Krebs on Security

Time 2020-06-26 08:09:44

Web Name: Krebs on Security

WebSite: http://www.krebsonsecurity.com

ID:11155

Keywords:

Krebs,on,Security,

Description:

The U.S. Justice Department today charged a Canadian and a Northern Ireland man for allegedly conspiring to build botnets that enslaved hundreds of thousands of routers and other Internet of Things (IoT) devices for use in large-scale distributed denial-of-service (DDoS) attacks. In addition, a defendant in the United States was sentenced today to drug treatment and 18 months community confinement for his admitted role in the botnet conspiracy.Indictments unsealed by a federal court in Alaska today allege 20-year-old Aaron Sterritt from Larne, Northern Ireland, and 31-year-old Logan Shwydiuk of Saskatoon, Canada conspired to build, operate and improve their IoT crime machines over several years.Prosecutors say Sterritt, using the hacker aliases Vamp and Viktor, was the brains behind the computer code that powered several potent and increasingly complex IoT botnet strains that became known by exotic names such as Masuta, Satori, Okiru and Fbot. Shwydiuk, a.k.a. Drake, Dingle, and Chickenmelon, is alleged to have taken the lead in managing sales and customer support for people who leased access to the IoT botnets to conduct their own DDoS attacks.A third member of the botnet conspiracy 22-year-old Kenneth Currin Schuchman of Vancouver, Wash. pleaded guilty in Sept. 2019 to aiding and abetting computer intrusions in September 2019. Schuchman, whose role was to acquire software exploits that could be used to infect new IoT devices, was sentenced today by a judge in Alaska to 18 months of community confinement and drug treatment, followed by three years of supervised release.Kenneth Nexus-Zeta Schuchman, in an undated photo.The government says the defendants built and maintained their IoT botnets by constantly scanning the Web for insecure devices. That scanning primarily targeted devices that were placed online with weak, factory default settings and/or passwords. But the group also seized upon a series of newly-discovered security vulnerabilities in these IoT systems commandeering devices that hadn t yet been updated with the latest software patches.Some of the IoT botnets enslaved hundreds of thousands of hacked devices. For example, by November 2017, Masuta had infected an estimated 700,000 systems, allegedly allowing the defendants to launch crippling DDoS attacks capable of hurling 100 gigabits of junk data per second at targets enough firepower to take down many large websites.In 2015, then 15-year-old Sterritt was involved in the high-profile hack against U.K. telecommunications provider TalkTalk. Sterritt later pleaded guilty to his part in the intrusion, and at his sentencing in 2018 was ordered to complete 50 hours of community service.The indictments against Sterritt and Shwydiuk (PDF) do not mention specific DDoS attacks thought to have been carried out with the IoT botnets. In an interview today with KrebsOnSecurity, prosecutors in Alaska declined to discuss any of their alleged offenses beyond building, maintaining and selling the above-mentioned IoT botnets.But multiple sources tell KrebsOnSecuirty Vamp was principally responsible for the 2016 massive denial-of-service attack that swamped Dyn — a company that provides core Internet services for a host of big-name Web sites. On October 21, 2016, an attack by a Mirai-based IoT botnet variant overwhelmed Dyn’s infrastructure, causing outages at a number of top Internet destinations, including Twitter, Spotify, Reddit and others.In 2018, authorities with the U.K. s National Crime Agency (NCA) interviewed a suspect in connection with the Dyn attack, but ultimately filed no charges against the youth because all of his digital devices had been encrypted. The principal suspect of this investigation is a UK national resident in Northern Ireland, reads a June 2018 NCA brief on their investigation into the Dyn attack (PDF), dubbed Operation Midmonth. In 2018 the subject returned for interview, however there was insufficient evidence against him to provide a realistic prospect of conviction. The login prompt for Nexus Zeta s IoT botnet included the message Masuta is powered and hosted on Brian Kreb s [sic] 4head. To be precise, it s a 5head. Continue reading Hundreds of thousands of potentially sensitive files from police departments across the United States were leaked online last week. The collection, dubbed BlueLeaks and made searchable online, stems from a security breach at a Texas web design and hosting company that maintains a number of state law enforcement data-sharing portals.The collection nearly 270 gigabytes in total is the latest release from Distributed Denial of Secrets (DDoSecrets), an alternative to Wikileaks that