BrianKrebs

Independent investigative journalist. Covers cybercrime, security, privacy. Author of 'Spam Nation,' a NYT bestseller. Former Washington Post reporter, '95-'09. Signal: briankrebs.07
krebsonsecurity @ gmail .com
Linkedin: https://www.linkedin.com/in/bkrebs

website: https://krebsonsecurity.com

Public Key

npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh

NIP-05 Address

briankrebs_at_infosec.exchange@momostr.pink

Profile Code

nprofile1qqsxvgjseexsxl0ppxny56szxrmcn8uj9dmrgcugk0nu5ph7jjgrtrgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0ds7wxgyc

Publishing to

relay.damus.io

nos.lol

Author Public Key

npub1vc39pnjdqd77zzdxff4qyv8h3x0ey2mkx33c3vl8egr0a9ysxkxsk0axsh

Show more details

Last Notes

2026-03-11 16:24:45 UTC

Breaking, new, by me: Iran-backed Hackers Claim Wiper Attack on Medtech Firm Stryker
A hacktivist group with links to Iran's intelligence agencies is claiming responsibility for a data-wiping attack against Stryker, a global medical technology company based in Michigan. News reports out of Ireland, Stryker's largest hub outside of the United States, said the company sent home more than 5,000 workers there today. Meanwhile, a voicemail message at Stryker's main U.S. headquarters says the company is currently experiencing a building emergency.
From the story:
"Wiper attacks usually involve malicious software designed to overwrite any existing data on infected devices. But a trusted source with knowledge of the attack who spoke on condition of anonymity told KrebsOnSecurity the perpetrators in this case appear to have used a Microsoft service called Microsoft Intune to issue a ‘remote wipe’ command against all connected devices."
"Intune is a cloud-based solution built for IT teams to enforce security and data compliance policies, and it provides a single, web-based administrative console to monitor and control devices regardless of location. The Intune connection is supported by this Reddit discussion on the Stryker outage, where several users who claimed to be Stryker employees said they were told to uninstall Intune urgently."
https://krebsonsecurity.com/2026/03/iran-backed-hackers-claim-wiper-attack-on-medtech-firm-stryker/
#stryker #handala #intune #wiper #cybersecurity
https://media.infosec.exchange/infosec.exchange/media_attachments/files/116/211/464/307/859/938/original/3d348cfab9495ad4.png

2026-01-26 17:10:54 UTC

We knew this was coming, but now the clock is running. From Privacy International:
"Yesterday the Trump Administration announced a proposed change in policy for travellers to the U.S. It applies to the powers of data collection by the Customs and Border Police (CBP)."
"If the proposed changes are adopted after the 60-day consultation, then millions of travellers to the U.S. will be forced to use a U.S. government mobile phone app, submit their social media from the last five years and email addresses used in the last ten years, including of family members. They’re also proposing the collection of DNA."
PI linked to and summarized a Federal Register entry describing the proposed requirements:
-All visitors must submit ‘their social media from the last 5 years’
-ESTA (Electronic System for Travel Authorization) applications will include ‘high value data fields’, ‘when feasible’
‘telephone numbers used in the last five years’
-‘email addresses used in the last ten years’
-‘family number telephone numbers (sic) used in the last five years’
-biometrics – face, fingerprint, DNA, and iris
-business telephone numbers used in the last five years
-business email addresses used in the last ten years.
https://www.privacyinternational.org/news-analysis/5713/trump-administration-wants-your-dna-and-social-media
The Federal Register entry says comments are encouraged and
must be submitted (no later than
February 9, 2026) to be assured of
consideration
Federal Register entry: https://www.govinfo.gov/content/pkg/FR-2025-12-10/pdf/2025-22461.pdf

2026-01-02 15:55:02 UTC

From the Financial Times:
"Australia’s largest pension fund is planning to reduce its allocation to global equities next year, amid signs that the artificial intelligence boom in the US stock market could be running out of steam."
"John Normand, head of investment strategy at the A$400bn (US$264bn) AustralianSuper, told the Financial Times that not only did valuations of big US tech companies look high relative to history, but the leverage being used to fund AI investment was increasing “very rapidly”, as was the pace of fundraising through mergers, venture capital and public listings."
“I can see some forces lining up that we are looking for less public equity allocation at some point next year. It’s the basic intersection of the maturing AI cycle with a shift towards Fed[eral Reserve] tightening in 2027,” Normand said in an interview.
https://archive.is/hru63

