• Search for:
    11 May, 2021
    Microsoft Patch Tuesday, May 2021 Edition
    Cybersecurity , , , , , , , , , , , , , ,

    Microsoft today released fixes to plug at least 55 security holes in its Windows operating systems and other software. Four of these weaknesses can be exploited by malware and malcontents to seize complete, remote control over vulnerable systems without any help from users. On deck this month are patches to quash a wormable flaw, a creepy wireless bug, and yet another reason to call for the death of Microsoft’s Internet Explorer (IE) web browser. …

    Read MoreMicrosoft Patch Tuesday, May 2021 Edition

    11 May, 2021
    A Closer Look at the DarkSide Ransomware Gang
    Cybersecurity , , , , , ,

    The FBI confirmed this week that a relatively new ransomware group known as DarkSide is responsible for an attack that caused Colonial Pipeline to shut down 5,550 miles of pipe, stranding countless barrels of gasoline, diesel and jet fuel on the Gulf Coast. Here’s a closer look at the DarkSide cybercrime gang, as seen through their negotiations with a recent U.S. victim that earns $15 billion in annual revenue. …

    Read MoreA Closer Look at the DarkSide Ransomware Gang

    10 May, 2021
    Fintech Startup Offers $500 for Payroll Passwords
    Cybersecurity , , , , , , , , , , , , , , , , ,

    How much is your payroll data worth? Probably a lot more than you think. One financial startup that’s targeting the gig worker market is offering up to $500 to anyone willing to hand over the payroll account username and password given to them by their employer, plus a regular payment for each month afterwards in which those credentials still work. …

    Read MoreFintech Startup Offers $500 for Payroll Passwords

    7 May, 2021
    Investment Scammer John Davies Reinvents Himself?
    Cybersecurity , , , , , , , , , , , , , , , , , , , ,

    John Bernard, a pseudonym used by a convicted thief and con artist named John Clifton Davies who’s fleeced dozens of technology startups out of an estimated $30 million, appears to have reinvented himself again after being exposed in a recent investigative series published here. Sources tell KrebsOnSecurity that Davies/Bernard is now posing as John Cavendish and head of a new “private office” called Hempton Business Management LLP. …

    Read MoreInvestment Scammer John Davies Reinvents Himself?

    5 May, 2021
    Malicious Office 365 Apps Are the Ultimate Insiders
    Cybersecurity , , , , , , , , ,

    Phishers targeting Microsoft Office 365 users increasingly are turning to specialized links that take users to their organization’s own email login page. After a user logs in, the link prompts them to install a malicious but innocuously-named app that gives the attacker persistent, password-free access to any of the user’s emails and files, both of which are then plundered to launch malware and phishing scams against others. …

    Read MoreMalicious Office 365 Apps Are the Ultimate Insiders

    29 Apr, 2021
    Task Force Seeks to Disrupt Ransomware Payments
    Cybersecurity , , , , , , , , , , , , , , , , ,

    Some of the world’s top tech firms are backing a new industry task force focused on disrupting cybercriminal ransomware gangs by limiting their ability to get paid, and targeting the individuals and finances of the organized thieves behind these crimes. …

    Read MoreTask Force Seeks to Disrupt Ransomware Payments

    28 Apr, 2021
    Experian API Exposed Credit Scores of Most Americans
    Cybersecurity , , , , ,

    Big-three consumer credit bureau Experian just fixed a weakness with a partner website that let anyone look up the credit score of tens of millions of Americans just by supplying their name and mailing address, KrebsOnSecurity has learned. Experian says it has plugged the data leak, but the researcher who reported the finding says he fears the same weakness may be present at countless other lending websites that work with the credit bureau. …

    Read MoreExperian API Exposed Credit Scores of Most Americans

    26 Apr, 2021
    Experian’s Credit Freeze Security is Still a Joke
    Cybersecurity , , , , , , ,

    In 2017, KrebsOnSecurity showed how easy it is for identity thieves to undo a consumer’s request to freeze their credit file at Experian, one of the big three consumer credit bureaus in the United States.  Last week, KrebsOnSecurity heard from a reader who had his freeze thawed without authorization through Experian’s website, and it reminded me of how truly broken authentication and security remains in the credit bureau space. …

    Read MoreExperian’s Credit Freeze Security is Still a Joke