Scammers are looking to cash in on the chaos that has set in following the startling meltdowns of Silicon Valley Bank and Signature Bank and the crisis at Credit Suisse
The post Banking turmoil opens opportunities for fraud – Week in security with Tony Anscombe appeared first on WeLiveSecurity
from WeLiveSecurity https://ift.tt/EchI4rC
via IFTTT
The U.S. Federal Bureau of Investigation (FBI) this week arrested a New York man on suspicion of running BreachForums, a popular English-language cybercrime forum where some of the world biggest hacked databases routinely first show up for sale. The forum’s administrator “Pompompurin” has been a thorn in the side of the FBI for years, and BreachForums is widely considered a reincarnation of RaidForums, a remarkably similar crime forum that the FBI infiltrated and dismantled in 2022.
FBI agents carting items out of Fitzpatrick’s home on March 15. Image: News 12 Westchester.
In an affidavit filed with the District Court for the Southern District of New York, FBI Special Agent John Langmire said that at around 4:30 p.m. on March 15, 2023, he led a team of law enforcement agents that made a probable cause arrest of a Conor Brian Fitzpatrick in Peekskill, NY.
“When I arrested the defendant on March 15, 2023, he stated to me in substance and in part that: a) his name was Conor Brian Fitzpatrick; b) he used the alias ‘pompompurin/’ and c) he was the owner and administrator of ‘BreachForums the data breach website referenced in the Complaint,” Langmire wrote.
Pompompurin has been something of a nemesis to the FBI for several years. In November 2021, KrebsOnSecurity broke the news that thousands of fake emails about a cybercrime investigation were blasted out from the FBI’s email systems and Internet addresses.
Pompompurin took credit for that stunt, and said he was able to send the FBI email blast by exploiting a flaw in an FBI portal designed to share information with state and local law enforcement authorities. The FBI later acknowledged that a software misconfiguration allowed someone to send the fake emails.
In December, 2022, KrebsOnSecurity broke the news that hackers active on BreachForums had infiltrated the FBI’s InfraGard program, a vetted FBI program designed to build cyber and physical threat information sharing partnerships with experts in the private sector. The hackers impersonated the CEO of a major financial company, applied for InfraGard membership in the CEO’s name, and were granted admission to the community.
From there, the hackers plundered the InfraGard member database, and proceeded to sell contact information on more than 80,000 InfraGard members in an auction on BreachForums. The FBI responded by disabling the portal for some time, before ultimately forcing all InfraGard members to re-apply for membership.
More recently, BreachForums was the sales forum for data stolen from DC Health Link, a health insurance exchange based in Washington, D.C. that suffered a data breach this month. The sales thread initially said the data included the names, Social Security numbers, dates of birth, health plan and enrollee information and more on 170,000 individuals, although the official notice about the breach says 56,415 people were affected in the DC Health Link breach.
In April 2022, U.S. Justice Department seized the servers and domains for RaidForums, an extremely popular English-language cybercrime forum that sold access to more than 10 billion consumer records stolen in some of the world’s largest data breaches since 2015. As part of that operation, the feds also charged the alleged administrator, 21-year-old Diogo Santos Coelho of Portugal, with six criminal counts.
Coelho was arrested in the United Kingdom on Jan. 31, 2022. By that time, the new BreachForums had been live for just under a week, but with a familiar look.
BreachForums remains accessible online, and from reviewing the live chat stream on the site’s home page it appears the forum’s active users are only just becoming aware that their administrator — and the site’s database — is likely now in FBI hands:
Members of BreachForums discuss the arrest of the forum’s alleged owner.
“Wait if they arrested pom then doesn’t the FBI have all of our details we’ve registered with?” asked one worried BreachForums member.
“But we all have good VPNs I guess, right…right guys?” another denizen offered.
“Like pom would most likely do a plea bargain and cooperate with the feds as much as possible,” replied another.
Fitzpatrick could not be immediately reached for comment. The FBI declined to comment for this story.
There is only one page to the criminal complaint against Fitzpatrick (PDF), which charges him with one count of conspiracy to commit access device fraud. The affidavit on his arrest is available here (PDF).
from Krebs on Security https://ift.tt/OgHdJzj
via IFTTT
Scammers are looking to cash in on the chaos that has set in following the startling meltdowns of Silicon Valley Bank and Signature Bank and the crisis at Credit Suisse
The post Banking turmoil opens opportunities for fraud – Week in security with Tony Anscombe appeared first on WeLiveSecurity
from WeLiveSecurity https://ift.tt/EchI4rC
via IFTTT
How cybercriminals can exploit Silicon Valley Bank’s downfall for their own ends – and at your expense
The post SVB’s collapse is a scammer’s dream: Don’t get caught out appeared first on WeLiveSecurity
from WeLiveSecurity https://ift.tt/thp2Fjl
via IFTTT
How cybercriminals can exploit Silicon Valley Bank’s downfall for their own ends – and at your expense
The post SVB’s collapse is a scammer’s dream: Don’t get caught out appeared first on WeLiveSecurity
from WeLiveSecurity https://ift.tt/thp2Fjl
via IFTTT
By BY NICO GRANT
The Google-owned video platform became the latest of the big social networks to reverse the former president’s account restrictions.