2025-08-13 23:08:02 UTC

...aaand that's about all a Subway sandwich is good for anyway
http://nytimes.com/2025/08/13/us/politics/federal-agent-trump-sandwich-dc.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/115/023/965/221/936/668/original/0c890448954e48c5.png

2025-07-21 15:26:22 UTC

I'm seeing an unusually large number of phishous and mailicious messages landing in my inbox today. Granted, it's always hard to know if an uptick is related to an increase in malicious attacks or just more bad stuff figuring out how to bypass spam and malware filters. I can say, though, that most of these that made it to my inbox today are the kind that I would normally have to fish out of the spam folder. Be careful out there folks.

2025-05-05 16:29:41 UTC

Enjoyed this post from Malwarebytes about how AI is getting creepy good at guessing the geo-location of photos/videos by analyzing the tiniest of clues.
When analyzing videos with audio, e.g., apparently just having a few birds chirping in the background can be enough to make a strong guess about where the video was recorded.
https://www.malwarebytes.com/blog/news/2025/04/ai-is-getting-creepy-good-at-geo-guessing?utm_source=iterable&utm_medium=email&utm_campaign=b2c_pro_oth_20250505_mayweeklynewsletter_v1_174617365504&utm_content=AI

2025-04-16 21:33:59 UTC

Another area where the POTUS is setting up a constitutional challenge with the judicial branch:
"The Associated Press said in a court filing on Wednesday that the Trump administration had defied a federal judge’s order requiring the administration to restore the wire service’s full access to the White House."
"Lawyers for the The A.P. wrote that a White House spokesman had told A.P. reporters on Monday that they would continue to be excluded from the press pool — a small, rotating group of journalists who cover certain events in confined spaces at the White House — because the “case is ‘ongoing.’”
"For the last two months, The A.P.’s access to President Trump has been sharply curtailed over its refusal to refer to the Gulf of Mexico as the Gulf of America, the name that Mr. Trump designated for the body of water."
"In a temporary order last week, Judge Trevor N. McFadden of the Federal District Court in Washington, D.C., said the exclusion violated the First Amendment’s free-speech clause and instructed the White House to restore The A.P.’s access “immediately.”
https://www.nytimes.com/2025/04/16/us/politics/trump-ap-white-house-access.html

2025-04-16 15:33:53 UTC

Hey Parallels, thanks for giving me a heart attack this morning. Why are you asking to connect to an "account" page at account.parallels.cn"?? That's a nope. Thank goodness for Little Snitch firewall. Found exactly one discussion thread about this in an online search, and there were no responses except "yeah, I had the same question."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/348/358/180/198/650/original/72e81d9a9a0c62c5.png

2025-04-16 14:53:51 UTC

Yeah, because this is totally normal. Martin likes to fire off nastygrams to people and organizations that criticize the POTUS.
"Trump’s D.C. U.S. attorney pick appeared on Russian state media over 150 times
Trump nominee Ed Martin’s 100-plus appearances on Russian state-directed media RT and Sputnik from 2016 to 2024 alarm some former national security officials."
https://www.washingtonpost.com/dc-md-va/2025/04/16/ed-martin-rt-sputnik-usattorney/
Meanwhile, on April 14, a group of former federal prosecutors urged the DC Court of Appeals to pursue a disciplinary investigation of Martin for making public statements suggesting he was criminally investigating perceived political enemies of himself and the president.
https://societyfortheruleoflaw.org/ed-martin-complaint/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/348/206/544/738/868/original/b349c748bb77cfcf.png

2025-04-16 04:03:30 UTC

- reply

Finally put together a proper story on this funding debacle for MITRE's CVE program.
"A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization MITRE warned today that its contract to maintain the Common Vulnerabilities and Exposures (CVE) program -- which is traditionally funded each year by the Department of Homeland Security -- expires on April 16."
https://krebsonsecurity.com/2025/04/funding-expires-for-key-cyber-vulnerability-database/

