Krebs on Security

NOVEMBER 26, 2019

The other three restaurants are all part of the same parent company and disclosed breaches in August 2019. Focus Brands (which owns Moe’s, McAlister’s, and Schlotzsky’s) was breached between April and July 2019, and publicly disclosed this on August 23. Krystal announced a card breach last month. percent worldwide.

Marketing 340

Marketing Cybercrime Retail Advertising 340

Schneier on Security

JANUARY 25, 2024

Since at least 2019, I have been saying that this is hard. Interesting article. I am also skeptical that we are going to see useful quantum computers anytime soon. And that we don’t know if it’s “land a person on the surface of the moon” hard, or “land a person on the surface of the sun” hard.

262

262

Krebs on Security

DECEMBER 8, 2020

Additionally, Microsoft released an advisory on how to minimize the risk from a DNS spoofing weakness in Windows Server 2008 through 2019. These vulnerabilities affect Microsoft Excel 2013 through 2019, Microsoft 365 32 and 64 bit versions, Microsoft Office 2019 32 and 64 bit versions, and Microsoft Excel for Mac 2019.”

DNS 306

DNS Backups Malware Software 306

Schneier on Security

FEBRUARY 15, 2021

In September 2019, another similar vulnerability was found being exploited by the same hacking group. More discoveries in November 2019, January 2020, and April 2020 added up to at least five zero-day vulnerabilities being exploited from the same bug class in short order. Microsoft issued a patch and fixed the flaw, sort of.

Technology 321

Technology Hacking Software 321

Krebs on Security

JULY 23, 2020

In May 2019, KrebsOnSecurity broke the news that the website of mortgage title insurance giant First American Financial Corp. billion in 2019. In August 2019, the company said a third-party investigation into the exposure identified just 32 consumers whose non-public personal information likely was accessed without authorization.

Insurance 323

Insurance Financial Services Penetration Testing Scams 323

Krebs on Security

JANUARY 28, 2020

In late December 2019, fuel and convenience store chain Wawa Inc. The fraud bazaar Joker’s Stash on Monday began selling some 30 million stolen payment card accounts that experts say have been tied back to a breach at Wawa in 2019. Representatives from MasterCard did not respond to requests for comment.

Retail 333

Retail Banking Malware Accountability 333

Schneier on Security

MARCH 8, 2021

In 2019, Mladenov et al. Interesting paper: “ Shadow Attacks: Hiding and Replacing Content in Signed PDFs “: Abstract: Digitally signed PDFs are used in contracts and invoices to guarantee the authenticity and integrity of their content. A user opening a signed PDF expects to see a warning in case of any modification.

Hacking 346

Hacking Authentication 346

Krebs on Security

SEPTEMBER 8, 2020

Among the chief concerns for enterprises this month is CVE-2020-16875 , which involves a critical flaw in the email software Microsoft Exchange Server 2016 and 2019. Security firm Tenable notes that this bug is reminiscent of CVE-2019-0604 , another Sharepoint problem that’s been exploited for cybercriminal gains since April 2019.

Software 277

Software Backups Authentication Internet 277

Schneier on Security

APRIL 29, 2021

According to the 2019 documentary La Traque de Rédoine Faïd , detective units scoured records of cell phones used during his escape, isolating a handful of numbers active at the time that went silent shortly thereafter.

Surveillance 252

Surveillance 252

Krebs on Security

OCTOBER 15, 2020

Q6Cyber CEO Eli Dominitz said the breach appears to extend from May 2019 through September 2020. Gemini puts the exposure window between July 2019 and August 2020. The NYU researchers found BriansClub earned close to $104 million in gross revenue from 2015 to early 2019, and listed over 19 million unique card numbers for sale.

Data breaches 361

Data breaches Cybercrime Retail Banking 361

Schneier on Security

FEBRUARY 1, 2021

If Georgia had still been using the paperless touchscreen DRE voting machines that they used from 2003 to 2019, then there would have been no paper ballots to recount, and no way to disprove the allegations that the election was hacked. That would have been a nightmare scenario.

Hacking 317

Hacking Software 317

Schneier on Security

JANUARY 17, 2023

No details , though: According to the complaint against him, Al-Azhari allegedly visited a dark web site that hosts “unofficial propaganda and photographs related to ISIS” multiple times on May 14, 2019.

Surveillance 347

Surveillance Media Hacking 347

Krebs on Security

JANUARY 12, 2021

In October 2019, SolarWinds pushed an update to their Orion customers that contained the modified test code. More worrisome, the research suggests the insidious methods used by the intruders to subvert the company’s software development pipeline could be repurposed against many other major software providers.