publishes caches of previously secret data.A partial screenshot of the BlueLeaks data cache.In a post on Twitter, DDoSecrets said the BlueLeaks archive indexes ten years of data from over 200 police departments, fusion centers and other law enforcement training and support resources, and that among the hundreds of thousands of documents are police and FBI reports, bulletins, guides and more. Fusion centers are state-owned and operated entities that gather and disseminate law enforcement and public safety information between state, local, tribal and territorial, federal and private sector partners.KrebsOnSecurity obtained an internal June 20 analysis by the National Fusion Center Association (NFCA), which confirmed the validity of the leaked data. The NFCA alert noted that the dates of the files in the leak actually span nearly 24 years from August 1996 through June 19, 2020 and that the documents include names, email addresses, phone numbers, PDF documents, images, and a large number of text, video, CSV and ZIP files. Additionally, the data dump contains emails and associated attachments, the alert reads. Our initial analysis revealed that some of these files contain highly sensitive information such as ACH routing numbers, international bank account numbers (IBANs), and other financial data as well as personally identifiable information (PII) and images of suspects listed in Requests for Information (RFIs) and other law enforcement and government agency reports. The NFCA said it appears the data published by BlueLeaks was taken after a security breach at Netsential, a Houston-based web development firm. Preliminary analysis of the data contained in this leak suggests that Netsential, a web services company used by multiple fusion centers, law enforcement, and other government agencies across the United States, was the source of the compromise, the NFCA wrote. Netsential confirmed that this compromise was likely the result of a threat actor who leveraged a compromised Netsential customer user account and the web platform’s upload feature to introduce malicious content, allowing for the exfiltration of other Netsential customer data. Reached via phone Sunday evening, Netsential Director Stephen Gartrell declined to comment for this story. Continue reading Hundreds of popular websites now offer some form of multi-factor authentication (MFA), which can help users safeguard access to accounts when their password is breached or stolen. But people who don t take advantage of these added safeguards may find it far more difficult to regain access when their account gets hacked, because increasingly thieves will enable multi-factor options and tie the account to a device they control. Here s the story of one such incident.As a career chief privacy officer for different organizations, Dennis Dayman has tried to instill in his twin boys the importance of securing their online identities against account takeovers. Both are avid gamers on Microsoft s Xbox platform, and for years their father managed their accounts via his own Microsoft account. But when the boys turned 18, they converted their child accounts to adult, effectively taking themselves out from under their dad s control.On a recent morning, one of Dayman s sons found he could no longer access his Xbox account. The younger Dayman admitted to his dad that he d reused his Xbox profile password elsewhere, and that he hadn t enabled multi-factor authentication for the account.When the two of them sat down to reset his password, the screen displayed a notice saying there was a new Gmail address tied to his Xbox account. When they went to turn on multi-factor authentication for his son s Xbox profile which was tied to a non-Microsoft email address the Xbox service said it would send a notification of the change to unauthorized Gmail account in his profile.Wary of alerting the hackers that they were wise to their intrusion, Dennis tried contacting Microsoft Xbox support, but found he couldn t open a support ticket from a non-Microsoft account. Using his other son s Outlook account, he filed a ticket about the incident with Microsoft.Dennis soon learned the unauthorized Gmail address added to his son s hacked Xbox account also had enabled MFA. Meaning, his son would be unable to reset the account s password without approval from the person in control of the Gmail account.Luckily for Dayman s son, he hadn t re-used the same password for the email address tied to his Xbox profile. Nevertheless, the thieves began abusing their access to purchase games on Xbox and third-party sites. During this period, we started realizing that his bank account was being drawn down through purchases of games from Xbox and [Electronic Arts], Dayman the elder recalled. I pulled the recovery codes for his Xbox account out of the safe, but