Published: March 17, 2023 at 03:07PM
from NYT Technology https://ift.tt/IUbo50f
via IFTTT
PAHO seeks to strengthen regional avian influenza surveillance and response
Oscar Reyes
16 Mar 2023
from PAHO/WHO | Pan American Health Organization https://ift.tt/x3r4IzP
via IFTTT
PAHO Director meets the President of Panama
Oscar Reyes
17 Mar 2023
from PAHO/WHO | Pan American Health Organization https://ift.tt/qoJVU8t
via IFTTT
Despite its usually inflexible 0-day disclosure policy, Google is keeping four mobile modem bugs semi-secret due to likely ease of exploitation.
from Naked Security https://ift.tt/IuKXmVc
via IFTTT
Si se explotan, estas fallas pueden permitir a los atacantes obtener acceso no autorizado a información confidencial o, en general, causar problemas
(adsbygoogle = window.adsbygoogle || []).push({});
Los investigadores del equipo de Google Project Zero, dieron a conocer hace poco mediante una publicación de blog, el descubrimiento de 18 vulnerabilidades detectadas en los módems Samsung Exynos 5G/LTE/GSM.
Según los representantes de Google Project Zero, después de un poco de investigación adicional, los atacantes calificados podrán preparar rápidamente un exploit funcional que permita obtener el control de forma remota a nivel del módulo inalámbrico, conociendo solo el número de teléfono de la víctima. El ataque puede llevarse a cabo sin que el usuario lo perciba y no requiere que realice ninguna acción, lo que vuelve criticas algunas de las vulnerabilidades detectadas.
(adsbygoogle = window.adsbygoogle || []).push({});
Las cuatro vulnerabilidades más peligrosas (CVE-2023-24033) permiten la ejecución de código a nivel de chip de banda base a través de la manipulación de redes externas de Internet.
A fines de 2022 y principios de 2023, Project Zero informó dieciocho vulnerabilidades de día cero en los módems Exynos producidos por Samsung Semiconductor. Las cuatro más graves de estas dieciocho vulnerabilidades (CVE-2023-24033 y otras tres vulnerabilidades a las que aún no se les han asignado CVE-ID) permitieron la ejecución remota de código de Internet a banda base.
De las 14 vulnerabilidades restantes, se menciona que tienen un nivel de gravedad menor, ya que el ataque requiere acceso a la infraestructura del operador de red móvil o acceso local al dispositivo del usuario. Con la excepción de la vulnerabilidad CVE-2023-24033, cuya solución se propuso en la actualización de firmware de marzo para los dispositivos Google Pixel, los problemas siguen sin solucionarse.
Hasta el momento, lo único que se sabe sobre la vulnerabilidad CVE-2023-24033 es que está causada por una verificación incorrecta del formato del atributo «accept-type» transmitido en los mensajes SDP (Session Description Protocol ) .
(adsbygoogle = window.adsbygoogle || []).push({});
Las pruebas realizadas por Project Zero confirman que esas cuatro vulnerabilidades permiten que un atacante comprometa de forma remota un teléfono a nivel de banda base sin interacción del usuario, y solo requiere que el atacante conozca el número de teléfono de la víctima. Con investigación y desarrollo adicionales limitados, creemos que los atacantes expertos podrían crear rápidamente un exploit operativo para comprometer los dispositivos afectados de forma silenciosa y remota.
Las vulnerabilidades se manifiestan en dispositivos equipados con chips Samsung Exynos, según la información de los sitios web públicos que asignan conjuntos de chips a dispositivos, es probable que los productos afectados incluyan:
Hasta que los fabricantes solucionen las vulnerabilidades, se recomienda a los usuarios que deshabiliten la compatibilidad con VoLTE (Voice-over-LTE) y la función de llamada a través de Wi-Fi en la configuración. Desactivar estas configuraciones eliminará el riesgo de explotación de estas vulnerabilidades.
Debido al peligro de las vulnerabilidades y al realismo de la rápida aparición de un exploit, Google decidió hacer una excepción para los 4 problemas más peligrosos y posponer la divulgación de información sobre la naturaleza de los problemas.
Como siempre, alentamos a los usuarios finales a que actualicen sus dispositivos lo antes posible para asegurarse de que están ejecutando las últimas compilaciones que solucionan las vulnerabilidades de seguridad reveladas y no reveladas.
Para el resto de vulnerabilidades se seguirá el calendario de divulgación de detalles 90 días después de la notificación al fabricante (información sobre vulnerabilidades CVE-2023-26072, CVE-2023-26073, CVE-2023-26074, CVE-2023-26075 y CVE -2023-26076 ya está disponible en el sistema de seguimiento de errores y para los 9 problemas restantes, la espera de 90 días aún no ha vencido).
(adsbygoogle = window.adsbygoogle || []).push({});
Las vulnerabilidades reportadas CVE-2023-2607* son causadas por un desbordamiento de búfer al decodificar ciertas opciones y listas en los códecs NrmmMsgCodec y NrSmPcoCodec.
Finalmente, si estás interesado en poder conocer más al respecto puedes consultar los detalles en el siguiente enlace.
from Linux Adictos https://ift.tt/LPpc70U
via IFTTT
Pacosite's Blog 