I have been writing about Internet security related stories for the past two decades, and maintain a daily blog on computer security and cybercrime at KrebsOnSecurity.com. 

I was a reporter for The Washington Post from 1995 - 2009. I have a broad degree of knowledge about and interest in a range of Internet security topics. My main professional goal is to make the important computer security issues understandable, interesting, and timely for readers. My stories focus mainly on computer crime, and on the cybercrime underground.

Call me old fashioned, but this kind of sleazebaggery pisses me off. Fair warning: I'm apt to call out any company that sends me something like this.

Brian Krebs

Investigative reporter, krebsonsecurity.com

BleepingComputer says Crowdstrike has confirmed that an "insider" was caught sharing screenshots taken on internal systems. Bleeping reports that those ended up in the hands of Scattered Lapsus$ Hunters.

https://lnkd.in/etQNkbtM

I'm guessing someone at Crowdstrike was responding to the group's recent posts on Telegram, where they said they were buying insider access to large companies. The non-aggression carveout for the DPRK, PRC, RU and Belarus is a hoot. Here's the text of one recent solicitation from the criminal hacking group:

"DM us to sell your IA on % locking with all major lockers depending on target; must be ready to run AD commands or Okta commands, or show /etc/openldap/ldap.conf /var/log and ip -a addr && ssh -i /home/$$/.ssh/*pem $$@(ip addr ip's) or anything else you find relevant to showing us

Rules:
- no companies under 500M revenue
- no RF/PRC/DPRK/Belarus companies

IA rates:
25% for any AD joined system.
10% for Okta, Azure portal, AWS IAM root, etc

were also recruiting employees/insider at the following!!!!

- Any company providing Telecommunications (Claro, Telefoinica, ATT, and other similar)
- Large software/gaming corporations (Microsoft, Apple, EA, IBM, other similar)
- Callcenter/BPM (Atento, Teleperformance, and other similar)
- Server hosts (OVH, Lcaweb, and other similar)

If you are not sure if you are needed then send a DM and we will respond!!!!
If you are not a employee here but have access such as VPN or VDI then we are still interested!!

You will be paid if you would like. Contact us to discuss that"

Open article: CrowdStrike catches insider feeding information to hackers by bleepingcomputer.com

CrowdStrike catches insider feeding information to hackers

Chatting with a friend about Cloudflare's intermittent outages today, they brought up an interesting point: How many organizations have started relying on Cloudflare to do basic security blocking and tackling stuff, like stopping SQL injection attacks at the edge? Maybe your devs were lazy at blocking this stuff in the past b/c CF was the control layer to compensate for that.

You might say well okay but if CF is down, so are the sites relying on them, and that's true. But a lot of organizations will switch CF off during these times to keep their sites and services reachable and running. And my friend's point was that for those organizations, they might want to take a closer look at the traffic they received during this eight-hour outage window or whatever, and I think that's sound advice.

BTW, Cloudflare is saying the "root cause" of the outage was an automatically generated configuration file used to manage threat traffic that "grew beyond an expected size of entries," which triggered a crash in the software system that handles traffic for several of its services.

https://lnkd.in/eVJy5XRE

Scoopy, new, by me:

"A prolific cybercriminal group that calls itself “Scattered LAPSUS$ Hunters” has dominated headlines this year by regularly stealing data from and publicly mass extorting dozens of major corporations. But the tables seem to have turned somewhat for “Rey,” the moniker chosen by the technical operator and public face of the hacker group: Earlier this week, Rey confirmed his real life identity and agreed to an interview after KrebsOnSecurity tracked him down and contacted his father."

Open article: Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’ by krebsonsecurity.com

Meet Rey, the Admin of ‘Scattered Lapsus$ Hunters’

Social engineering -- the art of tricking people into doing stupid shit -- has always been the most reliable way to hack anything. Now with AI browsers and agentic this and that, we've actually built social engineering into the code. So it can be used to trick others but also trick itself. Brilliant!

