• Search for:
    16 Mar, 2021
    Can We Stop Pretending SMS Is Secure Now?
    Cybersecurity , , , , , , , , ,

    SMS text messages were already the weakest link securing just about anything online, mainly because there are tens of thousands of people (many of them low-paid mobile store employees) who can be tricked or bribed into swapping control over a mobile phone number to someone else. Now we’re learning about an entire ecosystem of companies that anyone could use to silently intercept text messages intended for other mobile users. …

    Read MoreCan We Stop Pretending SMS Is Secure Now?

    5 Mar, 2021
    At Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software
    Cybersecurity , , , , , , , , , ,

    At least 30,000 organizations across the United States — including a significant number of small businesses, towns, cities and local governments — have over the past few days been hacked by an unusually aggressive Chinese cyber espionage unit that’s focused on stealing email from victim organizations, multiple sources tell KrebsOnSecurity. The espionage group is exploiting four newly-discovered flaws in Microsoft Exchange Server email software, and has seeded hundreds of thousands of victim organizations worldwide with tools that give the attackers total, remote control over affected systems. …

    Read MoreAt Least 30,000 U.S. Organizations Newly Hacked Via Holes in Microsoft’s Email Software

    2 Mar, 2021
    Microsoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails
    Cybersecurity , , , , , , , , ,

    Microsoft Corp. today released software updates to plug four critical security holes that attackers have been using to plunder email communications at companies that use its Exchange Server products. The company says all four flaws are being actively exploited as part of a complex attack chain deployed by a previously unidentified Chinese cyber espionage group. …

    Read MoreMicrosoft: Chinese Cyberspies Used 4 Exchange Server Flaws to Plunder Emails

    29 Jan, 2021
    The Taxman Cometh for ID Theft Victims
    Cybersecurity , , , , , ,

    The unprecedented volume of unemployment insurance fraud witnessed in 2020 hasn’t abated, although news coverage of the issue has largely been pushed off the front pages by other events. But the ID theft problem is coming to the fore once again: Countless Americans will soon be receiving notices from state regulators saying they owe thousands of dollars in taxes on benefits they never received last year. …

    Read MoreThe Taxman Cometh for ID Theft Victims

    29 Jan, 2021
    The Taxman Cometh for ID Theft Victims
    Cybersecurity , , , , , ,

    The unprecedented volume of unemployment insurance fraud witnessed in 2020 hasn’t abated, although news coverage of the issue has largely been pushed off the front pages by other events. But the ID theft problem is coming to the fore once again: Countless Americans will soon be receiving notices from state regulators saying they owe thousands of dollars in taxes on benefits they never received last year. …

    Read MoreThe Taxman Cometh for ID Theft Victims

    17 Nov, 2020
    Be Very Sparing in Allowing Site Notifications
    Cybersecurity , , , , , , , , ,

    An increasing number of websites are asking visitors to approve “notifications,” browser modifications that periodically display messages on the user’s mobile or desktop device. In many cases these notifications are benign, but several dodgy firms are paying site owners to install their notification scripts and then selling that communications pathway to scammers and online hucksters. …

    Read MoreBe Very Sparing in Allowing Site Notifications

    29 Oct, 2020
    FBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals
    Cybersecurity , , , , , , , , , , ,

    On Monday, Oct. 27, KrebsOnSecurity began following up on a tip from a reliable source that an aggressive Russian cybercriminal gang known for deploying ransomware was preparing to disrupt information technology systems at hundreds of hospitals, clinics and medical care facilities across the United States. Today, officials from the FBI and the U.S. Department of Homeland Security hastily assembled a conference call with healthcare industry executives warning about an “imminent cybercrime threat to U.S. hospitals and healthcare providers.” …

    Read MoreFBI, DHS, HHS Warn of Imminent, Credible Ransomware Threat Against U.S. Hospitals

    15 Oct, 2020
    Breach at Dickey’s BBQ Smokes 3M Cards
    Cybersecurity , , , , ,

    One of the digital underground’s most popular stores for peddling stolen credit card information began selling a batch of more than three million new card records this week. KrebsOnSecurity has learned the payment card data was stolen in a two-year-long data breach at more than 100 Dickey’s Barbeque Restaurant locations around the country. …

    Read MoreBreach at Dickey’s BBQ Smokes 3M Cards

    21 Aug, 2020
    FBI, CISA Echo Warnings on ‘Vishing’ Threat
    Cybersecurity , , , , , ,

    The Federal Bureau of Investigation (FBI) and the Cybersecurity and Infrastructure Security Agency (CISA) on Thursday issued a joint alert to warn about the growing threat from voice phishing or “vishing” attacks targeting companies. The advisory came less than 24 hours after KrebsOnSecurity published an in-depth look at a crime group offering a service that people can hire to steal VPN credentials and other sensitive data from employees working remotely during the Coronavirus pandemic. …

    Read MoreFBI, CISA Echo Warnings on ‘Vishing’ Threat

    19 Aug, 2020
    Voice Phishers Targeting Corporate VPNs
    Cybersecurity , , , , , , , , , , , ,

    The COVID-19 epidemic has brought a wave of email phishing attacks that try to trick work-at-home employees into giving away credentials needed to remotely access their employers’ networks. But one increasingly brazen group of crooks is taking your standard phishing attack to the next level, marketing a voice phishing service that uses a combination of one-on-one phone calls and custom phishing sites to steal VPN credentials from employees. …

    Read MoreVoice Phishers Targeting Corporate VPNs