• Search for:
    7 Mar, 2020
    U.S. Govt. Makes it Harder to Get .Gov Domains
    Cybersecurity , , , , , ,

    The federal agency in charge of issuing .gov domain names is enacting new requirements for validating the identity of people requesting them. The additional measures come less than four months after KrebsOnSecurity published research suggesting it was relatively easy for just about anyone to get their very own .gov domain. In November’s piece It’s Way Too Easy to Get a .gov Domain Name, an anonymous source detailed how he obtained one by impersonating an official at a small town in Rhode Island that didn’t already have its own .gov. …

    Read MoreU.S. Govt. Makes it Harder to Get .Gov Domains

    3 Mar, 2020
    The Case for Limiting Your Browser Extensions
    Cybersecurity , , , , , , , , , , , ,

    Last week, KrebsOnSecurity reported to health insurance provider Blue Shield of California that its Web site was flagged by multiple security products as serving malicious content. Blue Shield quickly removed the unauthorized code. An investigation determined it was injected by a browser extension installed on the computer of a Blue Shield employee who’d edited the Web site in the past month. The incident is a reminder that browser extensions — however useful or fun they may seem when you install them — typically have a great deal of power and can effectively read and/or write all data in your browsing sessions. And as we’ll see, it’s not uncommon for extension makers to sell or lease their user base to shady advertising firms, or in some cases abandon them to outright cybercriminals. …

    Read MoreThe Case for Limiting Your Browser Extensions

    2 Mar, 2020
    French Firms Rocked by Kasbah Hacker?
    Cybersecurity , , , , , , , , , , , , , ,

    A large number of French critical infrastructure firms were hacked as part of an extended malware campaign that appears to have been orchestrated by at least one attacker based in Morocco, KrebsOnSecurity has learned. The individual thought to be involved has earned accolades from the likes of Apple, Dell, and Microsoft for helping to find and fix security vulnerabilities in their products. …

    Read MoreFrench Firms Rocked by Kasbah Hacker?

    28 Feb, 2020
    FCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data
    Cybersecurity , , , , , , , , , ,

    The U.S. Federal Communications Commission (FCC) today proposed fines of more than $200 million against the nation’s four largest wireless carriers for selling access to their customers’ location information without taking adequate precautions to prevent unauthorized access to that data. While the fines would be among the largest the FCC has ever levied, critics say the penalties don’t go far enough to deter wireless carriers from continuing to sell customer location data. …

    Read MoreFCC Proposes to Fine Wireless Carriers $200M for Selling Customer Location Data

    26 Feb, 2020
    Zyxel 0day Affects its Firewall Products, Too
    Cybersecurity , , , , ,

    On Monday, networking hardware maker Zyxel released security updates to plug a critical security hole in its network attached storage (NAS) devices that is being actively exploited by crooks who specialize in deploying ransomware. Today, Zyxel acknowledged the same flaw is present in many of its firewall products. …

    Read MoreZyxel 0day Affects its Firewall Products, Too

    24 Feb, 2020
    Zyxel Fixes 0day in Network Storage Devices
    Cybersecurity , , , , , , , , , , , , , ,

    Networking hardware vendor Zyxel today released an update to fix a critical flaw in many of its network attached storage (NAS) devices that can be used to remotely commandeer them. The patch comes 12 days after KrebsOnSecurity alerted the company that precise instructions for exploiting the vulnerability were being sold for $20,000 in the cybercrime underground. Based in Taiwan, Zyxel Communications Corp. (a.k.a “ZyXEL”) is a maker of networking devices, including Wi-Fi routers, NAS products and hardware firewalls. The company has roughly 1,500 employees and boasts some 100 million devices deployed worldwide. While in many respects the class of vulnerability addressed in this story is depressingly common among Internet of Things (IoT) devices, the flaw is notable because it has attracted the interest of groups specializing in deploying ransomware at scale. …

    Read MoreZyxel Fixes 0day in Network Storage Devices

    19 Feb, 2020
    Hackers Were Inside Citrix for Five Months
    Cybersecurity , , , , ,

    Networking software giant Citrix Systems says malicious hackers were inside its networks for five months between 2018 and 2019, making off with personal and financial data on company employees, contractors, interns, job candidates and their dependents. The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords. …

    Read MoreHackers Were Inside Citrix for Five Months

    18 Feb, 2020
    Encoding Stolen Credit Card Data on Barcodes
    Cybersecurity , ,

    Crooks are constantly dreaming up new ways to use and conceal stolen credit card data. According to the U.S. Secret Service, the latest scheme involves stolen card information embedded in barcodes affixed to phony money network rewards cards. The scammers then pay for merchandise by instructing a cashier to scan the barcode and enter the expiration date and card security code. …

    Read MoreEncoding Stolen Credit Card Data on Barcodes

    17 Feb, 2020
    Pay Up, Or We’ll Make Google Ban Your Ads
    Cybersecurity , , , ,

    A new email-based extortion scheme apparently is making the rounds, targeting Web site owners serving banner ads through Google’s AdSense program. In this scam, the fraudsters demand bitcoin in exchange for a promise not to flood the publisher’s ads with so much bot and junk traffic that Google’s automated anti-fraud systems suspend the user’s AdSense account for suspicious traffic. …

    Read MorePay Up, Or We’ll Make Google Ban Your Ads

    14 Feb, 2020
    A Light at the End of Liberty Reserve’s Demise?
    Cybersecurity , , , , ,

    In May 2013, the U.S. Justice Department seized Liberty Reserve, alleging the virtual currency service acted as a $6 billion financial hub for the cybercrime world. Prompted by assurances that the government would one day afford Liberty Reserve users a chance to reclaim any funds seized as part of the takedown, KrebsOnSecurity filed a claim shortly thereafter to see if and when this process might take place. This week, an investigator with the U.S. Internal Revenue service finally got in touch to discuss my claim. …

    Read MoreA Light at the End of Liberty Reserve’s Demise?