Pete Hegseth is urging members of the military to embrace GenAI.mil, a "secure generative AI platform for every member of the Department of War." I'm sure this will be fine.

"I expect every member of the Department to log in, learn it, and incorporate it into your workflows immediately. AI should be in your battle rhythm every single day. It should be your teammate. By mastering this tool, we will outpace our adversaries. The power is now in your hands."

I wonder who came up with their logo, which looks like a worm invading the Pentagon.

I'm proud that my Senator Mark Warner (D-Va) is consistently one of the smartest voices on cybersecurity in Congress. Warner took to the Senate floor today to warn about political purges at the FBI, and the apparent collapse of U.S. cyber defenses under this administration.

"I intend to continue making these speeches… for as long as it takes… because the stakes for our national security are too high to let this pattern go unchallenged."

"Since my remarks in September, we’ve seen not restraint, but an escalation… an escalation of political retaliation, of the hollowing out of expertise, and of the outright manipulation of intelligence. We are watching, in real time, an administration strip away the guardrails that have protected this country for generations."

https://lnkd.in/eJMDR_Rm

I always wince a little when I see graphs and charts on the homepage of some news outlet, but this one was really well done and conveyed a lot of interesting and timely information in very few words. https://lnkd.in/ea-j247b

New, by me: The Cloudflare Outage May Be a Security Roadmap

An intermittent outage at Cloudflare on Tuesday briefly knocked many of the Internet’s top destinations offline. Some affected Cloudflare customers were able to pivot away from the platform temporarily so that visitors could still access their websites. But security experts say doing so may have also triggered an impromptu network penetration test for organizations that have come to rely on Cloudflare to block many types of abusive and malicious traffic.

https://lnkd.in/eJBH-Fd3

This sounds ominous. Is Gainsight the next Salesloft-type incident? Sure sounds like it. From Salesforce:

Security Advisory: Unusual Activity Related to Gainsight Applications
 
"Salesforce has identified unusual activity involving Gainsight-published applications connected to Salesforce, which are installed and managed directly by customers. Our investigation indicates this activity may have enabled unauthorized access to certain customers’ Salesforce data through the app’s connection."

"Upon detecting the activity, Salesforce revoked all active access and refresh tokens associated with Gainsight-published applications connected to Salesforce and temporarily removed those applications from the AppExchange while our investigation continues."

'There is no indication that this issue resulted from any vulnerability in the Salesforce platform. The activity appears to be related to the app’s external connection to Salesforce."

"We have notified known affected customers directly and will continue to provide updates as appropriate. Customers who need assistance can reach us through Salesforce Help"

https://lnkd.in/ewQ_K85n

New, by me: Is your Android TV streaming box part of a botnet?

"On the surface, the Superbox media streaming devices for sale at retailers like BestBuy and Walmart may seem like a steal: They offer unlimited access to more than 2,200 pay-per-view and streaming services like Netflix, ESPN and Hulu, all for a one-time fee of around $400. But security experts warn these TV boxes require intrusive software that forces the user’s network to relay Internet traffic for others, traffic that is often tied to cybercrime activity such as advertising fraud and account takeovers."

The story looks closely at what Superbox is, how it operates, and what it appears to do on the sly. Spoiler: A Censys researcher found that installing the apps that allow these channels to stream enrolls the user's IP in a residential proxy service, and that these devices include powerful network discovery and remote access tools like Tcpdump and Netcat.

Overall, the Superbox is just one brand in an ocean of no-name Android-based TV boxes that are widely available and that either come pre-infected with malware or require malicious apps to use. 

https://lnkd.in/eEZHrmnd

The Federal Communications Commission (FCC) is meeting right now to vote on a proposal to scrap cyber rules that the FCC began adopting during the Biden administration.

https://lnkd.in/e9cHadnz

"The commission first declared that the 1994 Communications Assistance for Law Enforcement Act (CALEA) “affirmatively requires telecommunications carriers to secure their networks from unlawful access or interception of communications,” and then it proposed specific requirements that telecoms should have to meet."