2025-04-15 22:21:37 UTC

Wow. The tech and NASDAQ giant NVIDIA's shares have tanked in after hours trading, down 7 percent right now. Might have something to do with this disclosure:
"On April 9, 2025, the U.S. government, or USG, informed NVIDIA Corporation, or the Company, that the USG requires a license for export to China (including Hong Kong and Macau) and D:5 countries, or to companies headquartered or with an ultimate parent therein, of the Company's H20 integrated circuits and any other circuits achieving the H20's memory bandwidth, interconnect bandwidth, or combination thereof. The USG indicated that the license requirement addresses the risk that the covered products may be used in, or diverted to, a supercomputer in China. On April 14, 2025, the USG informed the Company that the license requirement will be in effect for the indefinite future.
The Company's first quarter of fiscal year 2026 ends on April 27, 2025. First quarter results are expected to include up to approximately $5.5 billion of charges associated with H20 products for inventory, purchase commitments, and related reserves."
Expect an extra wild ride on Wall Street when the bell rings tomorrow.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/344/297/980/307/698/original/e90d30e67197ea22.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/344/304/922/387/721/original/c0c19ccf19298f85.png

2025-04-15 21:54:34 UTC

- reply

It seems like there are a lot of unknowns at this point about what exactly will happen this week with CVE, but here's more of what I've gathered: CVEs will still be issued to CNAs, or CVE Numbering Authorities, i.e. vendors, researchers, open source, CERT, hosted service, bug bounty provider, and consortium organizations authorized by the CVE Program to assign CVE IDs to vulnerabilities and publish CVE records within their own specific scopes of coverage.
The CVE has an API for CNAs to obtain CVEs, and as long as that's still running there will be new CVEs. So, not a complete stop to CVEs being issued. But MITRE does have a more manual process for issuing CVEs to non-CNAs, and that may be impacted this week.

2025-04-15 21:39:48 UTC

- reply

I've also heard from people close to the CVE project that its funding coming down to the wire is not a one-time occurrence, and that in the past people outside the organization have had to pull some strings to get it done. The seems like an incredibly short-sighted way to support a critical resource.

2025-04-15 21:32:02 UTC

- reply

Hearing a bit more on this. Apparently it's up to the CVE board to decide what to do, but for now no new CVEs will be added after tomorrow. the CVE website will still be up.

2025-04-15 20:21:05 UTC

I boosted several posts about this already, but since people keep asking if I've seen it....
MITRE has announced that its funding for the Common Vulnerabilities and Exposures (CVE) program and related programs, including the Common Weakness Enumeration Program, will expire on April 16. The CVE database is critical for anyone doing vulnerability management or security research, and a whole of other uses. There isn't really anyone else left who does this, and it's typically been work that is paid for and supported by the US government, which is a major consumer of this information, btw.
I reached out to MITRE, and they confirmed it is for real. Here is the contract, which is through the Department of Homeland Security, and has been renewed annually on the 16th or 17th of April.
https://www.usaspending.gov/award/CONT_AWD_70RCSJ23FR0000015_7001_70RSAT20D00000001_7001
MITRE's CVE database is likely going offline tomorrow. They have told me that for now, historical CVE records will be available at GitHub, https://github.com/CVEProject
Yosry Barsoum, vice president and director at MITRE's Center for Securing the Homeland, said:
“On Wednesday, April 16, 2025, funding for MITRE to develop, operate, and modernize the Common Vulnerabilities and Exposures (CVE®) Program and related programs, such as the Common Weakness Enumeration (CWE™) Program, will expire. The government continues to make considerable efforts to support MITRE’s role in the program and MITRE remains committed to CVE as a global resource.”
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/343/825/030/064/900/original/e3075f25266481ee.png