because the hacker came in and turned on multi-factor, those codes were useless to us. Microsoft support sent Dayman and his son a list of 20 questions to answer about their account, such as the serial number on the Xbox console originally tied to the account when it was created. But despite answering all of those questions successfully, Microsoft refused to let them reset the password, Dayman said. They said their policy was not to turn over accounts to someone who couldn t provide the second factor, he said.Dayman s case was eventually escalated to Tier 3 Support at Microsoft, which was able to walk him through creating a new Microsoft account, enabling MFA on it, and then migrating his son s Xbox profile over to the new account.Microsoft told KrebsOnSecurity that while users currently are not prompted to enable two-step verification upon sign-up, they always have the option to enable the feature. Users are also prompted shortly after account creation to add additional security information if they have not yet done so, which enables the customer to receive security alerts and security promotions when they login to their account, the company said in a written statement. When we notice an unusual sign-in attempt from a new location or device, we help protect the account by challenging the login and send the user a notification. If a customer’s account is ever compromised, we will take the necessary steps to help them recover the account. Continue reading An information technology specialist at the Federal Emergency Management Agency (FEMA) was arrested this week on suspicion of hacking into the human resource databases of University of Pittsburgh Medical Center (UPMC) in 2014, stealing personal data on more than 65,000 UPMC employees, and selling the data on the dark web.On June 16, authorities in Michigan arrested 29-year-old Justin Sean Johnson in connection with a 43-count indictment on charges of conspiracy, wire fraud and aggravated identity theft.Federal prosecutors in Pittsburgh allege that in 2013 and 2014 Johnson hacked into the Oracle PeopleSoft databases for UPMC, a $21 billion nonprofit health enterprise that includes more than 40 hospitals.According to the indictment, Johnson stole employee information on all 65,000 then current and former employees, including their names, dates of birth, Social Security numbers, and salaries.The stolen data also included federal form W-2 data that contained income tax and withholding information, records that prosecutors say Johnson sold on dark web marketplaces to identity thieves engaged in tax refund fraud and other financial crimes. The fraudulent tax refund claims made in the names of UPMC identity theft victims caused the IRS to issue $1.7 million in phony refunds in 2014. The information was sold by Johnson on dark web forums for use by conspirators, who promptly filed hundreds of false form 1040 tax returns in 2014 using UPMC employee PII, reads a statement from U.S. Attorney Scott Brady. These false 1040 filings claimed hundreds of thousands of dollars of false tax refunds, which they converted into Amazon.com gift cards, which were then used to purchase Amazon merchandise which was shipped to Venezuela. Johnson could not be reached for comment. At a court hearing in Pittsburgh this week, a judge ordered the defendant to be detained pending trial. Johnson s attorney declined to comment on the charges.Prosecutors allege Johnson s intrusion into UPMC was not an isolated occurrence, and that for several years after the UPMC hack he sold personally identifiable information (PII) to buyers on dark web forums.The indictment says Johnson used the hacker aliases DS and TDS to market the stolen records to identity thieves on the Evolution and AlphaBay dark web marketplaces. However, archived copies of the now-defunct dark web forums indicate those aliases are merely abbreviations that stand for DearthStar and TheDearthStar, respectively. You can expect good things come tax time as I will have lots of profiles with verified prior year AGIs to make your refund filing 10x easier, TheDearthStar advertised in an August 2015 message to AlphaBay members.In some cases, it appears these DearthStar identities were actively involved in not just selling PII and tax refund fraud, but also stealing directly from corporate payrolls.In an Aug. 2015 post to AlphaBay titled I d like to stage a heist but , TheDearthStar solicited people to help him cash out access he had to the payroll systems of several different companies: I have nowhere to send the money. I d like to leverage the access I have to payroll systems of a few companies and swipe a chunk of their payroll. Ideally, I d like to find somebody who has a network of trusted individuals who can receive ACH deposits. When another AlphaBay member asks how much he can