Pay no mind to the fact that the FBI recently warned the public away from sharing sensitive information over the public telephone networks because they are all so completely owned by state-sponsored hackers from China that they should not be trusted. 

Also, try to ignore the fact that CALEA data is exactly what the Chinese hackers succeeded in gaining access to, including call and text message metadata.

What's clear is that what we've been doing to encourage telcos to care more about prioritizing security is not working at all. That said, they have shown through their actions that they're not going to do it on their own.

https://lnkd.in/eNBAKJSJ

The data broker industry is losing their minds over more than 150+ lawsuits filed against them by Atlas Data Privacy for alleged violations of Daniel's Law. The NJ statute gives law enforcement in that state special rights to have their personal information redacted from data broker and people-search services. The law specifically allows for non-trivial financial damages for each violation, and Atlas is seeking relief on behalf on >20k NJ residents.

And now in the face of intense lobbying by the data broker industry, NJ lawmakers are proposing to weaken Daniel's Law. The proposed changes "would remove covered individuals’ ability to select an assignee to sue to enforce Daniel’s Law on their behalf, and it would give judges discretion to award damages in such cases. Those awards are mandatory under existing law."

https://lnkd.in/eqespk-n

Want to read more about how Daniel's Law is being used to turn the screws to data brokers who traffic in mobile ad data? See this story:

https://lnkd.in/gJ_TdHxb

krebsonsecurity.com

The Global Surveillance Free-for-All in Mobile Ad Data

Jenifer McIntosh, CIPP/US

New, by me: 

Drones to Diplomas: How Russia's Largest Private University is Linked to a $25M Essay Mill

A sprawling academic cheating network turbocharged by Google Ads that has generated nearly $25 million in revenue has curious ties to a Kremlin-connected oligarch whose Russian university builds drones for Russia’s war against Ukraine.

https://lnkd.in/ekFX7yYu

New, by me: SMS Phishers Pivot to Points, Taxes, Fake Retailers

China-based phishing groups blamed for non-stop scam SMS messages about a supposed wayward package or unpaid toll fee are promoting a new offering, just in time for the holiday shopping season: Phishing kits for mass-creating fake but convincing e-commerce websites that convert customer payment card data into mobile wallets from Apple and Google. Experts say these same phishing groups also are now using SMS lures that promise unclaimed tax refunds and mobile rewards points.

https://lnkd.in/eqFgUY4x

In March 2024, Mozilla said it was winding down its collaboration with Onerep — an identity protection service offered with the Firefox web browser that promises to remove users from hundreds of people-search sites — after KrebsOnSecurity revealed Onerep’s founder had created dozens of people-search services and was continuing to operate at least one of them. Sixteen months later, however, Mozilla is still promoting Onerep. This week, Mozilla announced its partnership with Onerep will officially end next month.

https://lnkd.in/ee4Rznqb

taplio

Brian Krebs's Linkedin Analytics

Brian Krebs

Performance ScoreBrian Krebs's LinkedIn Performance

What is Brian talking about?

Brian Krebs's Best Posts (last 30 days)

Ready to grow your LinkedIn presence?

taplio

.css-6ytdur{background-image:linear-gradient(284deg, rgba(39, 43, 72, 1) 0%, rgba(33, 47, 183, 1) 100%);color:transparent;-webkit-background-clip:text;background-clip:text;}Brian Krebs's Linkedin Analytics

Brian Krebs

Performance Score.css-goub6s{font-size:var(--chakra-fontSizes-md);font-weight:500;color:var(--chakra-colors-gray-600);display:block;margin-top:var(--chakra-space-1);}Brian Krebs's LinkedIn Performance

What is Brian talking about?

Brian Krebs's Best Posts .css-1emoo84{font-size:var(--chakra-fontSizes-md);font-weight:400;color:var(--chakra-colors-gray-600);}(last 30 days)

Ready to grow your LinkedIn presence?

Brian Krebs's Linkedin Analytics

Performance ScoreBrian Krebs's LinkedIn Performance

Brian Krebs's Best Posts (last 30 days)