Schneier on Security

FEBRUARY 7, 2020

Ten years ago, I wrote an essay : "Security in 2020." Well, it's finally 2020. That's IT in 2020 -- it's not under your control, it's doing things without your knowledge and consent, and it's not necessarily acting in your best interests. I think I did pretty well. Security can only be defined in relation to something else.

Advertising 279

Advertising Internet Internet Artificial Intelligence 279

Krebs on Security

OCTOBER 30, 2024

.” But in June 2024 testimony to the Senate Finance Committee, it emerged that the intruders had stolen or purchased credentials for a Citrix portal used for remote access, and that no multi-factor authentication was required for that account. Last month, Sens. Mark Warner (D-Va.) and Ron Wyden (D-Ore.) Mark Warner (D-Va.)

Healthcare 296

Healthcare Insurance Computers and Electronics Data breaches 296

Krebs on Security

DECEMBER 2, 2021

NYSE:UI] disclosed that a breach at a third party cloud provider had exposed customer account credentials. 24, he reportedly maintained his innocence and told agents someone else must have used his Paypal account to purchase the Surfshark VPN subscription. In January 2021, technology vendor Ubiquiti Inc.

VPN 266

VPN Internet Internet Accountability 266

Krebs on Security

JANUARY 22, 2025

From June 30, 2020 until January 14, 2025, one of the core Internet servers that MasterCard uses to direct traffic for portions of the mastercard.com network was misnamed. The Russian search giant Yandex reports this user account belongs to an “Ivan I.” A DNS lookup on the domain az.mastercard.com on Jan.

DNS 362

DNS Internet Internet Risk 362

Krebs on Security

JUNE 6, 2023

One of the most expensive aspects of any cybercriminal operation is the time and effort it takes to constantly create large numbers of new throwaway email accounts. The service in question — kopeechka[.]store ” “Are you working on large volumes and are costs constantly growing? The service in question — kopeechka[.]store

Accountability 254

Accountability Scams Cryptocurrency Advertising 254

Malwarebytes

FEBRUARY 14, 2025

The most recent data in this database is from May 2020. Now, a cybercriminal using the monicker Jurak, leaked sensitive information related to roughly 12 million accounts, which allegedly stems from a breach that happened last year. This would be the 2nd (hacked back in 2020) major data breach for Zacks. . Take your time.

Accountability 82

Accountability Data breaches Passwords Phishing 82

Schneier on Security

JANUARY 24, 2022

Crowdstrike is reporting that malware targeting Linux has increased considerably in 2021: Malware targeting Linux systems increased by 35% in 2021 compared to 2020. XorDDoS, Mirai and Mozi malware families accounted for over 22% of Linux-targeted threats observed by CrowdStrike in 2021. Lots of details in the report.

Malware 352

Malware Accountability 352

Schneier on Security

JANUARY 6, 2021

This is bad : More than 100,000 Zyxel firewalls, VPN gateways, and access point controllers contain a hardcoded admin-level backdoor account that can grant attackers root access to devices via either the SSH interface or the web administration panel. […]. aN_fXp” password.

Firewall 353

Firewall VPN Passwords Accountability 353

Krebs on Security

DECEMBER 19, 2024

” According to Intel 471, this same Discord account was advertised in 2019 by a person on the cybercrime forum Cracked who used the monikers “ ORN ” and “ ori0n.” In early 2020, Exorn promoted a website called “ orndorks[.]com ” Orn advertising Araneida Scanner in Feb.

Hacking 230

Hacking Cybercrime Advertising Data breaches 230

Krebs on Security

APRIL 6, 2021

Facebook says the data was collected before 2020 when it changed things to prevent such information from being scraped from profiles. To my mind, this just reinforces the need to remove mobile phone numbers from all of your online accounts wherever feasible. billion active monthly users. According to a Jan. Image: @UnderTheBreach.

Mobile 358

Mobile Accountability Passwords Authentication 358

Malwarebytes

NOVEMBER 14, 2024

Employees of these companies were tricked into clicking malicious attachments and links and filling in their email account login information on fake sites. From calendar years 2020 to 2022, there was a 27% increase in victim reports to the Internet Crime Complaint Center (IC3) of BECs with a real estate nexus.

Accountability 143

Accountability Banking Internet Internet 143

Krebs on Security

NOVEMBER 19, 2024

The Telegram account that abyss0 listed in their sales thread appears to have been suspended or deleted. Likewise, abyss0’s account on BreachForums no longer exists, and all of their sales threads have since disappeared. Maybe abyss0 found a buyer who paid for their early retirement.