2025-04-15 18:59:41 UTC

Must-read report from NPR, showing once again that DOGE is a massive threat to the cyber/national security of the United States:
"In the first days of March, a team of advisers from President Trump's new Department of Government Efficiency initiative arrived at the Southeast Washington, D.C., headquarters of the National Labor Relations Board.
The small, independent federal agency investigates and adjudicates complaints about unfair labor practices. It stores reams of potentially sensitive data, from confidential information about employees who want to form unions to proprietary business information.
The DOGE employees, who are effectively led by White House adviser and billionaire tech CEO Elon Musk, appeared to have their sights set on accessing the NLRB's internal systems. They've said their unit's overall mission is to review agency data for compliance with the new administration's policies and to cut costs and maximize efficiency."
"But according to an official whistleblower disclosure shared with Congress and other federal overseers that was obtained by NPR, subsequent interviews with the whistleblower and records of internal communications, technical staff members were alarmed about what DOGE engineers did when they were granted access, particularly when those staffers noticed a spike in data leaving the agency. It's possible that the data included sensitive information on unions, ongoing legal cases and corporate secrets — data that four labor law experts tell NPR should almost never leave the NLRB and that has nothing to do with making the government more efficient or cutting spending."
Meanwhile, according to the disclosure and records of internal communications, members of the DOGE team asked that their activities not be logged on the system and then appeared to try to cover their tracks behind them, turning off monitoring tools and manually deleting records of their access — evasive behavior that several cybersecurity experts interviewed by NPR compared to what criminal or state-sponsored hackers might do.
https://www.npr.org/2025/04/15/nx-s1-5355896/doge-nlrb-elon-musk-spacex-security

2025-04-03 15:55:38 UTC

- reply

I like Dorothy Parker's version better: You can lead a whore to culture, but you can't make him think.

2025-04-03 15:52:27 UTC

Imagine being so drunk on the Kool-Aide that you can't listen to someone trying to help your company. Reached out to an executive at a manufacturing company about a security issue, and their reply was: "I'd like to help you. However, in checking out your website it is clear you suffer from Trump Derangement Syndrome. I don't like the guy but he is our President and a refreshing change from a mentally incapacitated do nothing President." Oh well, I tried.

2025-04-01 13:33:23 UTC

April Fools, a.k.a. that day everyone and his mom tries their hand a bad knock-knock joke. Fair warning: I ain't boosting shit today.

2025-03-31 17:45:24 UTC

My name keeps getting mentioned in Top 10 infosec influencers lists, or Top[arbitrary number here] security professionals to follow. Here's the thing: The group responsible for all these "awards" has tried to get me to participate in their group activities (podcast interviews, etc. I always decline or ignore). But near as I can tell their top people lists have mostly the same people on them that have somewhat thin backgrounds in the cybers. So it seems to be some kind of circular promotion thing, possibly of the paid variety, which is not something I want to be associated with.
Some people say any publicity is good publicity, but I've never believed that. My instinct as I see these "awards" parroted by the people listed in them is to dig deeper into who the awards givers are. But in the meantime, my inclination is to send a polite note asking them to please not include me in their lists.
Is that a dick move? What would you do?

2025-03-27 13:33:04 UTC

Dear Tesla (ab)users:
There's now an easier way to offload your Swasticars. I give you stealmytesla.com.
Discreet Tesla Acquisition
Having difficulty selling your Tesla without all the hassle and negativity? Maybe its time to consider other options.
Expert Acquisition Team
Our team of experienced Tesla acquisition specialists will ensure a smooth and successful transaction for you.
Anonymous Registration
With Steal My Tesla, you can anonymously register your car to be acquired, transported, and sold within 5-7 business days.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/234/639/211/589/724/original/46c4c888cd14b901.png

2025-03-26 15:22:32 UTC

Maybe there is hope after all
"The Supreme Court on Wednesday upheld federal restrictions aimed at curtailing access to kits that can be easily assembled into homemade, nearly untraceable firearms."
"In a 7-to-2 decision, written by Justice Neil M. Gorsuch, one of the court’s conservatives, the justices left in place requirements enacted during the Biden administration as part of a broader effort to combat gun violence by placing restrictions on so-called ghost guns."
"The ruling in favor of gun regulations is a departure for the court, which has shown itself to be skeptical both of administrative agency power and of gun regulations. Two conservative justices — Samuel A. Alito Jr. and Clarence Thomas — each filed dissents."
"The Biden administration enacted rules in 2022 tightening access to the weapons kits, after law enforcement agencies reported that ghost guns were exploding in popularity and being used to commit serious crimes."
https://www.nytimes.com/2025/03/26/us/politics/supreme-court-ghost-guns.html

2025-03-26 15:14:17 UTC

- reply

it's super easy to do that with signal, or butt dial them. the other day i noticed my butt had somehow populated a picture into signal. it hadn't sent, but that scared the living crap out of me.

