BrianKrebs

Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07
krebsonsecurity @ gmail .com
Linkedin: https://www.linkedin.com/in/bkrebs

website: https://krebsonsecurity.com

Public Key

npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh

NIP-05 Address

briankrebs_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsxvgjseexsxl0ppxny56szxrmcn8uj9dmrgcugk0nu5ph7jjgrtrgprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntwxa0sy

Publishing to

relay.momostr.pink

Author Public Key

npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh

Show more details

Last Notes

2026-06-13 17:23:57 UTC

There was an important court decision last week in a lawsuit filed by 20 states to halt the Trump administration's arbitrary new requirements for distributing food assistance funds to 39 million families that depend on these benefits. On June 5, a federal judge blocked the administration from enforcing new conditions on billions of dollars in federal nutrition funding, siding with a coalition of Democratic-led states that argued the requirements threatened programs serving low-income families.
"According to court filings, the disputed conditions included provisions related to immigration, "gender ideology" and "fair athletic opportunities" for women and girls. The states argued the requirements were vague, unrelated to nutrition and agriculture programs, and imposed without proper legal procedures."
https://www.usatoday.com/story/news/politics/2026/06/06/judge-halts-trump-snap-restrictions-in-states-lawsuit-over-funding-rules/90438543007/
I've written multiple stories about these Supplemental Nutrition Assistance Program (SNAP) benefits, from the perspective of them being stolen by card skimming devices secretly installed at checkout counters and random places. In the past, the states have struggled to get the federal government to reimburse them for these fraud costs, which are disproportionately caused by organized crime groups, particularly Armenian and Romanian gangs that have a significant presence in the US. Now the states are struggling to get these benefits funded at all. But the skimming threat hasn't gone away, because while some state benefits cards do now have chips on them, many still allow the cards to be swiped.
Previous reporting on this:
https://krebsonsecurity.com/2022/10/how-card-skimming-disproportionally-affects-those-most-in-need/
https://krebsonsecurity.com/2023/02/new-protections-for-food-benefits-stolen-by-skimmers/
https://krebsonsecurity.com/2022/11/lawsuit-seeks-food-benefits-stolen-by-skimmers/

2026-05-25 19:05:57 UTC

Nature hikes 101: Leave your headphones behind. Was hiking a trail today and heard a sickening CRACK directly above and saw an enormous tree limb starting to fall directly down on top of me. Literally dove out of the way and got splinters in my face when the thing crashed down. I probably would not be typing this if I'd been obliviously hiking along w/ my headphones on (which I'll admit I do from time to time).

2026-05-25 14:58:04 UTC

So, I guess now that Google has officially shit the bed w/ their AI search, this is going to be my new browser start page from now on.
https://udm14.org/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/635/796/859/443/674/original/ea93a3dcba81cd37.png

2026-05-18 20:55:23 UTC

New, by me: CISA Admin Leaked AWS GovCloud Keys on GitHub
Until this past weekend, a contractor for the Cybersecurity & Infrastructure Security Agency (CISA) maintained a public GitHub repository that exposed credentials to several highly privileged AWS GovCloud accounts and a large number of internal CISA systems. Security experts said the public archive included files detailing how CISA builds, tests and deploys software internally, and that it represents one of the most egregious government data leaks in recent history.
https://krebsonsecurity.com/2026/05/cisa-admin-leaked-aws-govcloud-keys-on-github/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/597/563/541/512/344/original/8f9a823d2ae9bc9c.png

2026-05-12 22:15:20 UTC

I had a daydream today where I imagined an AI dystopian future where AI models are "doxing" each other by pointing out live zero-days in each others' platforms. I'm not sure this is as sci-fi as it sounds.

2026-05-12 20:08:04 UTC

We've come to an icky time in security when the concern about using outdated, unpatched software starts to become overshadowed by the fear of downloaded some backdoored update.

2026-05-08 03:07:06 UTC

New, from me: Canvas Breach Disrupts Schools and Colleges Nationwide
"An ongoing data extortion attack targeting the widely-used education technology platform Canvas disrupted classes and coursework at school districts and universities across the United States today, after a cybercrime group defaced the service’s login page with a ransom demand that threatened to leak data from 275 million students and faculty across nearly 9,000 educational institutions."
"Canvas parent firm Instructure [NYSE:INST] responded to today's defacement attacks by disabling the platform, which is used by thousands of schools, universities and businesses to manage coursework and assignments, and to communicate with students."
Lots more here:
https://krebsonsecurity.com/2026/05/canvas-breach-disrupts-schools-colleges-nationwide/
#canvas #breach #shinyhunters #instructure
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/536/721/932/019/959/original/a4d51ec80caca497.png

2026-04-15 15:53:58 UTC

If my attention span was any shorter today

2026-04-14 21:55:29 UTC

ZOMG! It's freakin Patch Tuesday again. And Microsoft has patched a staggering 167 security holes (think more people are using AI to find bugs, maybe?)
tl;dr: There's something for everyone today, like an Adobe Reader 0day that's apparently been exploited since at least November 2025; a SharePoint zero-day; and a fix for BlueHammer, and a Windows Defender bug for which there is working exploit code that no longer works if you install today's Windows updates (as per @npub12xh…zxeq).
https://krebsonsecurity.com/2026/04/patch-tuesday-april-2026-edition/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/405/281/966/806/831/original/f61414859dc60aae.png

2026-04-13 16:21:12 UTC

- reply

Seems like good for the consumer, but also good for fraudsters, no?

2026-04-07 18:10:02 UTC

New, from me: Hackers linked to Russia’s military intelligence units are using known flaws in older Internet routers to mass harvest authentication tokens from Microsoft Office users, security experts warned today. The spying campaign allowed state-backed Russian hackers to quietly siphon authentication tokens from users on more than 18,000 networks without deploying any malicious software or code.
https://krebsonsecurity.com/2026/04/russia-hacked-routers-to-steal-microsoft-office-tokens/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/364/757/985/763/964/original/4111e74f07ee59bf.png

2026-03-11 16:24:45 UTC

Breaking, new, by me: Iran-backed Hackers Claim Wiper Attack on Medtech Firm Stryker
A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker's largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S. headquarters says the company is currently experiencing a building emergency.
From the story:
"Wiper attacks usually involve malicious software designed to overwrite any existing data on infected devices. But a trusted source with knowledge of the attack who spoke on condition of anonymity told KrebsOnSecurity the perpetrators in this case appear to have used a Microsoft service called Microsoft Intune to issue a ‘remote wipe’ command against all connected devices."
"Intune is a cloud-based solution built for IT teams to enforce security and data compliance policies, and it provides a single, web-based administrative console to monitor and control devices regardless of location. The Intune connection is supported by this Reddit discussion on the Stryker outage, where several users who claimed to be Stryker employees said they were told to uninstall Intune urgently."
https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/
#stryker #handala #intune #wiper #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/211/464/307/859/938/original/3d348cfab9495ad4.png

2026-02-23 20:13:01 UTC

Lol, most of these impressions were on a post I made about why you maybe shouldn't verify your LinkedIn account.
https://infosec.exchange/@briankrebs/116103192779110422
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/121/765/448/702/843/original/6b0533bf2483e729.png

2026-02-21 14:04:45 UTC

- reply

The CEO of Persona responded to this post, saying they wanted to clarify about the identity verification process. They said:
"The only subprocessors (8) used are: AWS, Confluent, DBT, ElasticSearch, GCP, MongoDB, Sigma Computing, and Snowflake
All biometric personal data is deleted immediately after processing.
All other personal data processed is automatically deleted within 30 days. Data is retained during this period to help users troubleshoot.
No personal data processed is used for AI/model training. Data is explicitly used to confirm your identity.
The subprocessors used do NOT include Anthropic, Groqcloud, or OpenAI. The referenced subprocessor list is the superset of subprocessors used across all customers which is unfortunately misleading - we are updating our documentation to make this clearer going forward (thank you for helping us realize this). Our customers select which products are used which determines which subprocessors are used."

