Notices by BrianKrebs (briankrebs@infosec.exchange), page 4

The U.S. Federal Bureau of Investigation (FBI) said today that it infiltrated the world’s second most prolific ransomware gang, a Russia-based criminal group known as ALPHV and BlackCat. The FBI said it seized the gang’s darknet website, and released a decryption tool that hundreds of victim companies can use to recover systems. Meanwhile, BlackCat responded by briefly “unseizing” its darknet site with a message promising 90 percent commissions for affiliates who continue to work with the crime group, and open season on everything from hospitals to nuclear power plants.

https://krebsonsecurity.com/2023/12/blackcat-ransomware-raises-ante-after-fbi-disruption/

[Santa hat edits from @nixonnixoff ]

Hey everyone! I'm guessing a lot of you will be buying last minute gifts for people, and those tend to involve gift cards. Be very careful when you're buying these off-the-rack at retail stores that sell gift cards for various popular restaurants and brands. Especially those that are not in particularly tamper-proof packaging.

A friend just shared some photos he took after buying a bunch of Dardens restaurant gift cards for some gifts to clients. They didn't discover until leaving the store that several of the cards had been tampered with, their PIN scratch-offs re-covered with look-alike scratch off stickers. Also, the phony ones seem to have goofy looking barcodes, like they were scanned and printed by a laser printer without enough ink.

The trick here is the thieves pull the card out, scratch off the PIN part, record that, cover up the pin with fake tape, and then shove the thing back in the packaging and put it back on the shelf. Then, when someone buys it, the thieves can access the value on the card the minute it is activated (purchased).

The image shows two of these cards that are non-tampered (left) and two on the right that were. These cards can slide right out of their packaging with a little wiggling, and slide back in the same way.

Some stores keep their gift cards behind the counter for this reason. Might be best going for those instead of the ones in aisle 19.

My repertoire of Christmas songs on the piano is getting longer. Why is Carol of the Bells so much fun to play? Apart from getting to really hammer on the keys, I think it's because it's kind of dark and ominous, and very unlike most other traditional holiday tunes.

I can't even begin to count the hours of research that went into this story. Frustrated that most of that research went in the wrong direction for so long. But also very excited to share what I found, and that I finally have something to show for it all:

On Dec. 18, 2013, KrebsOnSecurity broke the news that U.S. retail giant Target was battling a wide-ranging computer intrusion that compromised more than 40 million customer payment cards over the previous month. The malware used in the Target breach included the text string “Rescator,” which also was the handle chosen by the cybercriminal who was selling all of the cards stolen from Target customers. Ten years later, KrebsOnSecurity has uncovered new clues about the real-life identity of Rescator.

https://krebsonsecurity.com/2023/12/ten-years-later-new-clues-in-the-target-breach/

One aspect of this reporting I really need to get off my chest. In the 9 years since my book Spam Nation was published, I've been privy to snide remarks about the focus of that book -- Mr. Vrublevsky -- bc he comes across as a somewhat cartoonish figure who is consumed with penny-ante scams like fake antivirus sales or running some payments scam. I think this is bc Vrublevsky appears on the surface to lampoon and play down his own activities, but I assure you this is a distraction and ruse.

In reality, I still haven't come across anyone in the RU cybercrime space who has more connections to the current and former top players there. So, in a lot of ways this reporting only validates my focus.

In re the "how ransomware could possibly get worse" response, I have two scenarios (which we have already seen in the playbook/arsenal of ALL of the regimes already mentioned): Deleting data (forget ransoming it: you already pwn the servers); corrupting it (holy crap what blood type is this patient????).

I really admire what Bruce Schneier has said about the pay-or-not-pay debacle that ransomware puts companies and individuals in. Because it aptly summarizes the counterpoint to outlawing the payment of ransomware: I'm paraphrasing from memory here, but it was something to the effect of, "it's your data, or your daughter." In other words, the imperative to pay is directly related to your skin in the game.

I've grudgingly come around to the notion that there is only one way out of the ransomware problem: Make paying a ransom illegal. This is not very different from laws that make it illegal for US companies to pay bribes to foreign officials.

I really don't see any other way out of this mess. Yes, some victims will unfortunately ignore any laws that say they can't pay, but enforcement probably will not be hard.

What will be difficult are the situations where peoples' lives are at stake in ransomware situations. This sounds callous, but we can't afford to take the short view here anymore, and our other alternatives aren't great either.

I'm quite certain this is an unpopular view, but we have already seen the cost of doing nothing. At least in the interests of congruity for our financial sanctions vs Russia, we should probably make this change sooner rather than later.

Last night I set a new record for the length of time it took me to find a specific cybercriminal in real life. This one only took ten years, and hundreds of hours of research -- almost all of it in the wrong direction. I'm ecstatic, but also kind of mad at myself for missing key pieces of the puzzle that it turns out I had IN MY INBOX all along.

Anyway, the person in question is a big fish, and this going to be quite the story when it's ready. So, if I'm unresponsive to nudges etc for the next, er...week probably, you know why.

Just added this bit to the end of the story, which was news to me until a few minutes ago:

Regardless of whether the RDRS succeeds or fails, there is another European law that takes effect in 2024 which is likely to place additional pressure on registrars to respond to legitimate WHOIS data requests. The new Network and Information Security Directive (NIS2), which EU member states have until October 2024 to implement, requires registrars to keep much more accurate WHOIS records, and to respond within as little as 24 hours to WHOIS data requests tied everything from phishing, malware and spam to copyright and brand enforcement.