2025-03-26 14:57:09 UTC

- reply

I am super curious who the national security advisor Michael Waltz intended to invite to the secret Signal group.
Was it it the US trade representative Jamie Greer? He has the same initials as The Atlantic editor in chief Jeffrey Goldberg.

2025-03-26 14:38:27 UTC

The Atlantic has released the entire Signal chat showing Hegseth's detailed attack plans against the Houthis. Why not, right? The administration claims none of it is classified.
In the group chat, Hegseth posted:
“1215et: F-18s LAUNCH (1st strike package)”
“1345: ‘Trigger Based’ F-18 1st Strike Window Starts (Target Terrorist is @ his Known Location so SHOULD BE ON TIME – also, Strike Drones Launch (MQ-9s)”
“1410: More F-18s LAUNCH (2nd strike package)”
“1415: Strike Drones on Target (THIS IS WHEN THE FIRST BOMBS WILL DEFINITELY DROP, pending earlier ‘Trigger Based’ targets)”
“1536 F-18 2nd Strike Starts – also, first sea-based Tomahawks launched.”
https://www.theatlantic.com/politics/archive/2025/03/signal-group-chat-attack-plans-hegseth-goldberg/682176/
h/t @npub1l2h…wcr0

2025-03-26 13:28:14 UTC

- reply

Karl is really mad, too. Although, I think maybe that anger is misdirected. Karl's response is typical LinkedIn Reply Guy whataboutism stuff ("where were you when Hunter Biden's laptop..")
Karl's profile says he is a f/t cybersecurity program architect for Microsoft's Asia/Pacific region. I feel safer already.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/228/939/468/173/758/original/f557401a1e4c9cf8.png

2025-03-26 13:10:32 UTC

The Electronic Frontier Foundation has released an open source project called Rayhunter. It is designed to run on an inexpensive (~$20) mobile hotspot and look for signs of mobile spying devices called cell-site simulators. Also known as Stingrays or IMSI catchers, they masquerade as legitimate cellphone towers, tricking phones w/in a certain radius into connecting to the device rather than a tower.
https://www.eff.org/deeplinks/2025/03/meet-rayhunter-new-open-source-tool-eff-detect-cellular-spying
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/228/890/918/778/555/original/fd273063b7e04396.png

2025-03-26 11:56:49 UTC

Reuters has a good follow on some of the reporting about Edward Coristine, a teenage DOGE staffer with years-long connections to the English-language cybercrime community known as the Com.
The story says Coristine ran a website operated by the name "EGodly":
"In 2023, EGodly boasted on its Telegram channel of hijacking phone numbers, breaking into unspecified law enforcement email accounts in Latin America and Eastern Europe, and cryptocurrency theft. Early that year, the group distributed the personal details of an FBI agent who they said was investigating them, circulating his phone number, photographs of his house, and other private details on Telegram.
EGodly also posted an audio recording of an obscene prank call made to the agent's phone and a video, shot from the inside of a car, of an unknown party driving by the agent's house in Wilmington, Delaware at night and screaming out the window, "EGodly says you're a bitch!"
"Reuters could not independently verify EGodly's boasts of cybercriminal activity, including its claims to have hijacked phone numbers or infiltrated law enforcement emails. But it was able to authenticate the video by visiting the same Wilmington address and comparing the building to the one in the footage."
"The FBI agent targeted by EGodly, who is now retired, told Reuters that the group had drawn law enforcement attention because of its connection to swatting, the dangerous practice of making hoax emergency calls to send armed officers swarming targeted addresses. The agent didn't go into detail. Reuters is not identifying him out of concern for further harassment."
"These are bad folks," the former agent said. "They're not a pleasant group."
https://www.reuters.com/world/us/doge-staffer-big-balls-provided-tech-support-cybercrime-ring-records-show-2025-03-26/
My reporting on Coristine ties to the Com:
https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-graduated-from-the-com/