2026-02-11 18:19:27 UTC

Thank goodness the Federal Aviation Administration is still able to do its job and be the adult in the room. For now, anyway. How long until the Cheetoh in Chief starts grounding planes in blue states for the rebuke?
From CBS News:
"The unexpected but brief airspace closure in the Texas border city of El Paso stemmed from disagreements between the Federal Aviation Administration and Pentagon officials over drone-related tests, multiple sources close to the matter told CBS News. "
"The Pentagon had undertaken extensive planning on the use of military technology near Fort Bliss, a military base that abuts the El Paso International Airport, to practice taking down drones."
"Two sources identified the technology as a high-energy laser."
"Meetings were scheduled over safety impacts, but Pentagon officials wanted to test the technology sooner, stating that U.S. Code 130i requirements governing the protection of certain facilities from unmanned aircraft had been met."
"FAA Administrator Bryan Bedford on Tuesday night decided to close the airspace — without alerting White House, Pentagon or Homeland Security officials, sources said."
https://www.cbsnews.com/news/airspace-closure-followed-spat-over-drone-related-tests-and-party-balloon-shoot-down-sources-say/

2026-01-26 17:10:54 UTC

We knew this was coming, but now the clock is running. From Privacy International:
"Yesterday the Trump Administration announced a proposed change in policy for travellers to the U.S. It applies to the powers of data collection by the Customs and Border Police (CBP)."
"If the proposed changes are adopted after the 60-day consultation, then millions of travellers to the U.S. will be forced to use a U.S. government mobile phone app, submit their social media from the last five years and email addresses used in the last ten years, including of family members. They’re also proposing the collection of DNA."
PI linked to and summarized a Federal Register entry describing the proposed requirements:
-All visitors must submit ‘their social media from the last 5 years’
-ESTA (Electronic System for Travel Authorization) applications will include ‘high value data fields’, ‘when feasible’
‘telephone numbers used in the last five years’
-‘email addresses used in the last ten years’
-‘family number telephone numbers (sic) used in the last five years’
-biometrics – face, fingerprint, DNA, and iris
-business telephone numbers used in the last five years
-business email addresses used in the last ten years.
https://www.privacyinternational.org/news-analysis/5713/trump-administration-wants-your-dna-and-social-media
The Federal Register entry says comments are encouraged and
must be submitted (no later than
February 9, 2026) to be assured of
consideration
Federal Register entry: https://www.govinfo.gov/content/pkg/FR-2025-12-10/pdf/2025-22461.pdf

2026-01-02 15:55:02 UTC

From the Financial Times:
"Australia’s largest pension fund is planning to reduce its allocation to global equities next year, amid signs that the artificial intelligence boom in the US stock market could be running out of steam."
"John Normand, head of investment strategy at the A$400bn (US$264bn) AustralianSuper, told the Financial Times that not only did valuations of big US tech companies look high relative to history, but the leverage being used to fund AI investment was increasing “very rapidly”, as was the pace of fundraising through mergers, venture capital and public listings."
“I can see some forces lining up that we are looking for less public equity allocation at some point next year. It’s the basic intersection of the maturing AI cycle with a shift towards Fed[eral Reserve] tightening in 2027,” Normand said in an interview.
https://archive.is/hru63

2025-12-11 16:14:03 UTC

Pete Hegseth is urging members of the military to embrace GenAI.mil, a "secure generative AI platform for every member of the Department of War." I'm sure this will be fine.
"I expect every member of the Department to log in, learn it, and incorporate it into your workflows immediately. AI should be in your battle rhythm every single day. It should be your teammate. By mastering this tool, we will outpace our adversaries. The power is now in your hands."
I wonder who came up with their logo, which looks like a worm invading the Pentagon.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/701/807/309/719/661/original/3ca553a68c6baf33.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/701/816/131/134/999/original/7f3cf1e2e25110a3.png

2025-09-24 13:04:50 UTC

New, by me: Feds Tie 'Scattered Spider' Duo to $115 million in Ransoms
'U.S. prosecutors last week levied criminal hacking charges against 19-year-old U.K. national Thalha Jubair for allegedly being a core member of Scattered Spider, a prolific cybercrime group blamed for extorting at least $115 million in ransom payments from victims. The charges came as Jubair and an alleged co-conspirator appeared in a London court to face accusations of hacking into and extorting several large U.K. retailers, the London transit system, and healthcare providers in the United States."
Today's story is an account of cybercrime activities that prosecutors have attributed to Jubair’s alleged hacker handles, as told by those accounts in posts to public Telegram channels that are closely monitored by multiple cyber intelligence firms. The story shows how these hacker handles started selling their services and access to companies on the Russian-language cybercrime forum Exploit. Barely a year later, Scattered Spider would take credit for the ransom attacks that shut down MGM and Caesars in Las Vegas. Many more ransom attacks from the group would follow.
"At around the same time in the Summer of 2022, at least two different accounts tied to Star Chat — “RocketAce” and “Lopiu” — introduced the group’s services to denizens of the Russian-language cybercrime forum Exploit, including:
-SIM-swapping services targeting Verizon and T-Mobile customers;
-Dynamic phishing pages targeting customers of single sign-on providers like Okta;
-Malware development services;
-The sale of extended validation (EV) code signing certificates.
https://krebsonsecurity.com/2025/09/feds-tie-scattered-spider-duo-to-115m-in-ransoms/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/259/358/423/937/738/original/d606e6ea28bb54fb.png

2025-09-16 15:55:59 UTC

- reply

Oh wait, nevermind. I see quotes are disabled right now, although there is a greyed out button there.

2025-09-12 15:36:23 UTC

So this is pretty funny. I published a story yesterday about how European sanctions against a huge source of Kremlin-linked disinformation and cyberattacks -- Stark Industries Solutions -- largely fizzled b/c the people running it just rebranded and transferred its assets to other companies they already controlled.
Anyway, I've been getting a raft of comments from what appear to be bots on IPs belonging to PQ Hosting, one of the two main conduits for Stark's new home. They're all clearly bot accounts leaving mostly positive reviews like, "I didn't know they were so bad. They cut me a deal on several months service" or something to the effect "yeah but their service is cheap and reliable." I guess since they didn't respond to requests for comment these are quite literally their comments. I binned most of them but left a few.
https://krebsonsecurity.com/2025/09/bulletproof-host-stark-industries-evades-eu-sanctions/

2025-09-09 19:13:15 UTC

Alternative headline: Biggest purveyor of bullshit machines complains there's too much bullshit on the interwebs.
https://techcrunch.com/2025/09/08/sam-altman-says-that-bots-are-making-social-media-feel-fake/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/175/924/180/214/712/original/9ec3bc0288b2081d.png

2025-09-04 18:52:52 UTC

- reply

The one I'm playing is called Set Mania

2025-08-26 17:46:36 UTC

Let's face it: Social media is a voluntary, emotional and logical roller coaster. It's okay to step off the ride every once in a while. Some days, you are not tall enough for the ride anyhow.
It's easy to slip unconsciously into the idea that your people, your community needs you, needs your feet ready to go at the hamster wheel at a moment's notice. That's also how you know it's time to let someone else drive the wheel for a while.
#fucksocialmedia #readabook #takeahike #makeafriendirl

2025-08-13 23:08:02 UTC

...aaand that's about all a Subway sandwich is good for anyway
http://nytimes.com/2025/08/13/us/politics/federal-agent-trump-sandwich-dc.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/023/965/221/936/668/original/0c890448954e48c5.png

2025-07-21 15:26:22 UTC

I'm seeing an unusually large number of phishous and mailicious messages landing in my inbox today. Granted, it's always hard to know if an uptick is related to an increase in malicious attacks or just more bad stuff figuring out how to bypass spam and malware filters. I can say, though, that most of these that made it to my inbox today are the kind that I would normally have to fish out of the spam folder. Be careful out there folks.

