• Search for:
    1 Oct, 2021
    FCC Proposal Targets SIM Swapping, Port-Out Fraud
    Cybersecurity , , , , , ,

    The U.S. Federal Communications Commission (FCC) is asking for feedback on new proposed rules to crack down on SIM swapping and number port-out fraud, increasingly prevalent scams in which identity thieves hijack a target’s mobile phone number and use that to wrest control over the victim’s online identity. …

    Read MoreFCC Proposal Targets SIM Swapping, Port-Out Fraud

    17 May, 2021
    Try This One Weird Trick Russian Hackers Hate
    Cybersecurity , , , , , , , , , , , ,

    In a Twitter discussion last week on ransomware attacks, KrebsOnSecurity noted that virtually all ransomware strains have a built-in failsafe designed to cover the backsides of the malware purveyors: They simply will not install on a Microsoft Windows computer that already has one of many types of virtual keyboards installed — such as Russian or Ukrainian. So many readers had questions in response to the tweet that I thought it was worth a blog post exploring this one weird cyber defense trick. …

    Read MoreTry This One Weird Trick Russian Hackers Hate

    16 Mar, 2021
    Can We Stop Pretending SMS Is Secure Now?
    Cybersecurity , , , , , , , , ,

    SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of people (many of them low-paid mobile store employees) who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that anyone could use to silently intercept text messages intended for other mobile users. …

    Read MoreCan We Stop Pretending SMS Is Secure Now?

    9 Mar, 2021
    Warning the World of a Ticking Time Bomb
    Cybersecurity , , , ,

    Globally, hundreds of thousand of organizations running Exchange email servers from Microsoft just got mass-hacked, including at least 30,000 victims in the United States. Each hacked server has been retrofitted with a “web shell” backdoor that gives the bad guys total, remote control, the ability to read all email, and easy access to the victim’s other computers. Researchers are now racing to identify, alert and help victims, and hopefully prevent further mayhem. …

    Read MoreWarning the World of a Ticking Time Bomb

    19 Aug, 2020
    Voice Phishers Targeting Corporate VPNs
    Cybersecurity , , , , , , , , , , , ,

    The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. But one increasingly brazen group of crooks is taking your standard phishing attack to the next level, marketing a voice phishing service that uses a combination of one-on-one phone calls and custom phishing sites to steal VPN credentials from employees. …

    Read MoreVoice Phishers Targeting Corporate VPNs

    19 Aug, 2020
    Voice Phishers Targeting Corporate VPNs
    Cybersecurity , , , , , , , , , , , ,

    The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. But one increasingly brazen group of crooks is taking your standard phishing attack to the next level, marketing a voice phishing service that uses a combination of one-on-one phone calls and custom phishing sites to steal VPN credentials from employees. …

    Read MoreVoice Phishers Targeting Corporate VPNs

    22 Jul, 2020
    Twitter Hacking for Profit and the LoLs
    Cybersecurity , , , , , , , , , , , , , , , , , , , ,

    The New York Times last week ran an interview with several young men who claimed to have had direct contact with those involved in last week’s epic hack against Twitter. These individuals said they were only customers of the person who had access to Twitter’s internal employee tools, and were not responsible for the actual intrusion or bitcoin scams that took place that day. But new information suggests that at least two of them operated a service that resold access to Twitter employees for the purposes of modifying or seizing control of prized Twitter profiles. …

    Read MoreTwitter Hacking for Profit and the LoLs

    14 Jun, 2020
    Privnotes.com Is Phishing Bitcoin from Users of Private Messaging Service Privnote.com
    Cybersecurity , , , ,

    For the past year, a site called Privnotes.com has been impersonating Privnote.com, a legitimate, free service that offers private, encrypted messages which self-destruct automatically after they are read. Until recently, I couldn’t quite work out what Privnotes was up to, but today it became crystal clear: Any messages containing bitcoin addresses will be automatically altered to include a different bitcoin address, as long as the Internet addresses of the sender and receiver of the message are not the same. …

    Read MorePrivnotes.com Is Phishing Bitcoin from Users of Private Messaging Service Privnote.com