• Search for:
    30 Jun, 2020
    COVID-19 ‘Breach Bubble’ Waiting to Pop?
    Cybersecurity , , , , , , , ,

    The COVID-19 pandemic has made it harder for banks to trace the source of payment card data stolen from smaller, hacked online merchants. On the plus side, months of quarantine have massively decreased demand for account information that thieves buy and use to create physical counterfeit credit cards. But fraud experts say recent developments suggest both trends are about to change — and likely for the worse. …

    Read MoreCOVID-19 ‘Breach Bubble’ Waiting to Pop?

    22 Jun, 2020
    ‘BlueLeaks’ Exposes Files from Hundreds of Police Departments
    Cybersecurity , , , , , , , , ,

    Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed “BlueLeaks” and made searchable via a new website by the same name, stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals online. …

    Read More‘BlueLeaks’ Exposes Files from Hundreds of Police Departments

    16 May, 2020
    U.S. Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs
    Cybersecurity , , , , , , , , , ,

    A well-organized Nigerian crime ring is exploiting the COVID-19 crisis by committing large-scale fraud against multiple state unemployment insurance programs, with potential losses in the hundreds of millions of dollars, according to a new alert issued by the U.S. Secret Service. A memo seen by KrebsOnSecurity that the Secret Service sent to field offices around the United States this week says the ring has been filing unemployment claims in different states using Social Security numbers and other personally identifiable information (PII) belonging to identity theft victims, and that “a substantial amount of the fraudulent benefits submitted have used PII from first responders, government personnel and school employees.” …

    Read MoreU.S. Secret Service: “Massive Fraud” Against State Unemployment Insurance Programs

    23 Apr, 2020
    When in Doubt: Hang Up, Look Up, & Call Back
    Cybersecurity , ,

    Many security-conscious people probably think they’d never fall for a phone-based phishing scam. But if your response to such a scam involves anything other than hanging up and calling back the entity that claims to be calling, you may be in for a rude awakening. Here’s how one security and tech-savvy reader got taken for more than $10,000 in an elaborate, weeks-long ruse. …

    Read MoreWhen in Doubt: Hang Up, Look Up, & Call Back

    16 Apr, 2020
    Sipping from the Coronavirus Domain Firehose
    Cybersecurity , , , , , , , , , , , , , , , , , ,

    Security experts are poring over thousands of new Coronavirus-themed domain names registered each day, but this often manual effort struggles to keep pace with the flood of domains invoking the virus to promote malware and phishing sites, as well as non-existent healthcare products and charities. As a result, domain name registrars are under increasing pressure to do more to combat scams and misinformation during the COVID-19 pandemic. …

    Read MoreSipping from the Coronavirus Domain Firehose

    15 Apr, 2020
    COVID-19 Has United Cybersecurity Experts, But Will That Unity Survive the Pandemic?
    Cybersecurity , , , , , ,

    The Coronavirus has prompted thousands of information security professionals to volunteer their skills in upstart collaborative efforts aimed at frustrating cybercriminals who are seeking to exploit the crisis for financial gain. Whether it’s helping hospitals avoid becoming the next ransomware victim or kneecapping new COVID-19-themed scam websites, these nascent partnerships may well end up saving lives. But can this unprecedented level of collaboration survive the pandemic? …

    Read MoreCOVID-19 Has United Cybersecurity Experts, But Will That Unity Survive the Pandemic?

    10 Apr, 2020
    New IRS Site Could Make it Easy for Thieves to Intercept Some Stimulus Payments
    Cybersecurity , , , , , ,

    The U.S. federal government is now in the process of sending Economic Impact Payments by direct deposit to millions of Americans. Most who are eligible for payments can expect to have funds direct-deposited into the same bank accounts listed on previous years’ tax filings sometime next week. Today, the Internal Revenue Service (IRS) stood up a site to collect bank account information from the many Americans who don’t usually file a tax return. The question is, will those non-filers have a chance to claim their payments before fraudsters do? …

    Read MoreNew IRS Site Could Make it Easy for Thieves to Intercept Some Stimulus Payments

    2 Apr, 2020
    ‘War Dialing’ Tool Exposes Zoom’s Password Problems
    Cybersecurity , , , , , , , , , , ,

    As the Coronavirus pandemic continues to force people to work from home, countless companies are now holding daily meetings using videoconferencing services from Zoom. But without the protection of a password, there’s a decent chance your next Zoom meeting could be “Zoom bombed” — attended or disrupted by someone who doesn’t belong. And according to data gathered by a new automated Zoom meeting discovery tool dubbed “zWarDial,” a crazy number major corporations are setting up meetings without passwords enabled. …

    Read More‘War Dialing’ Tool Exposes Zoom’s Password Problems

    1 Apr, 2020
    Phish of GoDaddy Employee Jeopardized Escrow.com, Among Others
    Cybersecurity , , , , , , , ,

    A spear-phishing attack this week hooked a customer service employee at GoDaddy.com, the world’s largest domain name registrar, KrebsOnSecurity has learned. The incident gave the phisher the ability to view and modify key customer records, access that was used to briefly hijack domains for a half-dozen GoDaddy customers, including transaction brokering site escrow.com. …

    Read MorePhish of GoDaddy Employee Jeopardized Escrow.com, Among Others

    20 Mar, 2020
    Security Breach Disrupts Fintech Firm Finastra
    Cybersecurity , , , , ,

    Finastra, a company that provides a range of technology solutions to banks worldwide, said it was shutting down key systems in response to a security breach discovered Friday morning. The company’s public statement and notice to customers does not mention the cause of the outage, but their response so far is straight out of the playbook for dealing with ransomware attacks. …

    Read MoreSecurity Breach Disrupts Fintech Firm Finastra