Always strive to learn something useful. --Sophocles

So first a little talk about version numbers. Programs are written with version numbers, which lets the company keep track of the source code that produced it. This lets them patch specific versions and proceed from known good points and also bring problematic code into the known good version. These numbers are incremented as the code continues to be written. I'm not going to provide examples of what version numbers look like as they vary from company to company.

I don't understand it completely, but something got screwed up with Microsoft's version numbers, some sort of crossover happened and the net result is that several programs went unpatched for several months this year. Thus, today's patch dump updates a lot of stuff going back literal months. And this stuff has been exploited, so this is important! The Krebs article has more information as to what programs were affected by this problem.

There are also updates for Windows 11, Krebs does not mention any exploits going on for that OS.

Also, Adobe patched their core products, but say that there were no known exploits going on.

https://krebsonsecurity.com/2024/09/bug-left-some-windows-pcs-dangerously-unpatched/

I've posted about this guy before. When he wasn't able to get a good enough return from the therapy center for hacking them and stealing the files, he started trying to extort the patients to prevent their therapy records from being made public. He was finally convicted and received six years, three months in prison. Prosecution wanted a minimum of seven years, however he will be paying restitution and he will be held in prison while he goes through the appeals process, so they're satisfied.

https://krebsonsecurity.com/2024/04/man-who-mass-extorted-psychotherapy-patients-gets-six-years/

This is being thrown against high-value targets: AI startup owners, cryptocurrency fund managers, computer security consultants, etc. The odds of this being targeted against average shlubs is quite low as it requires some resources to be deployed, but that doesn't mean it can't happen. Regardless, it's always good to be aware.

In this case, MFA stands for multi-factor authentication. When you sign on to iCloud on a PC and it sends a six-digit number to your phone to authenticate in your PC browser, that's MFA.

What this attack is doing is flooding the target with dozens and dozens of Reset Password notification messages, exploiting a rate limit flaw. By rate limit, we mean limiting how many messages of a specific type that can be sent within a certain time frame. Normally if you (the account owner) request a password reset, a reasonable rate limit would be a message every 15-30 seconds, not more often than that. You wouldn't allow a flood of messages. These particular crooks have found a way to induce a flood.

The result is the classic Allow/Deny result. Clicking Deny gets you another message. Clicking Allow is not catastrophic, it pops up the MFA number entry screen. Eventually you get a call from "Apple Support" with the correct (spoofed) phone number, and they'll be able to verify pretty much all your information, because they've bought it from a data broker - one of the resources they have to deploy, which is why it's more of a targeted attack than a wide-spread one.

And this is the biggest giveaway - Apple Support will NEVER call you, unless YOU initiate a support call for them to call you back!

The only way to truly block this attack at the moment is to change the phone number, and we all know what a PITA that would be! I suppose you could temporarily buy a burner phone, change the outgoing message on your prime phone to say 'This number is temporarily out of service, if you need to contact me, drop me an email and I'll call you back' and notify your true emergency contacts and employment contacts.

It's believed Apple will be looking at fixing the rate limit that's allowing this bombing attack to take place, but Apple is typically pretty tight-lipped about these things.

The article is an interesting read to see what people are going through right now.

In a way, what this is is a moderately sophisticated social engineering attack with a good amount of resources behind it. And if the victim falls for it and enters the reset code, they've surrendered the keys to their iCloud account to the criminals and potentially can see ALL their devices wiped and reset: phone, watch, iPad, laptops. But not before the information is sucked out of them.

https://krebsonsecurity.com/2024/03/recent-mfa-bombing-attacks-targeting-apple-users/

The twerp hacked Vastaamo Psychotherapy Center and stole all their patient files, which included notes taken during therapy sessions. The center refused to pay a six-figure ransom, so he switched to trying to extort the individual patients for 500 Euro each. That didn't prove a revenue generator either, so he dumped all the files on a dark web site. This was October 2020.

In February 2023 he was arrested by French police when the man, 6'3" and green-eyed, presented Romanian identification which proved false. His attorneys asked for his release during the trial as he had already been jailed for eight months. The judge declared that he was still a flight risk and ordered him held for the duration of the trial.

https://krebsonsecurity.com/2023/11/alleged-extortioner-of-psychotherapy-patients-faces-trial/

Nominally, the .US top level domain is owned by the U.S. government. However, they contracted out the management of it. And it was then subcontracted out, etc. And now it's being controlled by a bunch of crooks who are doing domain shortening for a bunch of low-lifes who are using it for pfishing, credential theft, etc.

Domain shortening is when you see something like goo.gl/xyzabc. Google takes xyzabc and expands it to a much longer domain, the problem is that you can't see if it's a safe domain in the shortened version! Can you say security risk? I knew you could! The .US is pretty much not at all in use by the U.S. government, and anything critical sent to you by the government, such as an IRS notice, is going to come by the U.S. mail anyway.

https://krebsonsecurity.com/2023/10/us-harbors-prolific-malicious-link-shortening-service/

It was noticed that Barracuda Email Security Gateways (ESGs) were spewing forth a lot of malware. And Barracuda says the devices CANNOT BE PATCHED AND MUST BE DECOMMISIONED AND REMOVED FROM SERVICE.