2025-06-03 13:16:36 UTC

Managed to burn several layers of skin off both of my thumbs recently (through thick gloves while holding a very hot steam hose). It's been three weeks now that biometric (thumb) authentication for all my devices stopped recognizing my hamburger thumbs, which are so covered in crusty new and old layers of skin that texting feels like I've got cleats on my thumbs. Fun times.

2025-05-23 00:55:52 UTC

- reply

No argument. I am somewhat stumped however by the number of regular internet users who have bought into the idea that they somehow need to VPN all their traffic. I do that for this connection and for lots of stuff that I'd rather not have my IP known for, but I won't put up for it in a lot of regular use cases.

2025-05-15 15:21:49 UTC

- reply

Weirdly, this story appears to now be buried in Google. If you search on the headline in Google (Pakistani Firm Shipped Fentanyl Analogs, Scams to US) you will see tons of places linking to my story, and you will see tags from the story. I don't see this behavior for any other story of mine on the homepage of KrebsOnSecurity.com now. But the story itself has been buried in Google's search. Gee, I wonder how that happened?

2025-05-11 20:10:09 UTC

Two thumbs up for the juxtaposition of these stories.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/491/007/493/145/348/original/523d1d19033ac179.png

2025-05-07 12:35:56 UTC

A+ trolling by Harvard.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/466/571/289/448/814/original/7f85a64c6373fe20.jpg

2025-05-05 16:29:41 UTC

Enjoyed this post from Malwarebytes about how AI is getting creepy good at guessing the geo-location of photos/videos by analyzing the tiniest of clues.
When analyzing videos with audio, e.g., apparently just having a few birds chirping in the background can be enough to make a strong guess about where the video was recorded.
https://www.malwarebytes.com/blog/news/2025/04/ai-is-getting-creepy-good-at-geo-guessing?utm_source=iterable&utm_medium=email&utm_campaign=b2c_pro_oth_20250505_mayweeklynewsletter_v1_174617365504&utm_content=AI

2025-04-20 12:19:20 UTC

- reply

While this may sound like a tempting idea for a president that simultaneously rails against and thrives on media coverage, that's not a wise move, and one that would ultimately hurt Americans and help the administration.

2025-04-16 21:33:59 UTC

Another area where the POTUS is setting up a constitutional challenge with the judicial branch:
"The Associated Press said in a court filing on Wednesday that the Trump administration had defied a federal judge’s order requiring the administration to restore the wire service’s full access to the White House."
"Lawyers for the The A.P. wrote that a White House spokesman had told A.P. reporters on Monday that they would continue to be excluded from the press pool — a small, rotating group of journalists who cover certain events in confined spaces at the White House — because the “case is ‘ongoing.’”
"For the last two months, The A.P.’s access to President Trump has been sharply curtailed over its refusal to refer to the Gulf of Mexico as the Gulf of America, the name that Mr. Trump designated for the body of water."
"In a temporary order last week, Judge Trevor N. McFadden of the Federal District Court in Washington, D.C., said the exclusion violated the First Amendment’s free-speech clause and instructed the White House to restore The A.P.’s access “immediately.”
https://www.nytimes.com/2025/04/16/us/politics/trump-ap-white-house-access.html

2025-04-16 15:33:53 UTC

Hey Parallels, thanks for giving me a heart attack this morning. Why are you asking to connect to an "account" page at account.parallels.cn"?? That's a nope. Thank goodness for Little Snitch firewall. Found exactly one discussion thread about this in an online search, and there were no responses except "yeah, I had the same question."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/348/358/180/198/650/original/72e81d9a9a0c62c5.png

2025-04-16 14:53:51 UTC

Yeah, because this is totally normal. Martin likes to fire off nastygrams to people and organizations that criticize the POTUS.
"Trump’s D.C. U.S. attorney pick appeared on Russian state media over 150 times
Trump nominee Ed Martin’s 100-plus appearances on Russian state-directed media RT and Sputnik from 2016 to 2024 alarm some former national security officials."
https://www.washingtonpost.com/dc-md-va/2025/04/16/ed-martin-rt-sputnik-usattorney/
Meanwhile, on April 14, a group of former federal prosecutors urged the DC Court of Appeals to pursue a disciplinary investigation of Martin for making public statements suggesting he was criminally investigating perceived political enemies of himself and the president.
https://societyfortheruleoflaw.org/ed-martin-complaint/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/348/206/544/738/868/original/b349c748bb77cfcf.png

2025-04-16 04:03:30 UTC

- reply

Finally put together a proper story on this funding debacle for MITRE's CVE program.
"A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization MITRE warned today that its contract to maintain the Common Vulnerabilities and Exposures (CVE) program -- which is traditionally funded each year by the Department of Homeland Security -- expires on April 16."
https://krebsonsecurity.com/2025/04/funding-expires-for-key-cyber-vulnerability-database/

2025-04-15 22:21:37 UTC

Wow. The tech and NASDAQ giant NVIDIA's shares have tanked in after hours trading, down 7 percent right now. Might have something to do with this disclosure:
"On April 9, 2025, the U.S. government, or USG, informed NVIDIA Corporation, or the Company, that the USG requires a license for export to China (including Hong Kong and Macau) and D:5 countries, or to companies headquartered or with an ultimate parent therein, of the Company's H20 integrated circuits and any other circuits achieving the H20's memory bandwidth, interconnect bandwidth, or combination thereof. The USG indicated that the license requirement addresses the risk that the covered products may be used in, or diverted to, a supercomputer in China. On April 14, 2025, the USG informed the Company that the license requirement will be in effect for the indefinite future.
The Company's first quarter of fiscal year 2026 ends on April 27, 2025. First quarter results are expected to include up to approximately $5.5 billion of charges associated with H20 products for inventory, purchase commitments, and related reserves."
Expect an extra wild ride on Wall Street when the bell rings tomorrow.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/344/297/980/307/698/original/e90d30e67197ea22.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/344/304/922/387/721/original/c0c19ccf19298f85.png

2025-04-15 21:58:13 UTC

- reply

See my updates. CVEs will still be issued to CNAs (via API, as long as that's running), but the more manual stuff they do (i.e. issuing cves to non-CNAs) may suffer in the time being.

2025-04-15 21:54:34 UTC

- reply

It seems like there are a lot of unknowns at this point about what exactly will happen this week with CVE, but here's more of what I've gathered: CVEs will still be issued to CNAs, or CVE Numbering Authorities, i.e. vendors, researchers, open source, CERT, hosted service, bug bounty provider, and consortium organizations authorized by the CVE Program to assign CVE IDs to vulnerabilities and publish CVE records within their own specific scopes of coverage.
The CVE has an API for CNAs to obtain CVEs, and as long as that's still running there will be new CVEs. So, not a complete stop to CVEs being issued. But MITRE does have a more manual process for issuing CVEs to non-CNAs, and that may be impacted this week.

2025-04-15 21:39:48 UTC

- reply

I've also heard from people close to the CVE project that its funding coming down to the wire is not a one-time occurrence, and that in the past people outside the organization have had to pull some strings to get it done. The seems like an incredibly short-sighted way to support a critical resource.

2025-04-15 21:32:02 UTC

- reply

Hearing a bit more on this. Apparently it's up to the CVE board to decide what to do, but for now no new CVEs will be added after tomorrow. the CVE website will still be up.

2025-04-15 20:55:31 UTC

- reply

Probably the last CVE indexed before it goes dark should be CVE-2025-DOGE (critical, local privilege escalation vulnerability that leads to malicious code execution and data exfiltration).

2025-04-15 20:43:02 UTC

- reply

It's worth asking again who would benefit from taking CVE offline? Surely not the United States government, nor its private companies. Not its allies (such as they are now) in Europe. But it almost certainly would help our adversaries, like China and Russia, because confusion and uncertainty works to their advantage always.

