The threat actors also deployed more aggressive techniques for mining CPU resources

Read More

These include infostealers, multi-layer encryption tools and dark web marketplace scripts

Read More

Following the takedown of the Hydra Marketplace in 2022, 10 darknet markets rose to fill the void

Read More

Graham Cluley Security News is sponsored this week by the folks at Edgescan. Thanks to the great team there for their support! Edgescan simplifies Vulnerability Management (VM) by delivering a single full-stack SaaS solution integrated with world-class security professionals. Edgescan helps enterprise companies consolidate managing multiple point scanning tools for each layer of the attack … Continue reading “Does a hybrid model for vulnerability management make sense?”

Read More

As technology weaves itself into our lives in new and unexpected ways, some of it will get quite personal and close to home. That made itself clear at CES this year, which makes a strong case for your security. 

The more things we connect, the more data we create. Data about ourselves that companies and others collect, share, and sell—where we are and what we’re doing, along with what we buy, watch, and search for. And today, we’re creating more of it and in more exacting detail.  

We connect our homes with smart devices that create data about our comings and goings, and we connect ourselves with smart glasses and watches, rings, and things that track our health, our sleep, and wellness overall. Meanwhile, we have virtual reality and augmented reality hardware companies that want a place on your face with headsets and experiences that will take you into the metaverse. 

Walking the floor of this year’s CES, you’ll see all these things, and plenty more. Yet central to it all is one thing—you. Specifically, your privacy and identity.  

As technology evolves so rapidly and brings new ways of experiencing our world, it’s an exciting time. It’s also a somewhat uncertain time. What data will these devices create? Who’ll collect it? What will they do with it? And importantly, what can you do to protect yourself? Questions about your security are very much on our minds, and they’re on yours too. You’ve told us as much.  

80% of you are concerned that a company could sell their data to another company.   
81% of you are concerned that your identity could be stolen from an online transaction. 

And unsurprisingly, protection is very much on your mind as well.                                

85% of you want to protect your identity online. 
84% of you want to take back control of your data online. 

And that’s where we come in. Just as the floor of CES showcases the evolution of life online, we’re evolving online protection as well. McAfee+ represents that next step—a product line that gives you a full slate of online protection that covers your privacy, identity, and devices so you can enjoy life online with confidence. 

At the center of that online life is you, and our definition of online protection has become quite expansive as a result. We see how it can help you monitor your credit, your identity, and where your personal information crops up online. We see how it can prevent the wrong people from getting their hands on data and info too. And we see how our industry-first Protection Score can show you how safe you are—and offer guidance that can make you safer still. In all, we see it as an online companion, one that removes uncertainty and gives you a feeling of security. Because you truly are secure. 

In all, protection today demands this comprehensive approach because we go about so much of our day online. McAfee+ reflects that reality. And with that, the various plans for McAfee+ include: 

Personal Data Cleanup reveals which high-risk data brokers and people search sites are collecting and selling your personal information and requests the removal of the information, confirms completion, and conducts ongoing scans as data is always being collected.    
Unlimited Secure VPN that automatically connects to public Wi-Fi to protect online privacy and safeguard personal data while online banking, shopping, or browsing.    
$1M Identity Theft and Stolen Funds Coverage to reimburse lost funds or expenses in restoring the customer’s identity, including losses to 401(k) accounts.   
Ransomware Coverage to reimburse up to $25,000 for losses and ransom fees.    
Licensed Restoration Experts who can take necessary actions to repair identity and credit issues, including assistance to assist with identity fraud of a deceased family member.    
Credit Monitoring and Alerts keeps an eye on changes to your credit score, report, and accounts with timely notifications and guidance so you can take action to tackle identity theft. 
Credit Score and Report to help you stay on top of daily changes to your credit score and report, from a single location.   
Credit Lock reduces the chance of becoming a victim of identity theft by allowing you to quickly lock and unlock your credit, which can help prevent unauthorized opening of accounts.    
Security Freeze prevents unauthorized access to existing accounts or new ones being set up in your name with a credit, bank, or utility freeze.   
Identity Monitoring for up to 60 unique pieces of personal information on the dark web with timely alerts up to 10 months sooner than competitive products.    

And that list will only continue to grow. As the year takes shape, we’ll roll out yet more protections that will give you even more control of your privacy and identity. Particularly as you and your household rely on life online more and more. 

As is true any year at CES, we see all manner of potential. New ways to make the day easier, more enjoyable, and more productive thanks to life online. Yet amidst it all, we see you. We see how you’ll use these new technologies, what the privacy, identity, and security implications are, and how we can protect you so you can benefit from these advances in technology, safely.  

Like you, we’re excited for what’s next, and we’ll see to it that you can enjoy it—with protection that looks after you, your household, and your family.  