get, TheDearthStar responds, Depends on how many people end up having their payroll records adjusted. Could be $1,000 could be $100,000. Continue reading We must care as much about securing our systems as we care about running them if we are to make the necessary revolutionary change. -CIA s Wikileaks Task Force. So ends a key section of a report the U.S. Central Intelligence Agency produced in the wake of a mammoth data breach in 2016 that led to Wikileaks publishing thousands of classified documents stolen from the agency s offensive cyber operations division. The analysis highlights a shocking series of security failures at one of the world s most secretive entities, but the underlying weaknesses that gave rise to the breach also unfortunately are all too common in many organizations today.The CIA produced the report in October 2017, roughly seven months after Wikileaks began publishing Vault 7 reams of classified data detailing the CIA s capabilities to perform electronic surveillance and cyber warfare. But the report s contents remained shrouded from public view until earlier this week, when heavily redacted portions of it were included in a letter by Sen. Ron Wyden (D-Ore.) to the Director of National Intelligence.The CIA acknowledged its security processes were so woefully lax that the agency probably would never have known about the data theft had Wikileaks not published the stolen documents online. What kind of security failures created an environment that allegedly allowed a former CIA employee to exfiltrate so much sensitive data? Here are a few, in no particular order:Failing to rapidly detect security incidents.Failing to act on warning signs about potentially risky employees.Moving too slowly to enact key security safeguards.A lack of user activity monitoring or robust server audit capability.No effective removable media controls.No single person empowered to ensure IT systems are built and maintained securely throughout their lifecycle.Historical data available to all users indefinitely.Substitute the phrase cyber weapons with productivity or just IT systems in the CIA s report and you might be reading the post-mortem produced by a security firm hired to help a company recover from a highly damaging data breach.A redacted portion of the CIA s report on the Wikileaks breach. Continue reading For the past year, a site called Privnotes.com has been impersonating Privnote.com, a legitimate, free service that offers private, encrypted messages which self-destruct automatically after they are read. Until recently, I couldn t quite work out what Privnotes was up to, but today it became crystal clear: Any messages containing bitcoin addresses will be automatically altered to include a different bitcoin address, as long as the Internet addresses of the sender and receiver of the message are not the same.Earlier this year, KrebsOnSecurity heard from the owners of Privnote.com, who complained that someone had set up a fake clone of their site that was fooling quite a few regular users of the service.And it s not hard to see why: Privnotes.com is confusingly similar in name and appearance to the real thing, and comes up second in Google search results for the term privnote. Also, anyone who mistakenly types privnotes into Google search may see at the top of the results a misleading paid ad for Privnote that actually leads to privnotes.com.A Google search for the term privnotes brings up a misleading paid ad for the phishing site privnotes.com, which is listed above the legitimate site privnote.com.Privnote.com (the legit service) employs technology that encrypts all messages so that even Privnote itself cannot read the contents of the message. And it doesn t send and receive messages. Creating a message merely generates a link. When that link is clicked or visited, the service warns that the message will be gone forever after it is read.But according to the owners of Privnote.com, the phishing site Privnotes.com does not fully implement encryption, and can read and/or modify all messages sent by users. It is very simple to check that the note in privnoteS is sent unencrypted in plain text, Privnote.com explained in a February 2020 message, responding to inquiries from KrebsOnSecurity. Moreover, it doesn t enforce any kind of decryption key when opening a note and the key after # in the URL can be replaced by arbitrary characters and the note will still open. But that s not the half of it. KrebsOnSecurity has learned that the phishing site Privnotes.com uses some kind of automated script that scours messages for bitcoin addresses, and replaces any bitcoin addresses found with its own bitcoin address. The script apparently only modifies messages if the note is opened from a different Internet address than the one that composed the address.Here s an