2025-04-15 20:21:05 UTC

I boosted several posts about this already, but since people keep asking if I've seen it....
MITRE has announced that its funding for the Common Vulnerabilities and Exposures (CVE) program and related programs, including the Common Weakness Enumeration Program, will expire on April 16. The CVE database is critical for anyone doing vulnerability management or security research, and a whole of other uses. There isn't really anyone else left who does this, and it's typically been work that is paid for and supported by the US government, which is a major consumer of this information, btw.
I reached out to MITRE, and they confirmed it is for real. Here is the contract, which is through the Department of Homeland Security, and has been renewed annually on the 16th or 17th of April.
https://www.usaspending.gov/award/CONT_AWD_70RCSJ23FR0000015_7001_70RSAT20D00000001_7001
MITRE's CVE database is likely going offline tomorrow. They have told me that for now, historical CVE records will be available at GitHub, https://github.com/CVEProject
Yosry Barsoum, vice president and director at MITRE's Center for Securing the Homeland, said:
“On Wednesday, April 16, 2025, funding for MITRE to develop, operate, and modernize the Common Vulnerabilities and Exposures (CVE®) Program and related programs, such as the Common Weakness Enumeration (CWE™) Program, will expire. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE as a global resource.”
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/343/825/030/064/900/original/e3075f25266481ee.png

2025-04-15 18:59:41 UTC

Must-read report from NPR, showing once again that DOGE is a massive threat to the cyber/national security of the United States:
"In the first days of March, a team of advisers from President Trump's new Department of Government Efficiency initiative arrived at the Southeast Washington, D.C., headquarters of the National Labor Relations Board.
The small, independent federal agency investigates and adjudicates complaints about unfair labor practices. It stores reams of potentially sensitive data, from confidential information about employees who want to form unions to proprietary business information.
The DOGE employees, who are effectively led by White House adviser and billionaire tech CEO Elon Musk, appeared to have their sights set on accessing the NLRB's internal systems. They've said their unit's overall mission is to review agency data for compliance with the new administration's policies and to cut costs and maximize efficiency."
"But according to an official whistleblower disclosure shared with Congress and other federal overseers that was obtained by NPR, subsequent interviews with the whistleblower and records of internal communications, technical staff members were alarmed about what DOGE engineers did when they were granted access, particularly when those staffers noticed a spike in data leaving the agency. It's possible that the data included sensitive information on unions, ongoing legal cases and corporate secrets — data that four labor law experts tell NPR should almost never leave the NLRB and that has nothing to do with making the government more efficient or cutting spending."
Meanwhile, according to the disclosure and records of internal communications, members of the DOGE team asked that their activities not be logged on the system and then appeared to try to cover their tracks behind them, turning off monitoring tools and manually deleting records of their access — evasive behavior that several cybersecurity experts interviewed by NPR compared to what criminal or state-sponsored hackers might do.
https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security

2025-04-06 14:47:49 UTC

Few things steam me more than readers complaining that I'm somehow censoring comments. All I can say is #1 it's just me and I try to have a life, and, #2: "have you looked at the comments lately????"
You don't have to spend more than a few minutes wading through comments on my stories to see I generally leave them alone unless they turn into personal attacks on me or other readers. I leave them even when I know the comments are left by the very same cybercriminals I'm writing about. You wouldn't believe how many times those comments turned out to be extremely useful down the road, BTW.
There are hundreds of comments in moderation on a recent story that will probably all stay there. They are a mix of pro and con comments, but it's mostly people attacking each other and being assholes. Some days, I can't even bring myself to look at the comments in moderation b/c they're just so awful and shitty.
But what really steams me are the people who think they have a "free speech" right to have a comment published on my site. Like this person, who wants to know why their comment, which matches the theme of about 30 others in moderation (by anti-spam, not by me), and about as many already published:
"My husband and I attempted to post a comment several times on your March 30 article, “How Each Pillar of the 1st Amendment is Under Attack.” In a respectful and well-researched manner, we pointed out that the article omitted any mention of the pro-Hamas nature of recent college campus protests.
We tried to resubmit the comment multiple times, softening the language each time, while still aiming to highlight this important point. However, the comment was never approved for publication.
Can you please explain why?
I would be happy to share the comment directly. We sincerely hope that you will uphold the principle of free speech by allowing space for this perspective, especially when it addresses the concerning omission related to anti-Semitism."

2025-04-03 15:55:38 UTC

- reply

I like Dorothy Parker's version better: You can lead a whore to culture, but you can't make him think.

2025-04-03 15:52:27 UTC

Imagine being so drunk on the Kool-Aide that you can't listen to someone trying to help your company. Reached out to an executive at a manufacturing company about a security issue, and their reply was: "I'd like to help you. However, in checking out your website it is clear you suffer from Trump Derangement Syndrome. I don't like the guy but he is our President and a refreshing change from a mentally incapacitated do nothing President." Oh well, I tried.

2025-04-03 14:31:27 UTC

Don't look now, but the S&P 500 has plunged another 4 percent today after POTUS's 34 percent tariffs on goods from China and 20 percent on European goods. The tech heavy NASDAQ is off ~5 percent already today.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/274/505/480/517/819/original/55f88d945b57e1a8.png

2025-04-02 00:03:44 UTC

So the Trump administration is continuing to say nothing to see here with the whole leaking of war plans to a journalist over Signal thing. No investigation, no inquiry. Case closed.
“This case has been closed here at the White House as far as we are concerned,” press secretary Karoline Leavitt told reporters on Monday. “There have been steps made to ensure that something like that can obviously never happen again, and we’re moving forward,” she said.
@npub14j8…pjuf has a great response to this bullshit, as he skewers a number of big media outlets for reporting on the White House statement as just, welp, that's it.
"Let’s be clear: uncritically reporting the White House’s “nothing to see here” stance isn’t journalism — it’s stenography. The press secretary’s statement isn’t just meaningless, it’s an active attempt to sweep serious actual violations under the rug."
"This White House’s strategy is clear: lie, mislead, and deflect until the story dies. We’ve seen it with Bondi’s desperate “but her emails” deflection last week, and we’re seeing it again with this premature “case closed” declaration."
"But there are plenty of things in this story that require investigation:"
How did multiple senior officials decide it was totally acceptable to plan military operations over a consumer messaging app?
What other sensitive discussions have happened on unsecured channels such as Signal?
Have these conversations been recorded, as required under the Federal Records Act?
Have other illegal commercial chats been scrubbed to see how many outsiders were allowed in to them like Goldberg was?
How did they fuck up so badly to add an external person (incredibly, a reporter) to this illegal chat?
Who approved targeting civilian infrastructure, and what was their legal justification?
What “steps have been made” to prevent this from happening again, and why should we trust them?
https://www.techdirt.com/2025/04/01/sorry-you-dont-get-to-declare-case-closed-on-war-crime-planning-over-signal/

2025-04-01 13:33:23 UTC

April Fools, a.k.a. that day everyone and his mom tries their hand a bad knock-knock joke. Fair warning: I ain't boosting shit today.

2025-03-31 17:45:24 UTC

My name keeps getting mentioned in Top 10 infosec influencers lists, or Top[arbitrary number here] security professionals to follow. Here's the thing: The group responsible for all these "awards" has tried to get me to participate in their group activities (podcast interviews, etc. I always decline or ignore). But near as I can tell their top people lists have mostly the same people on them that have somewhat thin backgrounds in the cybers. So it seems to be some kind of circular promotion thing, possibly of the paid variety, which is not something I want to be associated with.
Some people say any publicity is good publicity, but I've never believed that. My instinct as I see these "awards" parroted by the people listed in them is to dig deeper into who the awards givers are. But in the meantime, my inclination is to send a polite note asking them to please not include me in their lists.
Is that a dick move? What would you do?