A little technical lesson. Company/corporate networks have a single point of contact (for the sake of discussion) with the internet. At this point there is a firewall, which is a security device that scans all traffic coming in for attacks and going out for attempts to exfiltrate corporate secrets (well, at big companies they look for exfiltration attempts). There are also ESGs which try to block attempts from bag guys to send malware through corrupted email attachments and again, prevent exfiltration of corporate secrets through sending out cost sheets through email, etc.

Somehow bad guys have compromised Barracuda's ESG to such a level that they have no confidence that this malware can be removed! Now things get interesting. If you read the Krebs article linked below, one security professional believes this is the work of a 'State Actor', meaning a nation. Common computer criminals want fast results, and have the software exploits to get those results. State actors want long-term results without detection. This malware has been in place since OCTOBER OF LAST YEAR.

I've previously posted about the UEFI hack where an exploit goes into the boot system of a computer. Well, an ESG is a computer, though not a general purpose computer like I'm writing on or you're reading this with. But it has a boot system and a CPU and it's programmable, it's just programmed to do a specific task and it's updateable. Thing is, it probably uses bog-standard CPUs since it's easy to find engineers who know how to write code for them, even if the code is quite specialized - these things don't run Windows! But they do have a CPU and they do have to boot up, so there's an opportunity to exploit, and someone found a way.

Now, here's my thought. The Krebs article says that there are 11,000 of Barracuda's ESG devices in use right now. If I am an IT manager, and I have one or more of these devices in use, and I'm suddenly told that I have to replace ALL of them RIGHT NOW, is Barracuda going to be my automatic first choice for another ESG? They just cost me a LOT of money, and caused me a lot of trouble because guaranteed most of the people are going to be caught having to replace this gear outside of their scheduled replacement cycle (when corps can, things like this are budgeted and scheduled on approx a 3-5 year replacement cycle).

This is really going to hurt Barracuda's long-term financials. It wouldn't surprise me if they take a serious dive and are gobbled up by Cisco or someone else within the next 3-5 years.

https://krebsonsecurity.com/2023/06/barracuda-urges-replacing-not-patching-its-email-security-gateways/

An excellent article on how your private data gets shared and what you can do about it.

The WHY you should is pretty simple: 9 million AT&T customers were compromised in a hack at an advertising affiliate, T-Mobile has had 70 million accounts compromised in the last decade or so, etc.

These data breeches are so common as to be ridiculous. And that information can be used against you in possible fraud schemes. As an article that I posted recently said, Americans lost a record amount to fraud schemes in 2022, and breeches like these help fuel said schemes.

The article explains how to opt-OUT of data sharing for the Big Three: AT&T, Verizon, and T-Mobile.

https://krebsonsecurity.com/2023/03/why-you-should-opt-out-of-sharing-data-with-your-mobile-provider/

Remember that Violence As A Service article that I posted a while back? This is a direct offshoot of that. One of these stains is a "L337 hax0r" who stole over $300,000 in crypto currency via cell phone sim swapping. These twits would hack Yahoo Mail accounts, then see if that same password would unlock a Ring account. If it did, they were gold - goes to show that it's important to use different passwords for different accounts, especially important ones, and critical when privacy issues are at stake!

Then these stains would SWAT the victims, recording and live-streaming the victims. Fortunately no physical injuries were reported from the incidents, though emotional trauma I'm sure was received.

Have fun in prison, ass-wipes!

https://krebsonsecurity.com/2022/12/hacked-ring-cams-used-to-record-swatting-victims/

Good ol' Brian Krebs. In New York City, NCR and an unnamed financial institution have uncovered the latest generation in card skimmers. A card skimmer is a custom-made device that credit card thieves insert into AMERICAN ATMs (this is almost 100% an American problem because we won't get rid of the stupid magnetic strip and go to entirely chip-based cards) that has a strip reader and is inserted into the card reading slot of the ATM, so that when you insert your card into the machine, it captures the data on your bank card. A very cleverly-disguised card then captures your PIN that you almost never cover when you enter it. It's all stored in memory, then the thieves come by later with a Bluetooth transceiver, beam a code to the device, and it spews all the captured data back to them and clears itself.

These have been around for years and are most commonly found at stand-alone ATMs and at gas pumps. So what is new about this?

IT IS 0.68 MILLIMETERS THICK!

That is some pretty impressive engineering and manufacturing to make a skimmer that thin! To give you a comparison, your bank card is approximately 0.54mm thick.

NCR has some countermeasures to improve detection of these skimmers, but the best thing as always is to simply cover your hand when entering your PIN.

https://krebsonsecurity.com/2022/09/say-hello-to-crazy-thin-deep-insert-atm-skimmers/

Norton bought LifeLock and is now Norton Lifelock, and now their Norton 360 product bundles an Ethereum cryptominer in their software!

And Norton takes 15% of what you mine.

So if you're not interested in mining ETH and use Norton, be very careful on your install to disable the mining aspect of the software. If you do want to mine ETH, install a proper miner and don't give Norton a cut unless you feel like contributing to a major corporation's profits. I'm sure they need the 15% more than you do.

Myself, I loved Norton Utilities when it first came out. Peter Norton was a genius. And when Symantec took it over, initially it was good. But it became bloatware and eventually worthless and I stopped using it and now won't touch it or recommend it. But to each their own.

LifeLock, for those not current on the company, claimed to be able to lock down your personal information online. They were so confident about their product that they drove advertising trucks around major cities across the USA with their CEO's Social Security Number prominently displayed. And his identity was stolen multiple times.

https://krebsonsecurity.com/2022/01/norton-360-now-comes-with-a-cryptominer/