example, using the bitcoin wallet address from bitcoin s Wikipedia page as an example. The following message was composed at Privnotes.com from a computer with an Internet address in New York, with the message, please send money to bc1qar0srrr7xfkvy5l643lydnw9re59gtzzwf5mdq thanks :A test message composed on privnotes.com, which is phishing users of the legitimate encrypted message service privnote.com. Pay special attention to the bitcoin address in this message.When I visited the Privnotes.com link generated by clicking the create note button on the above page from a different computer with an Internet address in California, this was the result. As you can see, it lists a different bitcoin address, albeit one with the same first four characters.The altered message. Notice the bitcoin address has been modified and is not the same address that was sent in the original note.Several other tests confirmed that the bitcoin modifying script does not seem to change message contents if the sender and receiver s IP addresses are the same, or if one composes multiple notes with the same bitcoin address in it. Continue reading Microsoft today released software patches to plug at least 129 security holes in its Windows operating systems and supported software, by some accounts a record number of fixes in one go for the software giant. None of the bugs addressed this month are known to have been exploited or detailed prior to today, but there are a few vulnerabilities that deserve special attention particularly for enterprises and employees working remotely.June marks the fourth month in a row that Microsoft has issued fixes to address more than 100 security flaws in its products. Eleven of the updates address problems Microsoft deems critical, meaning they could be exploited by malware or malcontents to seize complete, remote control over vulnerable systems without any help from users.A chief concern among the panoply of patches is a trio of vulnerabilities in the Windows file-sharing technology (a.k.a. Microsoft Server Message Block or SMB service). Perhaps most troubling of these (CVE-2020-1301) is a remote code execution bug in SMB capabilities built into Windows 7 and Windows Server 2008 systems both operating systems that Microsoft stopped supporting with security updates in January 2020. One mitigating factor with this flaw is that an attacker would need to be already authenticated on the network to exploit it, according to security experts at Tenable.The SMB fixes follow closely on news that proof-of-concept code was published this week that would allow anyone to exploit a critical SMB flaw Microsoft patched for Windows 10 systems in March (CVE-2020-0796). Unlike this month s critical SMB bugs, CVE-2020-0796 does not require the attacker to be authenticated to the target s network. And with countless company employees now working remotely, Windows 10 users who have not yet applied updates from March or later could be dangerously exposed right now. Continue reading In late May, KrebsOnSecurity alerted numerous officials in Florence, Ala. that their information technology systems had been infiltrated by hackers who specialize in deploying ransomware. Nevertheless, on Friday, June 5, the intruders sprang their attack, deploying ransomware and demanding nearly $300,000 worth of bitcoin. City officials now say they plan to pay the ransom demand, in hopes of keeping the personal data of their citizens off of the Internet.Nestled in the northwest corner of Alabama, Florence is home to roughly 40,000 residents. It is part of a quad-city metropolitan area perhaps best known for the Muscle Shoals Sound Studio that recorded the dulcet tones of many big-name music acts in the 1960s and 70s.Image: Florenceal.orgOn May 26, acting on a tip from Milwaukee, Wisc.-based cybersecurity firm Hold Security, KrebsOnSecurity contacted the office of Florence s mayor to alert them that a Windows 10 system in their IT environment had been commandeered by a ransomware gang.Comparing the information shared by Hold Security dark web specialist Yuliana Bellini with the employee directory on the Florence website indicated the username for the computer that attackers had used to gain a foothold in the network on May 6 belonged to the city s manager of information systems.My call was transferred to no fewer than three different people, none of whom seemed eager to act on the information. Eventually, I was routed to the non-emergency line for the Florence police department. When that call went straight to voicemail, I left a message and called the city s emergency response team.That last effort prompted a gracious return call the following day from a system administrator for the city, who thanked me for the heads up and said he and his colleagues had isolated the computer and Windows network