The post The Case for Your Security at CES 2023 appeared first on McAfee Blog.

Read More

Identity thieves have been exploiting a glaring security weakness in the website of Experian, one of the big three consumer credit reporting bureaus. Normally, Experian requires that those seeking a copy of their credit report successfully answer several multiple choice questions about their financial history. But until the end of 2022, Experian’s website allowed anyone to bypass these questions and go straight to the consumer’s report. All that was needed was the person’s name, address, birthday and Social Security number.

In December, KrebsOnSecurity heard from Jenya Kushnir, a security researcher living in Ukraine who said he discovered the method being used by identity thieves after spending time on Telegram chat channels dedicated to the cashing out of compromised identities.

“I want to try and help to put a stop to it and make it more difficult for [ID thieves] to access, since [Experian is] not doing shit and regular people struggle,” Kushnir wrote in an email to KrebsOnSecurity explaining his motivations for reaching out. “If somehow I can make small change and help to improve this, inside myself I can feel that I did something that actually matters and helped others.”

Kushnir said the crooks learned they could trick Experian into giving them access to anyone’s credit report, just by editing the address displayed in the browser URL bar at a specific point in Experian’s identity verification process.

Following Kushnir’s instructions, I sought a copy of my credit report from Experian via annualcreditreport.com — a website that is required to provide all Americans with a free copy of their credit report from each of the three major reporting bureaus, once per year.

Annualcreditreport.com begins by asking for your name, address, SSN and birthday. After I supplied that and told Annualcreditreport.com I wanted my report from Experian, I was taken to Experian.com to complete the identity verification process.

Normally at this point, Experian’s website would present four or five multiple-guess questions, such as “Which of the following addresses have you lived at?”

Kushnir told me that when the questions page loads, you simply change the last part of the URL from “/acr/oow/” to “/acr/report,” and the site would display the consumer’s full credit report.

But when I tried to get my report from Experian via annualcreditreport.com, Experian’s website said it didn’t have enough information to validate my identity. It wouldn’t even show me the four multiple-guess questions. Experian said I had three options for a free credit report at this point: Mail a request along with identity documents, call a phone number for Experian, or upload proof of identity via the website.

But that didn’t stop Experian from showing me my full credit report after I changed the Experian URL as Kushnir had instructed — modifying the error page’s trailing URL from “/acr/OcwError” to simply “/acr/report”.

Experian’s website then immediately displayed my entire credit file.

Even though Experian said it couldn’t tell that I was actually me, it still coughed up my report. And thank goodness it did. The report contains so many errors that it’s probably going to take a good deal of effort on my part to straighten out.

Now I know why Experian has NEVER let me view my own file via their website. For example, there were four phone numbers on my Experian credit file: Only one of them was mine, and that one hasn’t been mine for ages.

I was so dumbfounded by Experian’s incompetence that I asked a close friend and trusted security source to try the method on her identity file at Experian. Sure enough, when she got to the part where Experian asked questions, changing the last part of the URL in her address bar to “/report” bypassed the questions and immediately displayed her full credit report. Her report also was replete with errors.

KrebsOnSecurity shared Kushnir’s findings with Experian on Dec. 23, 2022. On Dec. 27, 2022, Experian’s PR team acknowledged receipt of my Dec. 23 notification, but the company has so far ignored multiple requests for comment or clarification.

By the time Experian confirmed receipt of my report, the “exploit” Kushnir said he learned from the identity thieves on Telegram had been patched and no longer worked. But it remains unclear how long Experian’s website was making it so easy to access anyone’s credit report.

In response to information shared by KrebsOnSecurity, Senator Ron Wyden (D-Ore.) said he was disappointed — but not at all surprised — to hear about yet another cybersecurity lapse at Experian.

“The credit bureaus are poorly regulated, act as if they are above the law and have thumbed their noses at Congressional oversight,” Wyden said in a written statement. “Just last year, Experian ignored repeated briefing requests from my office after you revealed another cybersecurity lapse the company.”

Sen. Wyden’s quote above references a story published here in July 2022, which broke the news that identity thieves were hijacking consumer accounts at Experian.com just by signing up as them at Experian once more, supplying the target’s static, personal information (name, DoB/SSN, address) but a different email address.

From interviews with multiple victims who contacted KrebsOnSecurity after that story, it emerged that Experian’s own customer support representatives were actually telling consumers who got locked out of their Experian accounts to recreate their accounts using their personal information and a new email address. This was Experian’s advice even for people who’d just explained that this method was what identity thieves had used to lock them in out in the first place.