2025-03-26 00:32:48 UTC

Hey everyone. If you're looking for a reliably good, local cause to support with your time or donations consider your local food bank. Reuters reports that many food banks across the country are already strained by rising demand and will have less food to distribute because of least $1 billion in federal funding cuts and pauses by the POTUS.
"Hunger in the U.S. has ticked up in recent years with rising inflation and the end of pandemic-era programs that expanded food aid. President Donald Trump's administration has vowed to lower inflation by cutting back on government spending, including two U.S. Department of Agriculture programs that helped schools and food banks buy food from local farms."
"Reuters spoke with food banks in seven states who said cancellation and pauses of the programs meant they expected to offer less produce, meat and other staples in the coming weeks and months, leaving scarcer food for those reliant on free supplies that helped stave off hunger."
"One reason is fewer expected shipments from USDA's The Emergency Food Assistance Program (TEFAP), one of the agency's core nutrition programs that buys food from farmers and sends it to food pantries, some of the organizations said."
https://www.yahoo.com/news/trump-cuts-hit-struggling-food-101121569.html
https://www.cleveland.com/news/2025/03/too-stupid-for-words-trump-pulls-back-20-semi-trucks-of-food-from-clevelands-food-bank.html

2025-03-24 20:23:53 UTC

Let's be honest: Haven't we all at one point drunk texted a reporter an invitation to discuss plans for an upcoming military attack? Something tells me Hegseth will be hitting the sauce pretty hard tonight.

2025-03-24 18:24:56 UTC

I've noticed something that I think is worth pointing out: pretty much ALL of the pushback I have gotten on LinkedIn over the past few months over stories critical of this administration has come from men in IT. Many of whom no doubt idolize Musk, who in their minds can walk on water.
Conversely, the response almost universally I've seen from female non/male people in IT and security professionals on LinkedIn has been a great deal more appropriate, i.e. horror, disgust and revulsion for the way this administration is treating federal employees, veterans, the courts, judges, lawyers, journalists, and important, long-standing U.S. policy interests.
I guess what I'm saying is nobody should expect the men in IT to lead the resistance. So many of them are like this guy: angry, aggressive, and really excited about the good old US of A going back to the 80s. Like the 1880s.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/218/779/446/400/286/original/f1b56c099f5eef04.png

2025-03-21 19:13:54 UTC

New, by me:
Police in at least two U.S. states last week independently announced arrests of Chinese nationals accused of perpetrating a novel form of tap-to-pay fraud using mobile devices. Details released by authorities so far indicate the mobile wallets being used by the scammers were created through online phishing scams, and that the accused were relying on a custom Android app to relay tap-to-pay transactions from mobile devices located in China.
Asked for specifics about the mobile devices seized from the suspects, Lyon said “tap-to-pay fraud involves a group utilizing Android phones to conduct Apple Pay transactions utilizing stolen or compromised credit/debit card information,” [emphasis added].
https://krebsonsecurity.com/2025/03/arrests-in-tap-to-pay-scheme-powered-by-phishing/
I wrote last month in depth about the China-based phishing cartels behind these innovations in payment card fraud. One of them is selling an Android app which -- for $500 a month -- will let you use your phone to relay an NFC transaction halfway around the world.
https://krebsonsecurity.com/2025/03/arrests-in-tap-to-pay-scheme-powered-by-phishing/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/202/010/577/025/449/original/4e9e9a4fb726a4df.png

2025-03-21 18:59:18 UTC

Someone riddle me this: Why would Trump's Jan. 29 Executive Order on "Additional Measures to Combat Anti-Semitism" be given the executive order number it has, which is 14188? Surely, even with the flood of EOs this POTUS has issued already, we're not up to that number.
So where did it come from? Check out the Wikipedia entry for "fourteen words," also abbreviated 14 or 1488), which says it is a reference to "two slogans originated by the American domestic terrorist David Eden Lane, one of nine founding members of the defunct white supremacist terrorist organization The Order, and are accompanied by Lane's "88 Precepts". The slogans have served as a rallying cry for militant white nationalists internationally."
"Lane used the 14-88 numerical coding extensively throughout his spiritual, political, religious, esoteric, and philosophical tracts and notably in his "88 Precepts" manifesto. According to the Southern Poverty Law Center, inspiration for the Fourteen Words "are derived from a passage in Adolf Hitler's autobiographical book Mein Kampf."
"The Fourteen Words have been prominently used by neo-Nazis, white power skinheads and certain white nationalists and the alt-right. "88" is used by some as a shorthand for "Heil Hitler", 'H' being the 8th letter of the alphabet,[16] though Lane viewed Nazism along with America as being part of the "Zionist conspiracy."
https://en.m.wikipedia.org/wiki/Fourteen_Words
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/201/952/200/036/027/original/2e82259a78ed9369.png