Software 327

Software Malware Government 327

Krebs on Security

AUGUST 10, 2021

The software giant warned that attackers already are pouncing on one of the flaws, which ironically enough involves an easy-to-exploit bug in the software component responsible for patching Windows 10 PCs and Windows Server 2019 machines. “In the case of ransomware attacks, they have also been used to ensure maximum damage.”

Software 326

Software Internet Internet Backups 326

Krebs on Security

MAY 18, 2020

Intel 471 says a rumor has been circulating on Exploit and other forums upO frequented that he was the mastermind behind GandCrab , another ransomware-as-a-service affiliate program that first surfaced in January 2018 and later bragged about extorting billions of dollars from hacked businesses when it closed up shop in June 2019.

Malware 322

Malware Cybercrime Ransomware Marketing 322

Schneier on Security

NOVEMBER 2, 2023

These latest warnings build on repeated instances of cyber intrusion and spyware usage, and highlights the surveillance impunity in India that continues to flourish despite the public outcry triggered by the 2019 Pegasus Project revelations.

Spyware 261

Spyware Surveillance Government 261

Krebs on Security

APRIL 10, 2020

Most people who who filed a tax return in 2018 and/or 2019 and provided their bank account information for a debit or credit should soon see an Economic Impact Payment direct-deposited into their bank accounts. Likewise, people drawing Social Security payments from the government will receive stimulus payments the same way.

Computers and Electronics 353

Computers and Electronics Banking Accountability Scams 353

Troy Hunt

MARCH 18, 2020

troyhunt #NDCLondon pic.twitter.com/wxzhM6uOCG — HarryMiller (@HarryMillerr) January 31, 2019 Scott and I have been doing these for a couple of years now, initially as a bit of a space-filler at NDC Security on the Gold Coast. pic.twitter.com/ypKONdzVmP — Troy Hunt (@troyhunt) July 1, 2019 It's fun. Such a fun talk!

Advertising 295

Advertising Media 295

Troy Hunt

MARCH 19, 2022

that's a link through to 1Password's Masked Email feature that leverages Fastmail, the video is a good primer) Sponsored by: CrowdSec - The open-source & collaborative IPS: respond to attacks & share signals across the community.

IoT 286

IoT 286

Schneier on Security

NOVEMBER 30, 2021

After planning began in mid-2018, the Long-Term Retention Lab was up and running in the second half of 2019. The warehouse stores around 3,000 pieces of hardware and software, going back about a decade.

Technology 285

Technology Engineering Software Cybersecurity 285

Troy Hunt

JANUARY 1, 2021

References NZBGeek reported a data breach (the sire is offline now and the Twitter thread suggests that it perhaps on the shadier side of copyright law) Thousands of Aussies have been targeted by Coronavirus scams (no surprises there really, and it certainly goes well beyond just Aussies) CafePress has copped a $2M settlement related to their 2019 (..)

Data breaches 326

Data breaches Password Management Scams Passwords 326

Schneier on Security

JULY 28, 2021

The Pillar says it obtained 24 months’ worth of “commercially available records of app signal data” covering portions of 2018, 2019, and 2020, which included records of Grindr usage and locations where the app was used.

Mobile 359

Mobile Advertising Data collection Surveillance 359

Krebs on Security

JULY 31, 2024

Back in 2019, KrebsOnSecurity wrote about thieves employing this method to seize control over thousands of domains registered at GoDaddy, and using those to send bomb threats and sextortion emails (GoDaddy says they fixed that weakness in their systems not long after that 2019 story).

DNS 279

DNS Internet Internet Phishing 279

Schneier on Security

SEPTEMBER 6, 2021

” “All products launched after 2019 randomize their MAC-addresses on a frequent basis as it has become the market standard to do so,” Gamborg says. Jens Bjørnkjær Gamborg, head of communications at Bang & Olufsen, says that “this is products that were launched several years ago.”

Wireless 280

Wireless Marketing Manufacturing Risk 280

Krebs on Security

NOVEMBER 3, 2020

Prosecutors say on June 26, 2019, “Bryan called the Baltimore County Police Department and falsely reported that he, purporting to be a resident of the Milleson family residence, had shot his father at the residence.” Interestingly, the conspiracy appears to have unraveled over a business dispute between the two men.

Scams 310

Scams Wireless Identity Theft Mobile 310

Schneier on Security

OCTOBER 1, 2021

The Wall Street Journal is reporting on a baby’s death at an Alabama hospital in 2019, which they argue was a direct result of the ransomware attack the hospital was undergoing. Attending obstetrician Katelyn Parnell texted the nurse manager that she would have delivered the baby by caesarean section had she seen the monitor readout.