2025-03-27 13:33:04 UTC

Dear Tesla (ab)users:
There's now an easier way to offload your Swasticars. I give you stealmytesla.com.
Discreet Tesla Acquisition
Having difficulty selling your Tesla without all the hassle and negativity? Maybe its time to consider other options.
Expert Acquisition Team
Our team of experienced Tesla acquisition specialists will ensure a smooth and successful transaction for you.
Anonymous Registration
With Steal My Tesla, you can anonymously register your car to be acquired, transported, and sold within 5-7 business days.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/234/639/211/589/724/original/46c4c888cd14b901.png

2025-03-26 15:39:01 UTC

- reply

Hrm. MAR added MAR? Marco added Marco? Polo! Sock account?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/229/473/916/728/438/original/b78e3ae7c7bfbc7d.png

2025-03-26 15:22:32 UTC

Maybe there is hope after all
"The Supreme Court on Wednesday upheld federal restrictions aimed at curtailing access to kits that can be easily assembled into homemade, nearly untraceable firearms."
"In a 7-to-2 decision, written by Justice Neil M. Gorsuch, one of the court’s conservatives, the justices left in place requirements enacted during the Biden administration as part of a broader effort to combat gun violence by placing restrictions on so-called ghost guns."
"The ruling in favor of gun regulations is a departure for the court, which has shown itself to be skeptical both of administrative agency power and of gun regulations. Two conservative justices — Samuel A. Alito Jr. and Clarence Thomas — each filed dissents."
"The Biden administration enacted rules in 2022 tightening access to the weapons kits, after law enforcement agencies reported that ghost guns were exploding in popularity and being used to commit serious crimes."
https://www.nytimes.com/2025/03/26/us/politics/supreme-court-ghost-guns.html

2025-03-26 15:14:17 UTC

- reply

it's super easy to do that with signal, or butt dial them. the other day i noticed my butt had somehow populated a picture into signal. it hadn't sent, but that scared the living crap out of me.

2025-03-26 14:57:09 UTC

- reply

I am super curious who the national security advisor Michael Waltz intended to invite to the secret Signal group.
Was it it the US trade representative Jamie Greer? He has the same initials as The Atlantic editor in chief Jeffrey Goldberg.

2025-03-26 14:38:27 UTC

The Atlantic has released the entire Signal chat showing Hegseth's detailed attack plans against the Houthis. Why not, right? The administration claims none of it is classified.
In the group chat, Hegseth posted:
“1215et: F-18s LAUNCH (1st strike package)”
“1345: ‘Trigger Based’ F-18 1st Strike Window Starts (Target Terrorist is @ his Known Location so SHOULD BE ON TIME – also, Strike Drones Launch (MQ-9s)”
“1410: More F-18s LAUNCH (2nd strike package)”
“1415: Strike Drones on Target (THIS IS WHEN THE FIRST BOMBS WILL DEFINITELY DROP, pending earlier ‘Trigger Based’ targets)”
“1536 F-18 2nd Strike Starts – also, first sea-based Tomahawks launched.”
https://www.theatlantic.com/politics/archive/2025/03/signal-group-chat-attack-plans-hegseth-goldberg/682176/
h/t @npub1l2h…wcr0

2025-03-26 14:04:07 UTC

- reply

Auf wiedersehen, I say! The funny thing is my follower count there has gone way up since the inauguration.

2025-03-26 13:28:14 UTC

- reply

Karl is really mad, too. Although, I think maybe that anger is misdirected. Karl's response is typical LinkedIn Reply Guy whataboutism stuff ("where were you when Hunter Biden's laptop..")
Karl's profile says he is a f/t cybersecurity program architect for Microsoft's Asia/Pacific region. I feel safer already.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/228/939/468/173/758/original/f557401a1e4c9cf8.png

2025-03-26 13:10:32 UTC

The Electronic Frontier Foundation has released an open source project called Rayhunter. It is designed to run on an inexpensive (~$20) mobile hotspot and look for signs of mobile spying devices called cell-site simulators. Also known as Stingrays or IMSI catchers, they masquerade as legitimate cellphone towers, tricking phones w/in a certain radius into connecting to the device rather than a tower.
https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/228/890/918/778/555/original/fd273063b7e04396.png

2025-03-26 12:09:08 UTC

- reply

I'll have you know that I got a C in biology.

2025-03-26 11:56:49 UTC

Reuters has a good follow on some of the reporting about Edward Coristine, a teenage DOGE staffer with years-long connections to the English-language cybercrime community known as the Com.
The story says Coristine ran a website operated by the name "EGodly":
"In 2023, EGodly boasted on its Telegram channel of hijacking phone numbers, breaking into unspecified law enforcement email accounts in Latin America and Eastern Europe, and cryptocurrency theft. Early that year, the group distributed the personal details of an FBI agent who they said was investigating them, circulating his phone number, photographs of his house, and other private details on Telegram.
EGodly also posted an audio recording of an obscene prank call made to the agent's phone and a video, shot from the inside of a car, of an unknown party driving by the agent's house in Wilmington, Delaware at night and screaming out the window, "EGodly says you're a bitch!"
"Reuters could not independently verify EGodly's boasts of cybercriminal activity, including its claims to have hijacked phone numbers or infiltrated law enforcement emails. But it was able to authenticate the video by visiting the same Wilmington address and comparing the building to the one in the footage."
"The FBI agent targeted by EGodly, who is now retired, told Reuters that the group had drawn law enforcement attention because of its connection to swatting, the dangerous practice of making hoax emergency calls to send armed officers swarming targeted addresses. The agent didn't go into detail. Reuters is not identifying him out of concern for further harassment."
"These are bad folks," the former agent said. "They're not a pleasant group."
https://www.reuters.com/world/us/doge-staffer-big-balls-provided-tech-support-cybercrime-ring-records-show-2025-03-26/
My reporting on Coristine ties to the Com:
https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-graduated-from-the-com/

2025-03-26 00:32:48 UTC

Hey everyone. If you're looking for a reliably good, local cause to support with your time or donations consider your local food bank. Reuters reports that many food banks across the country are already strained by rising demand and will have less food to distribute because of least $1 billion in federal funding cuts and pauses by the POTUS.
"Hunger in the U.S. has ticked up in recent years with rising inflation and the end of pandemic-era programs that expanded food aid. President Donald Trump's administration has vowed to lower inflation by cutting back on government spending, including two U.S. Department of Agriculture programs that helped schools and food banks buy food from local farms."
"Reuters spoke with food banks in seven states who said cancellation and pauses of the programs meant they expected to offer less produce, meat and other staples in the coming weeks and months, leaving scarcer food for those reliant on free supplies that helped stave off hunger."
"One reason is fewer expected shipments from USDA's The Emergency Food Assistance Program (TEFAP), one of the agency's core nutrition programs that buys food from farmers and sends it to food pantries, some of the organizations said."
https://www.yahoo.com/news/trump-cuts-hit-struggling-food-101121569.html
https://www.cleveland.com/news/2025/03/too-stupid-for-words-trump-pulls-back-20-semi-trucks-of-food-from-clevelands-food-bank.html