2025-03-21 15:43:05 UTC

Wow. The US Treasury Dept. today announced it is lifting sanctions on Tornado Cash, a cryptocurrency mixing service that state-sponsored hackers from North Korea have been massively using to launder their stolen billions.
"Based on the Administration’s review of the novel legal and policy issues raised by use of financial sanctions against financial and commercial activity occurring within evolving technology and legal environments, we have exercised our discretion to remove the economic sanctions against Tornado Cash as reflected in Treasury’s Monday filing in Van Loon v. Department of the Treasury."
https://home.treasury.gov/news/press-releases/sb0057
h/t to @npub1ntc…9u8j for the heads up. Weaver said: "The US government has just said "money laundering is legal as long as the process is automated."
"Every wei that flows through Tornado Cash, even if 'legitimate,' is helping the North Korean nuclear regime by hiding illegitimate flows," Weaver told me.
Here's Treasury sanctioning Tornado Cash in 2022: https://home.treasury.gov/news/press-releases/jy0916

2025-03-20 23:39:30 UTC

- reply

Sorry, "the Fediverse chick." WTF Nicole? Currently at @npub10s0…r64r

2025-03-20 22:26:48 UTC

At some point, this administration and its mouthpieces like Musk and Stephen Miller are going get a federal judge killed with their rhetoric that judges should be impeached for ruling against the president. Every time they do this they are effectively painting a target on judges for their more extreme MAGA base.
From WaPo: "Stephen Miller, one of Donald Trump’s closest advisers at the White House, is escalating the administration’s attacks on federal judges who have ruled against the president’s recent orders, labeling them as rogue Marxists thwarting the will of American voters."

2025-03-20 21:45:47 UTC

I'm dying over here. This guy says he's created the world's first AI-based call center for actively disrupting and screwing with scammers. Their AI bots are taking live phonecalls at scale and keeping the scammers on the line for hours, and sometimes taunting the scammers. They're tying up entire scam call centers. So entertaining.
https://www.youtube.com/watch?v=ZDpo_o7dR8c

2025-03-20 14:41:21 UTC

Sure, it's totally normal for the US to cover up indefensible and ongoing atrocities by Russia.
"The Trump administration cut funding to Yale University’s Humanitarian Research Lab, which was compiling a database of alleged Russian war crimes, including the abduction of an estimated 35,000 children from occupied areas of Ukraine, last month."
"Using satellite imagery and other surveillance systems provided through the US government, the Yale researchers were monitoring 116 sites in Russia."
"A Yale source said the US state department deleted the evidence which would have been used as part of rescue efforts to get the children home to Ukraine. It would also have been used to prosecute those behind their abductions – including Russian president Vladimir Putin."
https://www.independent.co.uk/news/world/europe/trump-ukraine-children-russia-war-kidnapping-evidence-b2717730.html
More reporting from USAToday:
https://www.usatoday.com/story/news/world/2025/03/19/trump-abducted-ukrainian-kids/82541604007/

2025-03-20 13:36:01 UTC

Published another update about all the winning by DOGE and the POTUS on cybery stuff lately, and their efforts to rehire and then place on *paid* leave some 25,000 government employees they illegally fired, including > 100 people at the Cybersecurity & Infrastructure Security Agency (CISA). From the story:
"Both the message to fired CISA workers and DOGE's ongoing efforts to bypass vetted government networks for a faster Wi-Fi signal are emblematic of this administration's overall approach to even basic security measures: To go around them, or just pretend they don't exist for a good reason.
On Monday, The New York Times reported that U.S. Secret Service agents at the White House were briefly on alert last month when a trusted captain of Elon Musk's "Department of Government Efficiency" (DOGE) visited the roof of the Eisenhower building inside the White House compound -- to see about setting up a dish to receive satellite Internet access directly from Musk's Starlink service.
The White House press secretary told The Times that Starlink had "donated" the service and that the gift had been vetted by the lawyer overseeing ethics issues in the White House Counsel’s Office. The White House claims the service is necessary because its wireless network is too slow."
https://krebsonsecurity.com/2025/03/doge-to-fired-cisa-staff-email-us-your-personal-data/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/195/014/637/815/937/original/0854764afd4dc98a.png