Ransomware 286

Ransomware Hacking Accountability Healthcare 286

Troy Hunt

DECEMBER 23, 2023

K'gari / Fraser Island is just exceedingly beautiful (and now we need a bigger wall to put these photos up on 🤣) The Ubiquiti Dream Wall is a really sweet looking piece of kit (awesome solution to avoid having a full rack setup if you don't need it) I'll be back as NDC Oslo in June for the first time since 2019 (this is the event (..)

Mobile 244

Mobile Marketing 244

Krebs on Security

OCTOBER 13, 2020

Worst in terms of outright scariness is probably CVE-2020-16898 , which is a nasty bug in Windows 10 and Windows Server 2019 that could be abused to install malware just by sending a malformed packet of data at a vulnerable system. CVE-2020-16898 earned a CVSS Score of 9.8 (10 10 is the most awful).

Backups 337

Backups Malware Engineering Hacking 337

Krebs on Security

MARCH 25, 2020

Here’s a sobering statistic: According to PhishLabs , by the end of 2019 roughly three-quarters (74 percent) of all phishing sites were using SSL certificates. PhishLabs found this percentage increased from 68% in Q3 and 54% in Q2 of 2019.

Government 304

Government Phishing Encryption Scams 304

Krebs on Security

MAY 26, 2020

On March 31, 2019, police in Cancun, Mexico arrested 42-year-old Tudor and 37-year-old Adrian Nicholae Cosmin for the possession of an illegal firearm and cash totaling nearly 500,000 pesos (~USD $26,000) in both American and Mexican denominations.

Government 357

Government Media 357

The Last Watchdog

FEBRUARY 3, 2020

and Saudi Arabia have been steadily escalating for at least the past decade, with notable spikes in activity throughout the course of 2019. The report discloses a new strain of wiper malware, dubbed Dustman , found to be targeting entities within the Middle East through the course of 2019. As geopolitical tensions between the U.S.

Energy and Utilities 330

Energy and Utilities Malware Hacking Passwords 330

Krebs on Security

AUGUST 14, 2020

billion in 2019. R1 RCM Inc. NASDAQ:RCM ], one of the nation’s largest medical debt collection companies, has been hit in a ransomware attack. Formerly known as Accretive Health Inc. Chicago-based R1 RCM brought in revenues of $1.18

Ransomware 363

Ransomware Healthcare Insurance Phishing 363

Krebs on Security

MAY 13, 2024

The indictment against Khoroshev says he used the hacker nickname Putinkrab , and Intel 471 says this corresponds to a username that was first registered across three major Russian cybercrime forums in early 2019. A machine-translated ad for ransomware source code from Putinkrab on the Russian language cybercrime forum UFOlabs in 2019.

Ransomware 267

Ransomware Cybercrime Accountability Malware 267

Krebs on Security

AUGUST 13, 2021

Nick Bax is an independent expert in tracing cryptocurrency transactions, and he said it appears Antinalysis may be little more than a clone of AMLBot, an anti- anti-money laundering intelligence service that first came online in 2019. ET: Corrected the story to note that AMLBot has been around since 2019. ” Update, 1:42 p.m.

Cryptocurrency 332

Cryptocurrency Marketing Ransomware Financial Services 332

Security Affairs

MARCH 2, 2024

In October 2019, WhatsApp sued the Israeli surveillance firm NSO Group accusing it of carrying out malicious attacks against its users. In May 2019, Facebook patched a critical zero-day vulnerability in WhatsApp, tracked as CVE-2019-3568 , that has been exploited to remotely install spyware on phones by calling the targeted device.

Spyware 142

Spyware Surveillance Architecture Software 142

Krebs on Security

APRIL 26, 2021

The first question asked about a new mortgage I supposedly took out in 2019 (I didn’t), and the answer was none of the above. Also in 2019, identity thieves were able to get a copy of my credit report from TransUnion after successfully guessing the answers to multiple-guess questions like the ones Experian asks.

Authentication 343

Authentication Accountability Identity Theft Account Security 343

Krebs on Security

JULY 13, 2020

3, 2019, Data Viper’s Twitter account casually noted , “FiveStars — 44m breached records added – incl Name, Email, DOB.” On Oct 12, 2019, a new user named Exabyte registered on RaidForums — a site dedicated to sharing hacked databases and tools to perpetrate credential stuffing attacks. But on Aug.

Hacking 353

Hacking Marketing Cybercrime Accountability 353