2025-03-25 18:47:19 UTC

In case you missed this Reuters story from a few days ago....
"Several U.S. national security agencies have halted work on a coordinated effort to counter Russian sabotage, disinformation and cyberattacks, easing pressure on Moscow as the Trump Administration pushes Russia to end its war in Ukraine."
"Former President Joe Biden last year ordered his national security team to establish working groups to monitor the issue amid warnings from U.S. intelligence that Russia was escalating a shadow war against Western nations."
"The plan was led by the president's National Security Council (NSC) and involved at least seven national security agencies working with European allies to disrupt plots targeting Europe and the United States, seven former officials who participated in the working groups told Reuters."
Before President Donald Trump was inaugurated, his incoming administration was briefed by Biden officials about the efforts and urged to continue monitoring Russia's hybrid warfare campaign, the former U.S. officials said.
"However, since Trump took office on Jan. 20 much of the work has come to a standstill, according to eleven current and former officials, all of whom requested anonymity to discuss classified matters. Reuters is the first to report on the full extent of the Biden administration effort and how multiple different U.S. agencies have since paused their work on the issue."
"Regular meetings between the National Security Council and European national security officials have gone unscheduled, and the NSC has also stopped formally coordinating efforts across U.S. agencies, including with the FBI, the Department of Homeland Security and the State Department, the current and former officials said."
"Some officials involved in the working groups said they are concerned that the Trump administration is de-prioritizing the issue despite intelligence warnings. The change follows the unwinding of other Russia-focused projects launched by Biden’s administration."
"The FBI last month ended an effort to counter interference in U.S. elections by foreign adversaries including Russia and put on leave staff working on the issue at the Department of Homeland Security. The Department of Justice also disbanded a team that seized the assets of Russian oligarchs."
https://www.yahoo.com/news/exclusive-us-suspends-efforts-counter-060549726.html

2025-03-24 20:23:53 UTC

Let's be honest: Haven't we all at one point drunk texted a reporter an invitation to discuss plans for an upcoming military attack? Something tells me Hegseth will be hitting the sauce pretty hard tonight.

2025-03-24 19:07:04 UTC

Drop what you're doing and read this incredible story, which recounts how a reporter for The Atlantic was inadvertently included in a private Signal discussion group that appears to have included Defense Secretary Pete Hegseth, Vice President Marco Rubio and other administration officials discussing plans for an upcoming U.S. military assault on Yemen.
The reporter, Jeff Goldberg, said he was convinced it was all an elaborate hoax as they laid out the pros and cons of specific attack options, and discussed targets over the course of a week. That is, until they shared on the Signal chat exactly where and when the targets in Yemen would be hit, and then those targets got hit exactly when they'd said.
"The world found out shortly before 2 p.m. eastern time on March 15 that the United States was bombing Houthi targets across Yemen."
"I, however, knew two hours before the first bombs exploded that the attack might be coming. The reason I knew this is that Pete Hegseth, the secretary of defense, had texted me the war plan at 11:44 a.m. The plan included precise information about weapons packages, targets, and timing.
"According to the lengthy Hegseth text, the first detonations in Yemen would be felt two hours hence, at 1:45 p.m. eastern time. So I waited in my car in a supermarket parking lot. If this Signal chat was real, I reasoned, Houthi targets would soon be bombed. At about 1:55, I checked X and searched Yemen. Explosions were then being heard across Sanaa, the capital city."
"I went back to the Signal channel. At 1:48, “Michael Waltz” had provided the group an update. Again, I won’t quote from this text, except to note that he described the operation as an “amazing job.” A few minutes later, “John Ratcliffe” wrote, “A good start.” Not long after, Waltz responded with three emoji: a fist, an American flag, and fire. Others soon joined in, including “MAR,” who wrote, “Good Job Pete and your team!!,” and “Susie Wiles,” who texted, “Kudos to all – most particularly those in theater and CENTCOM! Really great. God bless.” “Steve Witkoff” responded with five emoji: two hands-praying, a flexed bicep, and two American flags."
"I have never seen a breach quite like this. It is not uncommon for national-security officials to communicate on Signal. But the app is used primarily for meeting planning and other logistical matters—not for detailed and highly confidential discussions of a pending military action. And, of course, I’ve never heard of an instance in which a journalist has been invited to such a discussion."
https://www.theatlantic.com/politics/archive/2025/03/trump-administration-accidentally-texted-me-its-war-plans/682151/?gift=DjgA9DZGvABas7wFCM-ptk0vpPuikYUZT9Ej3cJbK1s&utm_source=copy-link&utm_medium=social&utm_campaign=share

2025-03-24 18:24:56 UTC

I've noticed something that I think is worth pointing out: pretty much ALL of the pushback I have gotten on LinkedIn over the past few months over stories critical of this administration has come from men in IT. Many of whom no doubt idolize Musk, who in their minds can walk on water.
Conversely, the response almost universally I've seen from female non/male people in IT and security professionals on LinkedIn has been a great deal more appropriate, i.e. horror, disgust and revulsion for the way this administration is treating federal employees, veterans, the courts, judges, lawyers, journalists, and important, long-standing U.S. policy interests.
I guess what I'm saying is nobody should expect the men in IT to lead the resistance. So many of them are like this guy: angry, aggressive, and really excited about the good old US of A going back to the 80s. Like the 1880s.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/218/779/446/400/286/original/f1b56c099f5eef04.png

2025-03-23 02:01:35 UTC

ICYMI, the POTUS just issued a memorandum instructing the DOJ and DHS to go after lawyers who challenge the administration.
"President Trump broadened his campaign of retaliation against lawyers he dislikes with a new memorandum that threatens to use government power to punish any law firms that, in his view, unfairly challenge his administration."
"The memorandum directs the heads of the Justice and Homeland Security Departments to “seek sanctions against attorneys and law firms who engage in frivolous, unreasonable and vexatious litigation against the United States” or in matters that come before federal agencies."
"Mr. Trump issued the order late Friday night, after a tumultuous week for the American legal community in which one of the country’s premier firms, Paul, Weiss, Rifkind, Wharton & Garrison, struck a deal with the White House to spare the company from a punitive decree issued by Mr. Trump the previous week."
"Vanita Gupta, who as a civil rights lawyer and a former Justice Department official has both sued the government and defended it in court, said Mr. Trump’s memo “attacks the very foundations of our legal system by threatening and intimidating litigants who aim to hold our government accountable to the law and the Constitution.”
https://www.nytimes.com/2025/03/22/us/politics/trump-memo-lawyers.html

2025-03-21 19:13:54 UTC

New, by me:
Police in at least two U.S. states last week independently announced arrests of Chinese nationals accused of perpetrating a novel form of tap-to-pay fraud using mobile devices. Details released by authorities so far indicate the mobile wallets being used by the scammers were created through online phishing scams, and that the accused were relying on a custom Android app to relay tap-to-pay transactions from mobile devices located in China.
Asked for specifics about the mobile devices seized from the suspects, Lyon said “tap-to-pay fraud involves a group utilizing Android phones to conduct Apple Pay transactions utilizing stolen or compromised credit/debit card information,” [emphasis added].
https://krebsonsecurity.com/2025/03/arrests-in-tap-to-pay-scheme-powered-by-phishing/
I wrote last month in depth about the China-based phishing cartels behind these innovations in payment card fraud. One of them is selling an Android app which -- for $500 a month -- will let you use your phone to relay an NFC transaction halfway around the world.
https://krebsonsecurity.com/2025/03/arrests-in-tap-to-pay-scheme-powered-by-phishing/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/202/010/577/025/449/original/4e9e9a4fb726a4df.png

2025-03-21 18:59:18 UTC

Someone riddle me this: Why would Trump's Jan. 29 Executive Order on "Additional Measures to Combat Anti-Semitism" be given the executive order number it has, which is 14188? Surely, even with the flood of EOs this POTUS has issued already, we're not up to that number.
So where did it come from? Check out the Wikipedia entry for "fourteen words," also abbreviated 14 or 1488), which says it is a reference to "two slogans originated by the American domestic terrorist David Eden Lane, one of nine founding members of the defunct white supremacist terrorist organization The Order, and are accompanied by Lane's "88 Precepts". The slogans have served as a rallying cry for militant white nationalists internationally."
"Lane used the 14-88 numerical coding extensively throughout his spiritual, political, religious, esoteric, and philosophical tracts and notably in his "88 Precepts" manifesto. According to the Southern Poverty Law Center, inspiration for the Fourteen Words "are derived from a passage in Adolf Hitler's autobiographical book Mein Kampf."
"The Fourteen Words have been prominently used by neo-Nazis, white power skinheads and certain white nationalists and the alt-right. "88" is used by some as a shorthand for "Heil Hitler", 'H' being the 8th letter of the alphabet,[16] though Lane viewed Nazism along with America as being part of the "Zionist conspiracy."
https://en.m.wikipedia.org/wiki/Fourteen_Words
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/201/952/200/036/027/original/2e82259a78ed9369.png