Clearly, Experian found it simpler to respond this way, rather than acknowledging the problem and addressing the root causes (lazy authentication and abhorrent account recovery practices). It’s also worth mentioning that reports of hijacked Experian.com accounts persisted into late 2022. That screw-up has since prompted a class action lawsuit against Experian.

Sen. Wyden said the Federal Trade Commission (FTC) and Consumer Financial Protection Bureau (CFPB) need to do much more to protect Americans from screw-ups by the credit bureaus.

“If they don’t believe they have the authority to do so, they should endorse legislation like my Mind Your Own Business Act, which gives the FTC power to set tough mandatory cybersecurity standards for companies like Experian,” Wyden said.

Sadly, none of this is terribly shocking behavior for Experian, which has shown itself a completely negligent custodian of obscene amounts of highly sensitive consumer information.

In April 2021, KrebsOnSecurity revealed how identity thieves were exploiting lax authentication on Experian’s PIN retrieval page to unfreeze consumer credit files. In those cases, Experian failed to send any notice via email when a freeze PIN was retrieved, nor did it require the PIN to be sent to an email address already associated with the consumer’s account.

A few days after that April 2021 story, KrebsOnSecurity broke the news that an Experian API was exposing the credit scores of most Americans.

It’s bad enough that we can’t really opt out of companies like Experian making $2.6 billion each quarter collecting and selling gobs of our personal and financial information. But there has to be some meaningful accountability when these monopolistic companies engage in negligent and reckless behavior with the very same consumer data that feeds their quarterly profits. Or when security and privacy shortcuts are found to be intentional, like for cost-saving reasons.

And as we saw with Equifax’s consolidated class-action settlement in response to letting state-sponsored hackers from China steal data on nearly 150 million Americans back in 2017, class-actions and more laughable “free credit monitoring” services from the very same companies that created the problem aren’t going to cut it.

WHAT CAN YOU DO?

It is easy to adopt a defeatist attitude with the credit bureaus, who often foul things up royally even for consumers who are quite diligent about watching their consumer credit files and disputing any inaccuracies.

But there are some concrete steps that everyone can take which will dramatically lower the risk that identity thieves will ruin your financial future. And happily, most of these steps have the side benefit of costing the credit bureaus money, or at least causing the data they collect about you to become less valuable over time.

The first step is awareness. Find out what these companies are saying about you behind your back. Keep in mind that — fair or not — your credit score as collectively determined by these bureaus can affect whether you get that loan, apartment, or job. In that context, even small, unintentional errors that are unrelated to identity theft can have outsized consequences for consumers down the road.

Each bureau is required to provide a free copy of your credit report every year. The easiest way to get yours is through annualcreditreport.com.

Some consumers report that this site never works for them, and that each bureau will insist they don’t have enough information to provide a report. I am definitely in this camp. Thankfully, a financial institution that I already have a relationship with offers the ability to view your credit file through them. Your mileage on this front may vary, and you may end up having to send copies of your identity documents through the mail or website.

When you get your report, look for anything that isn’t yours, and then document and file a dispute with the corresponding credit bureau. And after you’ve reviewed your report, set a calendar reminder to recur every four months, reminding you it’s time to get another free copy of your credit file.

If you haven’t already done so, consider making 2023 the year that you freeze your credit files at the three major reporting bureaus, including Experian, Equifax and TransUnion. It is now free to people in all 50 U.S. states to place a security freeze on their credit files. It is also free to do this for your partner and/or your dependents.

Freezing your credit means no one who doesn’t already have a financial relationship with you can view your credit file, making it unlikely that potential creditors will grant new lines of credit in your name to identity thieves. Freezing your credit file also means Experian and its brethren can no longer sell peeks at your credit history to others.

Anytime you wish to apply for new credit or a new job, or open an account at a utility or communications provider, you can quickly thaw a freeze on your credit file, and set it to freeze automatically again after a specified length of time.

Please don’t confuse a credit freeze (a.k.a. “security freeze”) with the alternative that the bureaus will likely steer you towards when you ask for a freeze: “Credit lock” services.

The bureaus pitch these credit lock services as a way for consumers to easily toggle their credit file availability with push of a button on a mobile app, but they do little to prevent the bureaus from continuing to sell your information to others.

My advice: Ignore the lock services, and just freeze your credit files already.

One final note. Frequent readers here will have noticed that I’ve criticized these so-called “knowledge-based authentication” or KBA questions that Experian’s website failed to ask as part of its consumer verification process.

KrebsOnSecurity has long assailed KBA as weak authentication because the questions and answers are drawn largely from consumer records that are public and easily accessible to organized identity theft groups.

That said, given that these KBA questions appear to be the ONLY thing standing between me and my Experian credit report, it seems like maybe they should at least take care to ensure that those questions actually get asked.

Read More