account Hold Security flagged as hacked. I can t tell you how grateful we are that you helped us dodge this bullet, the technician said in a voicemail message for this author. We got everything taken care of now, and some different protocols are in place. Hopefully we won t have another near scare like we did, and hopefully we won t have to talk to each other again. But on Friday, Florence Mayor Steve Holt confirmed that a cyberattack had shut down the city s email system. Holt told local news outlets at the time there wasn t any indication that ransomware was involved.However, in an interview with KrebsOnSecurity Tuesday, Holt acknowledged the city was being extorted by DoppelPaymer, a ransomware gang with a reputation for negotiating some of the highest extortion payments across dozens of known ransomware families.The average ransomware payment by ransomware strain. Source: Chainalysis.Holt said the same gang appears to have simultaneously compromised networks belonging to four other victims within an hour of Florence, including another municipality that he declined to name. Holt said the extortionists initially demanded 39 bitcoin (~USD $378,000), but that an outside security firm hired by the city had negotiated the price down to 30 bitcoin (~USD $291,000).Like many other cybercrime gangs operating these days, DoppelPaymer will steal reams of data from victims prior to launching the ransomware, and then threaten to publish or sell the data unless a ransom demand is paid.Holt told KrebsOnSecurity the city can t afford to see its citizens personal and financial data jeopardized by not paying. Do they have our stuff? We don t know, but that s the roll of the dice, Holt said. Continue reading The co-owners of vDOS, a now-defunct service that for four years helped paying customers launch more than two million distributed denial-of-service (DDoS) attacks that knocked countless Internet users and websites offline, each have been sentenced to six months of community service by an Israeli court.vDOS as it existed on Sept. 8, 2016.A judge in Israel handed down the sentences plus fines and probation against Yarden Bidani and Itay Huri, both Israeli citizens arrested in 2016 at age 18 in connection with an FBI investigation into vDOS.Until it was shuttered in 2016, vDOS was by far the most reliable and powerful DDoS-for-hire or booter service on the market, allowing even completely unskilled Internet users to launch crippling assaults capable of knocking most websites offline.vDOS advertised the ability to launch attacks at up to 50 gigabits of data per second (Gbps) well more than enough to take out any site that isn t fortified with expensive anti-DDoS protection services.The Hebrew-language sentencing memorandum (PDF) has redacted the names of the defendants, but there are more than enough clues in the document to ascertain the identities of the accused. For example, it says the two men earned a little more than $600,000 running vDOS, a fact first reported by this site in September 2016 just prior to their arrest, when vDOS was hacked and KrebsOnSecurity obtained a copy of its user database.In addition, the document says the defendants were initially apprehended on September 8, 2016, arrests which were documented here two days later.Also, the sentencing mentions the supporting role of a U.S. resident named only as Jesse. This likely refers to 23-year-old Jesse Wu, who KrebsOnSecurity noted in October 2016 pseudonymously registered the U.K. shell company used by vDOS, and ran a tiny domain name registrar called NameCentral that vDOS and many other booter services employed.Israeli prosecutors say Wu also set up their payment infrastructure, and received 15 percent of vDOS s total revenue for his trouble. NameCentral no longer appears to be in business, and Wu could not be reached for comment.Although it is clear Bidani and Huri are defendants in this case, it is less clear which is referenced as Defendant #1 or Defendant #2. Both were convicted of corrupting/disturbing a computer or computer material, charges that the judge said had little precedent in Israeli courts, noting that cases of this kind have not been discussed in court so far. Defendant #1 also was convicted of sharing nude pictures of a 14 year old girl. Continue reading An exhaustive inquiry published today by a consortium of investigative journalists says a three-part series KrebsOnSecurity published in 2015 on a Romanian ATM skimming gang operating in Mexico s top tourist destinations disrupted their highly profitable business, which raked in an estimated $1.2 billion and enjoyed the protection of top Mexican authorities.The multimedia investigation by the Organized Crime and Corruption Reporting Project (OCCRP) and several international journalism partners detailed the activities of the