Also added a list of registrars that are participating so far in this pilot program. There's only about 50 or so right now, but some of the big ones are included, such as Godaddy, eNom, Namecheap, Gandi, Network Solutions. I was surprised to see Porkbun participating, considering how much abuse comes through their platform.

More than five years after domain name registrars started redacting personal data from all public domain registration records, the non-profit organization overseeing the domain industry has introduced a centralized online service designed to make it easier for researchers, law enforcement and others to request the information directly from registrars.

https://krebsonsecurity.com/2023/12/icann-launches-service-to-help-with-whois-lookups/

Germany-based email provider Tuta says Microsoft Outlook is blocking all emails from tutanota.com.

https://tuta.com/blog/outlook-falsely-marks-tutanota-emails-as-junk

This one aged pretty well. IMHO, it's more true now than ever.

You probably never figured the Caribbean island of Anguilla would be a hotbed of AI activity, but here we are. One of the more interesting press releases I received this morning:

"Due to the rise in popularity of Artificial Intelligence (AI), .ai domain registration figures have skyrocketed. The small island of Anguilla, whose government owns the country code top-level domain (ccTLD) .ai, has had a huge spell of luck after reaping significant profits amid this tech-driven trend."

"Anguilla’s government is earning around $3 million every month from registrations, which has almost surpassed the revenue generated from all goods and services, from all of their shops and restaurants each month of the year so far. Should this trend persist, projections suggest a potential additional revenue of up to $45 million by the end of 2024."

"Although this presents a significant opportunity for a tiny island of only 16,000 inhabitants, such reliance on a single revenue stream poses potential risks to the nation’s economic prospects."

This is pretty clever. A phish going around spoofing Wordpress and telling people to install a security update that references a fake CVE. In this case, the "patch" is a website backdoor.

https://www.wordfence.com/blog/2023/12/psa-fake-cve-2023-45124-phishing-scam-tricks-users-into-installing-backdoor-plugin/

The House Select Committee on the Weaponization of Federal Government (yes, that's its real committee name) held a hearing yesterday you might have missed or tuned out on account of its witness list. But it's worth paying attention to because the far-right GOP's contention that everyone is out to censor their first amendment rights is starting to take aim at info sharing efforts between the private sector and the USG to fight Internet and computer security threats.

The pretext for the hearing is a "story" that ran this week that decried the "Censorship Industrial Complex," one of several new buzzwords echoed by Rep. Jim Jordan and other GOP members asking questions. Bear in mind that the folks pushing this narrative use this term interchangeably to describe any "anti-disinformation efforts" (duh):

https://public.substack.com/p/ctil-files-1-us-and-uk-military-contractors

The story and the hearing concerned the insidious censorship threat posed by a shadowy entity called the CTI League, which was allegedly started as a joint public-private partnership but which according to the "Twitter files" useful idiot Matt Taibbi is a cleverly disguised effort to censor republican and conservative views on social media.

In reality, the CTI League was one of several groups that formed around the time of the 2020 pandemic to help respond to the crushing number of phishing and scam websites that were taking advantage of the situation. Here's one example:

https://krebsonsecurity.com/2020/04/covid-19-has-united-cybersecurity-experts-but-will-that-unity-survive-the-pandemic/

When asked by a GOP committee member to describe the biggest "bombshell" -- the "most alarming thing" -- to come from "the Twitter files," Taibbi answered that the activities of the CTI League were "shocking." He went on to describe how this group maintained censorship spreadsheets with domains numbering in the hundreds of thousands. But he forgot to mention these were PHISHING DOMAINS!!!!!

Here's the giant whopper: Taibbi said there was "a regular, organized stream of communications between the FBI, the Dept of Homeland Security and the largest tech companies in the country," he said. "They had an organized system for flagging content. Not occasionally, but in enormous numbers involving spreadsheets of accounts that ran into the hundreds of thousands. This was shocking to us. This isn't some crazy conspiracy theory. We've already had 4 federal judges rule that this activity violates the first amendment."

Yeah. There was a spreadsheet that several thousand security people had access to that everyone agreed were malicious or phishous. CENSORSHIP!
https://judiciary.house.gov/committee-activity/hearings/hearing-weaponization-federal-government-4

Really do not miss this time of year, when the humidity in my office gets so low that everything I touch tries to shock the $#!+ out me. Had the humidifier going all morning and somehow it's still at 22 percent. I think maybe I'll just start wearing gloves in the house.

In 2019, I broke the news that First American Title Insurance Co, the country's second-largest title insurer, had leaked on its public website hundreds of millions of documents related to mortgage deals going back to 2003. The digitized records — including bank account numbers and statements, mortgage and tax records, Social Security numbers, wire transaction receipts, and drivers license images — were available without authentication to anyone with a Web browser.

https://krebsonsecurity.com/2019/05/first-american-financial-corp-leaked-hundreds-of-millions-of-title-insurance-records/

According to a report today from Newsday, First American has agreed to pay New York state $1 million for violating the state's cybersecurity regulation.

Not sure how the regulators reached $1m as an appropriate fine, but it seems small to me.

https://www.newsday.com/business/first-american-title-insurance-settlement-new-york-xh6x1gj0

How's this for a conundrum? You spend several months of your life trying to uncover the real-life identity of perhaps one of the older and most experienced ransomware access brokers out there. And when you do find this person, you discover they are now (also?) serving in a very important technical role for the Ukrainian military that involves successfully targeting and killing large numbers of Russian invaders.

I'm not sure the timing is right for this person's story, but it's a good one.