Data breaches 293

Data breaches Banking Cybercrime Advertising 293

Krebs on Security

JULY 14, 2020

Top of the heap this month in terms of outright scariness is CVE-2020-1350 , which concerns a remotely exploitable bug in more or less all versions of Windows Server that attackers could use to install malicious software simply by sending a specially crafted DNS request. .”

DNS 328

DNS Backups Software System Administration 328

Krebs on Security

FEBRUARY 26, 2023

But we do know the March 2020 attack was precipitated by a spear-phishing attack against a GoDaddy employee. GoDaddy described the incident at the time in general terms as a social engineering attack, but one of its customers affected by that March 2020 breach actually spoke to one of the hackers involved.

Hacking 326

Hacking Social Engineering Phishing Scams 326

Krebs on Security

MAY 5, 2021

Also, the apps will persist in a user’s Office 365 account indefinitely until removed, and will survive even after an account password reset. “Now, they’re compromising accounts in credible tenants first,” Proofpoint explains. A cybercriminal service advertising the sale of access to hacked Office365 accounts.

Accountability 351

Accountability Advertising Passwords Phishing 351

Troy Hunt

JUNE 1, 2020

closed or ia idk | BLM (@pjnkmin) May 31, 2020 Just to be clear: there's not necessarily a direct link between whoever put the video above together and the data now doing the rounds and attribution is tricky once you get a bunch of different people under different accounts and pseudonyms all flying the "Anonymous" banner.

Hacking 364

Hacking Passwords Data breaches Accountability 364

Malwarebytes

JANUARY 6, 2025

A US chain of dental offices known as Westend Dental LLC denied a 2020 ransomware attack and its associated data breach, instead telling their customers that data was lost due to an accidentally formatted hard drive. In October 2020, Westend Dental was attacked by the Medusa Locker ransomware group.

Data breaches 145

Data breaches Ransomware Passwords Insurance 145

Krebs on Security

JUNE 27, 2023

Joseph James “PlugwalkJoe” O’Connor , a 24-year-old from the United Kingdom who earned his 15 minutes of fame by participating in the July 2020 hack of Twitter , has been sentenced to five years in a U.S. 02, 2020, pitching O’Connor as a cryptocurrency expert and advisor.

Cryptocurrency 271

Cryptocurrency Accountability Mobile Hacking 271

Krebs on Security

SEPTEMBER 16, 2020

Prosecutors say the men then laundered the stolen funds through an array of intermediary cryptocurrency accounts — including compromised and fictitiously created accounts — on the targeted cryptocurrency exchange platforms. million from 158 Poloniex users, and $1.17 million from 42 Gemini customers.

Cryptocurrency 362

Cryptocurrency Phishing Accountability Cybercrime 362

Troy Hunt

OCTOBER 2, 2020

And then there's Scott's Grindr account. 22% of breaches begin with phishing (DBIR 2020). This week there's a lot of connected things: connected shoes, connected garage camera and connected GoPro. This week there's all the above and, on a more personal note, my relationship with Charlotte. Sponsored by: Tines.

Firmware 332

Firmware Phishing Accountability 332

Krebs on Security

NOVEMBER 10, 2021

KrebsOnSecurity recently heard from a reader who said his daughter received an SMS that said it was from her bank, and inquired whether she’d authorized a $5,000 payment from her account. Since this seemed like a reasonable and simple request — and she indeed had an account at the bank in question — she responded, “NO.”

Banking 363

Banking Phishing Scams Accountability 363

Krebs on Security

MARCH 17, 2021

In November 2020, KrebsOnSecurity heard from security researcher Abraham Vegh , who noticed something odd while inspecting an email from his financial institution. The messages from Netspend all were to confirm the email address tied to a new account, and concerned “me-to-me transfers” set up through its service.

Banking 349

Banking Accountability Software Mobile 349

Krebs on Security

SEPTEMBER 2, 2024

Scammers who had already stolen someone’s bank account credentials could enter the target’s phone number and name, and the service would initiate an automated phone call to the target that warned them about unauthorized activity on their account. The NCA said it began investigating the service in June 2020.

Accountability 297

Accountability Banking Passwords Scams 297

Malwarebytes

NOVEMBER 7, 2023

After 1Password, BeyondTrust, and Cloudflare detected unauthorized log-in attempts to their in-house Okta administrator accounts, they reported the incidents to Okta who started an investigation. To gain access to that service account, the attacker compromised an Okta employee. Take your time.