so-called Riviera Maya crime gang, allegedly a mafia-like group of Romanians who until very recently ran their own ATM company in Mexico called Intacash and installed sophisticated electronic card skimming devices inside at least 100 cash machines throughout Mexico.According to the OCCRP, Riviera Maya s skimming devices allowed thieves to clone the cards, which were used to withdraw funds from ATMs in other countries often halfway around the world in places like India, Indonesia, and Taiwan.Investigators say each skimmer captured on average 1,000 cards per month, siphoning about $200 from individual victim accounts. This allowed the crime gang to steal approximately $20 million monthly. The gang had little tricks, OCCRP reporters recounted in their video documentary (above). They would use the cards in different cities all over the globe and wait three months so banks would struggle to trace where the card had originally been cloned. In September 2015, I traveled to Mexico s Yucatan Peninsula to find and document almost two dozen ATMs in the region that were compromised with Bluetooth-based skimming devices. Unlike most skimmers which can be detected by looking for out-of-place components attached to the exterior of a compromised cash machine these skimmers were hooked to the internal electronics of ATMs operated by Intacash s competitors by authorized personnel who d reportedly been bribed or coerced by the gang.But because the skimmers were Bluetooth-based, allowing thieves periodically to collect stolen data just by strolling up to a compromised machine with a mobile device, I was able to detect which ATMs had been hacked using nothing more than a cheap smart phone.One of the Bluetooth-enabled PIN pads pulled from a compromised ATM in Mexico. The two components on the left are legitimate parts of the machine. The fake PIN pad made to be slipped under the legit PIN pad on the machine, is the orange bit, top right. The Bluetooth and data storage chips are in the middle.Several days of wandering around Mexico s top tourist areas uncovered these sophisticated skimmers inside ATMs in Cancun, Cozumel, Playa del Carmen and Tulum, including a compromised ATM in the lobby of my hotel in Cancun. OCCRP investigators said the gang also had installed the same skimmers in ATMs at tourist hotspots on the western coast of Mexico, in Puerto Vallarta, Sayulita and Tijuana.Part III of my 2015 investigation concluded that Intacash was likely behind the scheme. An ATM industry source told KrebsOnSecurity at the time that his technicians had been approached by ATM installers affiliated with Intacash, offering those technicians many times their monthly salaries if they would provide periodic access to the machines they maintained.The alleged leader of the Riviera Maya organization and principal owner of Intacash, 43-year-old Florian The Shark Tudor, is a Romanian with permanent residence in Mexico. Tudor claims he s an innocent, legitimate businessman who s been harassed and robbed by Mexican authorities.Last year, police in Mexico arrested Tudor for illegal weapons possession, and raided his various properties there in connection with an investigation into the 2018 murder of his former bodyguard, Constantin Sorinel Marcu.According to prosecution documents, Marcu and The Shark spotted my reporting shortly after it was published in 2015, and discussed what to do next on a messaging app:The Shark: Krebsonsecurity.com See this. See the video and everything. There are two episodes. They made a telenovela.Marcu: I see. It s bad.The Shark: They destroyed us. That s it. Fuck his mother. Close everything.The intercepted communications indicate The Shark also wanted revenge on whoever was responsible for leaking information about their operations.The Shark: Tell them that I am going to kill them.Marcu: Okay, I can kill them. Any time, any hour.The Shark: They are checking all the machines. Even at banks. They found over 20.Marcu: Whaaaat?!? They found? Already?? Continue reading All About Skimmers Click image for my skimmer series.Spam NationA New York Times Bestseller! The Value of a Hacked PCBadguy uses for your PCTools for a Safer PCTools for a Safer PC The Pharma WarsSpammers Duke it OutBadguy Uses for Your Email Your email account may be worth far more than you imagine.eBanking Best PracticeseBanking Best Practices for BusinessesCategory: Web Fraud 2.0Innovations from the UndergroundID Protection Services ExaminedIs Antivirus Dead?The reasons for its declineThe Growing Tax Fraud MenaceFile 'em Before the Bad Guys Can Inside a Carding ShopA crash course in carding. Beware Social Security FraudSign up, or Be Signed Up! How Was Your Card Stolen?Finding out is not so easy. Krebs s 3 Rules ...For Online Safety.

TAGS:Krebs on Security 

<<< Thank you for your visit >>>

Hot Websites