2025-03-21 18:03:39 UTC

This seems like an ominous development:
"A new executive order from President Donald Trump aims to expand information-sharing across federal agencies as well as between federal and state governments, but civil libertarians and other experts are warning that the main purpose is to help normalize how the Department of Government Efficiency is handling government data."
"The order, issued Thursday, directs all federal agency heads to modify or rescind any regulations preventing the sharing of unclassified data and records between federal agencies."
"Agency heads also must ensure that the U.S. government has “unfettered access” to comprehensive data from all state programs that receive federal funding. The order extends to all such data even when stored in third-party databases."
"The stated goal is “eliminating bureaucratic duplication and inefficiency while enhancing the Government’s ability to detect overpayments and fraud” — the supposed core of DOGE’s mission. The order does not mention DOGE by name."
"Civil libertarians and other experts, however, call the new EO an alarming development, and say it is meant to give cover to DOGE, which has been the subject of numerous lawsuits as its workers continue to root through government records and disrupt federal agencies. Trump also has previously sought to consolidate data for reasons that would infringe on civil liberties, the experts say."
"While the new EO asserts that the removal of data “silos” is designed to eliminate fraud, waste and abuse, disturbing mission creep is very possible, said Elizabeth Laird, director of equity and civic technology at the nonprofit Center for Democracy and Technology."
"There are no assurances that the data won’t be used for “targeting people who the administration has separately said are a priority for them,” Laird said. “That can include immigrants, it can include people who are transgender, it can include people that speak up” against the administration. "
More here:
https://therecord.media/trump-executive-order-information-silos-data-sharing-doge

2025-03-21 17:33:43 UTC

Okay, this is not good:
"Executive Summary
On 21 March 2025, CloudSEK’s XVigil discovered a threat actor, "rose87168," selling 6M records exfiltrated from SSO and LDAP of Oracle Cloud. The data includes JKS files, encrypted SSO passwords, key files, and enterprise manager JPS keys."
"The attacker, active since January 2025, is incentivizing decryption assistance and demanding payment for data removal from over 140K affected tenants. Our engagement with the threat actor suggests a possible undisclosed vulnerability on login.(region-name).oraclecloud.com, leading to unauthorized access. While the threat actor has no prior history, their methods indicate high sophistication, CloudSEK assesses this threat with medium confidence and rates it as High in severity."
https://www.cloudsek.com/blog/the-biggest-supply-chain-hack-of-2025-6m-records-for-sale-exfiltrated-from-oracle-cloud-affecting-over-140k-tenants
https://exposure.cloudsek.com/

2025-03-21 15:43:05 UTC

Wow. The US Treasury Dept. today announced it is lifting sanctions on Tornado Cash, a cryptocurrency mixing service that state-sponsored hackers from North Korea have been massively using to launder their stolen billions.
"Based on the Administration’s review of the novel legal and policy issues raised by use of financial sanctions against financial and commercial activity occurring within evolving technology and legal environments, we have exercised our discretion to remove the economic sanctions against Tornado Cash as reflected in Treasury’s Monday filing in Van Loon v. Department of the Treasury."
https://home.treasury.gov/news/press-releases/sb0057
h/t to @npub1ntc…9u8j for the heads up. Weaver said: "The US government has just said "money laundering is legal as long as the process is automated."
"Every wei that flows through Tornado Cash, even if 'legitimate,' is helping the North Korean nuclear regime by hiding illegitimate flows," Weaver told me.
Here's Treasury sanctioning Tornado Cash in 2022: https://home.treasury.gov/news/press-releases/jy0916

2025-03-21 01:57:05 UTC

Can someone please remind me when the hacker uprising is happening? Asking for a friend.

2025-03-20 23:39:30 UTC

- reply

Sorry, "the Fediverse chick." WTF Nicole? Currently at @npub10s0…r64r

2025-03-20 23:37:13 UTC

How? How is Nicole from the Fediverse showing up in my invites and DMs again? Is this just a bot account that keeps getting re-registered? Is it's a phishing test? Go away, Nicole.

2025-03-20 22:26:48 UTC

At some point, this administration and its mouthpieces like Musk and Stephen Miller are going get a federal judge killed with their rhetoric that judges should be impeached for ruling against the president. Every time they do this they are effectively painting a target on judges for their more extreme MAGA base.
From WaPo: "Stephen Miller, one of Donald Trump’s closest advisers at the White House, is escalating the administration’s attacks on federal judges who have ruled against the president’s recent orders, labeling them as rogue Marxists thwarting the will of American voters."

2025-03-20 21:57:14 UTC

- reply

That sounds complicated. I'd love to hear about your harrowing experience.

2025-03-20 21:45:47 UTC

I'm dying over here. This guy says he's created the world's first AI-based call center for actively disrupting and screwing with scammers. Their AI bots are taking live phonecalls at scale and keeping the scammers on the line for hours, and sometimes taunting the scammers. They're tying up entire scam call centers. So entertaining.
https://www.youtube.com/watch?v=ZDpo_o7dR8c

2025-03-20 16:22:59 UTC

The DOGE website behaves like a self-styled OSINT sleuth on Xitter, constantly making wild claims and connections and then quietly deleting or correcting their mistakes without comment or apology. It's pretty wild because if media orgs were to do this, they'd be sued into oblivion.

2025-03-20 15:16:04 UTC

In these uncertain times, I sometimes find it helpful and soothing to ponder Grey's Law: "Any sufficiently advanced incompetence is indistinguishable from malice."
https://en.wikipedia.org/wiki/Clarke%27s_three_laws#cite_note-Gooden2015-7

2025-03-20 14:41:21 UTC

Sure, it's totally normal for the US to cover up indefensible and ongoing atrocities by Russia.
"The Trump administration cut funding to Yale University’s Humanitarian Research Lab, which was compiling a database of alleged Russian war crimes, including the abduction of an estimated 35,000 children from occupied areas of Ukraine, last month."
"Using satellite imagery and other surveillance systems provided through the US government, the Yale researchers were monitoring 116 sites in Russia."
"A Yale source said the US state department deleted the evidence which would have been used as part of rescue efforts to get the children home to Ukraine. It would also have been used to prosecute those behind their abductions – including Russian president Vladimir Putin."
https://www.independent.co.uk/news/world/europe/trump-ukraine-children-russia-war-kidnapping-evidence-b2717730.html
More reporting from USAToday:
https://www.usatoday.com/story/news/world/2025/03/19/trump-abducted-ukrainian-kids/82541604007/

2025-03-20 13:36:01 UTC

Published another update about all the winning by DOGE and the POTUS on cybery stuff lately, and their efforts to rehire and then place on *paid* leave some 25,000 government employees they illegally fired, including > 100 people at the Cybersecurity & Infrastructure Security Agency (CISA). From the story:
"Both the message to fired CISA workers and DOGE's ongoing efforts to bypass vetted government networks for a faster Wi-Fi signal are emblematic of this administration's overall approach to even basic security measures: To go around them, or just pretend they don't exist for a good reason.
On Monday, The New York Times reported that U.S. Secret Service agents at the White House were briefly on alert last month when a trusted captain of Elon Musk's "Department of Government Efficiency" (DOGE) visited the roof of the Eisenhower building inside the White House compound -- to see about setting up a dish to receive satellite Internet access directly from Musk's Starlink service.
The White House press secretary told The Times that Starlink had "donated" the service and that the gift had been vetted by the lawyer overseeing ethics issues in the White House Counsel’s Office. The White House claims the service is necessary because its wireless network is too slow."
https://krebsonsecurity.com/2025/03/doge-to-fired-cisa-staff-email-us-your-personal-data/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/195/014/637/815/937/original/0854764afd4dc98a.png

2025-03-19 16:06:56 UTC

I feel like we haven't really processed or even talked much about the extent to which US federal agencies have transitioned to communicating press releases and important information on X. Want to interact with your government? Sure, just do it through X. If you let that really sink in, it's a fairly profound and terrifying shift, IMHO.