Accountability 137

Accountability Passwords Data breaches Phishing 137

Krebs on Security

FEBRUARY 19, 2020

The disclosure comes almost a year after Citrix acknowledged that digital intruders had broken in by probing its employee accounts for weak passwords. 10, 2020, Citrix disclosed additional details about the incident. But in a letter sent to affected individuals dated Feb. 13, 2018 and Mar.

VPN 363

VPN Passwords Software Telecommunications 363

Krebs on Security

JULY 26, 2021

02, 2020, pitching him as a trustworthy cryptocurrency expert and advisor. All of those come into play in the case of the Snapchat account of actor Bella Thorne , who was allegedly targeted by PlugwalkJoe and associates in June 2019. In this case, the SIM swap was done to wrest control over Thorne’s Snapchat account.

Media 351

Media Hacking Accountability Scams 351

Schneier on Security

APRIL 21, 2023

This a good example of a security feature that can sometimes harm security: Apple introduced the optional recovery key in 2020 to protect users from online hackers. Apple’s policy gives users virtually no way back into their accounts without that recovery key. For now, a stolen iPhone could mean devastating personal losses.

Passwords 300

Passwords Accountability Banking 300

Krebs on Security

NOVEMBER 21, 2020

And in May of this year, GoDaddy disclosed that 28,000 of its customers’ web hosting accounts were compromised following a security incident in Oct. 2019 that wasn’t discovered until April 2020. “This gave the actor the ability to change DNS records and in turn, take control of a number of internal email accounts. .

Cryptocurrency 363

Cryptocurrency VPN Scams Social Engineering 363

Krebs on Security

DECEMBER 3, 2021

Since the beginning of 2020, Babam has set up numerous auctions on the Russian-language cybercrime forum Exploit , mainly selling virtual private networking (VPN) credentials stolen from various companies. The username associated with that account was “ bo3dom.” com back in 2011, and sanjulianhotels[.]com com (2017).

Ransomware 346

Ransomware Passwords Accountability Cybercrime 346

Krebs on Security

JULY 10, 2022

Twice in the past month KrebsOnSecurity has heard from readers who’ve had their accounts at big-three credit bureau Experian hacked and updated with a new email address that wasn’t theirs. In both cases the readers used password managers to select strong, unique passwords for their Experian accounts.

Accountability 339

Accountability Passwords Authentication Password Management 339

Krebs on Security

DECEMBER 29, 2020

With the ongoing disruption to life and livelihood wrought by the Covid-19 pandemic, 2020 has been a fairly horrid year by most accounts. Thank you, Dear Readers, for your continued encouragement and support! But it was hardly a dull one for computer security news junkies.

Scams 308

Scams Social Engineering Cybercrime Advertising 308

Malwarebytes

NOVEMBER 12, 2024

All the company’s social media accounts haven’t been updated since 2023 at the latest. In 2020, Ancestry was acquired by investment firm Blackstone for $4.7 Lie if you must and create a separate free email account so the information can’t be tied to your main account.

Insurance 145

Insurance Accountability Risk Data breaches 145

Troy Hunt

OCTOBER 29, 2020

I had come to the realisation that I simply had too many accounts across too many systems to ever have any chance of creating decent unique passwords I could remember. Almost a decade ago now, I wrote what would become one of my most career-defining blog posts: The Only Secure Password is the One You Can't Remember.

Password Management 355

Password Management Passwords Software Accountability 355

The Hacker News

DECEMBER 26, 2024

A Brazilian citizen has been charged in the United States for allegedly threatening to release data stolen by hacking into a company's network in March 2020.

Accountability 140

Accountability Hacking 140

Security Affairs

DECEMBER 23, 2024

Will Cathcart of WhatsApp called the ruling a major privacy victory, emphasizing accountability for spyware firms after a five-year legal battle. We spent five years presenting our case because we firmly believe that spyware companies could not hide behind immunity or avoid accountability for their unlawful actions.

Spyware 108

Spyware Surveillance Software Hacking 108

Krebs on Security

MAY 22, 2023

Social networks are constantly battling inauthentic bot accounts that send direct messages to users promoting scam cryptocurrency investment platforms. Chaput said that at one point last week the volume of bot accounts being registered for the crypto spam campaign started overwhelming the servers that handle new signups at Mastodon.social.

Scams 301

Scams DDOS Cryptocurrency Accountability 301

Krebs on Security

FEBRUARY 1, 2021

“smishing”) service for the mass sending of text messages designed to phish account credentials for different popular websites and steal personal and financial data for resale. One of SMS Bandits’ key offerings: An “auto-shop” web panel for selling stolen account credentials. Image: osint.fans.

Phishing 358

Phishing Telecommunications Advertising Mobile 358