts Selling Access to Victims
    Cybersecurity , , , , , , , , ,

    The Conti ransomware affiliate program appears to have altered its business plan recently. Organizations infected with Conti’s malware who refuse to negotiate a ransom payment are added to Conti’s victim shaming blog, where confidential files stolen from victims may be published or sold. But sometime over the past 48 hours, the cybercriminal syndicate updated its victim shaming blog to indicate that it is now selling access to many of the organizations it has hacked. …

    Read MoreConti Ransom Gang Starts Selling Access to Victims

    14 Oct, 2021
    Missouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability
    Cybersecurity , , , , , , ,

    On Wednesday, the St. Louis Post-Dispatch ran a story about how its staff discovered and reported a security vulnerability in a Missouri state education website that exposed the Social Security numbers of 100,000 elementary and secondary teachers. In a press conference this morning, Missouri Gov. Mike Parson (R) said fixing the flaw could cost the state $50 million, and vowed his administration would seek to prosecute and investigate the “hackers” and anyone who aided the publication in its “attempt to embarrass the state and sell headlines for their news outlet.” …

    Read MoreMissouri Governor Vows to Prosecute St. Louis Post-Dispatch for Reporting Security Vulnerability

    13 Oct, 2021
    How Coinbase Phishers Steal One-Time Passwords
    Cybersecurity , , , , , , , , ,

    A recent phishing campaign targeting Coinbase users shows thieves are getting cleverer about phishing one-time passwords (OTPs) needed to complete the login process. It also shows that phishers are attempting to sign up for new Coinbase accounts by the millions as part of an effort to identify email addresses that are already associated with active accounts. …

    Read MoreHow Coinbase Phishers Steal One-Time Passwords

    12 Oct, 2021
    Patch Tuesday, October 2021 Edition
    Cybersecurity , , , , , , , , , , , , , , , , ,

    Microsoft today issued updates to plug more than 70 security holes in its Windows operating systems and other software, including one vulnerability that is already being exploited in active attacks. This month’s Patch Tuesday also includes security fixes for the newly released Windows 11 operating system. …

    Read MorePatch Tuesday, October 2021 Edition

    4 Oct, 2021
    What Happened to Facebook, Instagram, & WhatsApp?
    Cybersecurity , , , , , , , , , , ,

    Facebook and its sister properties Instagram and WhatsApp are suffering from ongoing, global outages. We don’t yet know why this happened, but the how is clear: Earlier this morning, something inside Facebook caused the company to revoke key digital records that tell computers and other Internet-enabled devices how to find these destinations online. …

    Read MoreWhat Happened to Facebook, Instagram, & WhatsApp?

    1 Oct, 2021
    FCC Proposal Targets SIM Swapping, Port-Out Fraud
    Cybersecurity , , , , , ,

    The U.S. Federal Communications Commission (FCC) is asking for feedback on new proposed rules to crack down on SIM swapping and number port-out fraud, increasingly prevalent scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identity. …

    Read MoreFCC Proposal Targets SIM Swapping, Port-Out Fraud

    29 Sep, 2021
    The Rise of One-Time Password Interception Bots
    Cybersecurity , , , , , , , , , ,

    In February, KrebsOnSecurity wrote about a novel cybercrime service that helped attackers intercept the one-time passwords (OTPs) that many websites require as a second authentication factor in addition to passwords. That service quickly went offline, but new research reveals a number of competitors have since launched bot-based services that make it relatively easy for crooks to phish OTPs from targets. …

    Read MoreThe Rise of One-Time Password Interception Bots

    28 Sep, 2021
    Apple AirTag Bug Enables ‘Good Samaritan’ Attack
    Cybersecurity , , , , , , ,

    The new $30 Airtag tracking device from Apple has a feature that allows anyone who finds one of these tiny location beacons to scan it with a mobile phone and discover its owner’s phone number if the Airtag has been set to lost mode. But according to new research, this same feature can be abused to redirect the Good Samaritan to an iCloud phishing page — or to any other malicious website. …

    Read MoreApple AirTag Bug Enables ‘Good Samaritan’ Attack