2025-03-19 02:45:13 UTC

From Vanity Fair:
"More than 40 years ago, Congress established the U.S. Institute of Peace (USIP) as an “independent, nonprofit, national institute” to “promote international peace and the resolution of conflicts.”
The Department of Government Efficiency just took it over.
“What has happened here today is an illegal takeover by elements of the executive branch of a private nonprofit,” USIP’s now-fired CEO George Moose told the Associated Press and others Monday, following a police standoff that ended in DOGE officials entering the building.
Moose said the building is not federally owned and that its employees do not work for the executive branch, putting its operations outside of DOGE’s purview. “Somehow, all of those arguments have not prevailed,” said Moose, who promised to bring legal action against DOGE, which he said “has broken into our building.”
https://www.vanityfair.com/news/story/doge-seizes-control-of-us-peace-institute

2025-03-17 17:54:39 UTC

- reply

I hate to say it, but in this case the AI summary of reader comments on this "story" are 100 percent right
"What readers are saying
The comments overwhelmingly express skepticism and criticism regarding the existence and effectiveness of Trump's economic plan, particularly its impact on the U.S. manufacturing sector. Many commenters argue that there is no coherent plan, citing Trump's past business failures."

2025-03-17 17:46:47 UTC

Gosh, WaPo, don't you think maybe you're giving the POTUS a little too much credit?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/179/018/591/419/215/original/58e158fd8d85ecbd.png

2025-03-14 13:18:36 UTC

Called it. Wrote this back in Sept. 2024, about a clever Windows Powershell phishing scam that was targeting developers at the time. It uses a fake CAPTCHA that asks visitors to distinguish themselves from bots by pressing a combination of keyboard keys that causes Microsoft Windows to download password-stealing malware. Everyone said, bah, devs will never fall for this. Maybe, I said, but your average user would for sure.
Judging from the number of recent media reports, it appears this one is pretty widespread at the moment.
https://krebsonsecurity.com/2024/09/this-windows-powershell-phish-has-scary-potential/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/160/976/012/619/024/original/7660ca7800fa00a1.png

2025-02-28 22:09:57 UTC

- reply

Don't even get me started on the WWIII chants. Past American presidents have gone out of their way to avoid uttering these words, because they invariably fill people with dread and feelings of dystopia. But you see, the current president would like nothing more.

2025-02-28 22:05:53 UTC

I am suck a fscking tyrant on LinkedIn right now. I've been posting pretty much the same comments over there, but deleting and blocking any useful idiots who try to rationalize any of this. Man, I hate moderating my LinkedIn feed, but I detest whataboutism and the endless sychopancy.

2025-02-28 21:40:38 UTC

- reply

We are so getting cut out of intel sharing agreements by our allies over this. I mean, if they have a brain. Anyone with intel training 101 (that isn't Israel) will conclude that the US cannot be a trusted intel sharing partner anymore.

2025-02-28 21:22:56 UTC

- reply

I'm completely apoplectic about this. U.S. offensive cyber operations against Russia should never ever stop unless and until Putin is gone and something resembling a non-threatening superpower takes over.
If we were serious about pushing Moscow to make *any* concessions in a cessation to its aggression in Ukraine, we would INCREASE by 10x or more the offensive actions against cybercrime operations that are at Russian state sponsored or state-tolerated.

2025-02-28 20:50:36 UTC

How much more proof do we need that this administration is completely compromised? There is zero reason for the US to relax any offensive digital actions against Russia. If anything, we should be applying more.
Martin Matishak over at The Record writes that the former Fox news host turned Defense Secretary Pete Hegseth last week ordered U.S. Cyber Command to stand down from all planning against Russia, including offensive digital actions.
"Hegseth gave the instruction to Cyber Command chief Gen. Timothy Haugh, who then informed the organization's outgoing director of operations, Marine Corps Maj. Gen. Ryan Heritage, of the new guidance, according to these people, who spoke on the condition of anonymity because of the matter’s sensitivity."
"The order does not apply to the National Security Agency, which Haugh also leads, or its signals intelligence work targeting Russia, the sources said."
"While the full scope of Hegseth’s directive to the command remains unclear, it is more evidence of the White House’s efforts to normalize ties with Moscow after the U.S. and international allies worked to isolate the Kremlin over its 2022 invasion of Ukraine."
https://therecord.media/hegseth-orders-cyber-command-stand-down-russia-planning

2025-02-28 20:29:31 UTC

Honestly, I don't know how Zelenksy didn't punch the cheetoh that whole time. That man has remarkable restraint.
I have never been so embarrassed for our country. What a thug. "World War III," he says over and over, echoing Putin's sabre rattling throughout his invasion. Even sitting in the White House, Trump is echoing the Kremlin line.
What's even more despicable is that the spineless, gutless GOP will say nothing about this indefensible show of gutlessness and cowardice by their leader. Imagine that: Being afraid of cowards makes you one.

2025-02-28 20:18:59 UTC

New, from me:
One of the most notorious providers of abuse-friendly “bulletproof” web hosting for cybercriminals has started routing its operations through networks run by the Russian antivirus and security firm Kaspersky Lab, KrebsOnSecurity has learned. Kaspersky did not respond to multiple requests for comment.
Security experts say the Russia-based service provider Prospero OOO (the triple O is the Russian version of “LLC”) has long been a persistent source of malicious software, botnet controllers, and a torrent of phishing websites. Last year, the French security firm Intrinsec detailed Prospero’s connections to bulletproof services advertised on Russian cybercrime forums under the names Securehost and BEARHOST.
"If you need a server for a botnet, for malware, brute, scan, phishing, fakes and any other tasks, please contact us," BEARHOST's ad on one forum advises. "We completely ignore all abuses without exception, including SPAMHAUS and other organizations."
https://krebsonsecurity.com/2025/02/notorious-malware-spam-host-prospero-moves-to-kaspersky-lab/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/083/353/323/378/955/original/f72e2645154f15da.png

2025-02-27 03:42:10 UTC

Sccop: U.S. Soldier Charged in AT&T Hack Searched "Can Hacking Be Treason"
A U.S. Army soldier who pleaded guilty last week to leaking phone records for high-ranking U.S. government officials searched online for non-extradition
countries and for an answer to the question "can hacking be treason?"
prosecutors in the case said Wednesday. The government disclosed the details
in a court motion to keep the defendant in custody until he is discharged from
the military.
https://krebsonsecurity.com/2025/02/u-s-soldier-charged-in-att-hack-searched-can-hacking-be-treason/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/073/773/646/197/316/original/12f618202fefba59.png

2025-02-26 16:13:44 UTC

- reply

And yet, we see this crap:
Massive encroachment by Jeff Bezos into The Washington Post's opinion section today — makes clear dissenting views will not be published or tolerated there," The Post's chief economics reporter Jeff Stein posted on X. "I still have not felt encroachment on my journalism on the news side of coverage, but if Bezos tries interfering with the news side I will be quitting immediately and letting you know."
Why legitimize X as a platform for journalism AT ALL? Don't make your stand at the nazi bar.

2025-02-26 16:09:16 UTC

Interesting that the Russian news service Kommersant reported yesterday about a ransomware attack on a Russian company involving the Lockbit ransomware. The piece is light on details about how they determined it was lockbit, or what version (Lockbit's source and builders have been leaked over the years).
The story says the attack happened in December 2024, but I wonder if this was an isolated incident, and/or if someone is trying to sick the local authorities on Lockbit.
https://archive.ph/To7oV