2025-03-19 16:06:56 UTC

I feel like we haven't really processed or even talked much about the extent to which US federal agencies have transitioned to communicating press releases and important information on X. Want to interact with your government? Sure, just do it through X. If you let that really sink in, it's a fairly profound and terrifying shift, IMHO.

2025-03-19 02:45:13 UTC

From Vanity Fair:
"More than 40 years ago, Congress established the U.S. Institute of Peace (USIP) as an “independent, nonprofit, national institute” to “promote international peace and the resolution of conflicts.”
The Department of Government Efficiency just took it over.
“What has happened here today is an illegal takeover by elements of the executive branch of a private nonprofit,” USIP’s now-fired CEO George Moose told the Associated Press and others Monday, following a police standoff that ended in DOGE officials entering the building.
Moose said the building is not federally owned and that its employees do not work for the executive branch, putting its operations outside of DOGE’s purview. “Somehow, all of those arguments have not prevailed,” said Moose, who promised to bring legal action against DOGE, which he said “has broken into our building.”
https://www.vanityfair.com/news/story/doge-seizes-control-of-us-peace-institute

2025-03-14 13:18:36 UTC

Called it. Wrote this back in Sept. 2024, about a clever Windows Powershell phishing scam that was targeting developers at the time. It uses a fake CAPTCHA that asks visitors to distinguish themselves from bots by pressing a combination of keyboard keys that causes Microsoft Windows to download password-stealing malware. Everyone said, bah, devs will never fall for this. Maybe, I said, but your average user would for sure.
Judging from the number of recent media reports, it appears this one is pretty widespread at the moment.
https://krebsonsecurity.com/2024/09/this-windows-powershell-phish-has-scary-potential/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/160/976/012/619/024/original/7660ca7800fa00a1.png

2025-02-28 22:09:57 UTC

- reply

Don't even get me started on the WWIII chants. Past American presidents have gone out of their way to avoid uttering these words, because they invariably fill people with dread and feelings of dystopia. But you see, the current president would like nothing more.

2025-02-28 22:05:53 UTC

I am suck a fscking tyrant on LinkedIn right now. I've been posting pretty much the same comments over there, but deleting and blocking any useful idiots who try to rationalize any of this. Man, I hate moderating my LinkedIn feed, but I detest whataboutism and the endless sychopancy.

2025-02-28 20:50:36 UTC

How much more proof do we need that this administration is completely compromised? There is zero reason for the US to relax any offensive digital actions against Russia. If anything, we should be applying more.
Martin Matishak over at The Record writes that the former Fox news host turned Defense Secretary Pete Hegseth last week ordered U.S. Cyber Command to stand down from all planning against Russia, including offensive digital actions.
"Hegseth gave the instruction to Cyber Command chief Gen. Timothy Haugh, who then informed the organization's outgoing director of operations, Marine Corps Maj. Gen. Ryan Heritage, of the new guidance, according to these people, who spoke on the condition of anonymity because of the matter’s sensitivity."
"The order does not apply to the National Security Agency, which Haugh also leads, or its signals intelligence work targeting Russia, the sources said."
"While the full scope of Hegseth’s directive to the command remains unclear, it is more evidence of the White House’s efforts to normalize ties with Moscow after the U.S. and international allies worked to isolate the Kremlin over its 2022 invasion of Ukraine."
https://therecord.media/hegseth-orders-cyber-command-stand-down-russia-planning

2025-02-28 20:29:31 UTC

Honestly, I don't know how Zelenksy didn't punch the cheetoh that whole time. That man has remarkable restraint.
I have never been so embarrassed for our country. What a thug. "World War III," he says over and over, echoing Putin's sabre rattling throughout his invasion. Even sitting in the White House, Trump is echoing the Kremlin line.
What's even more despicable is that the spineless, gutless GOP will say nothing about this indefensible show of gutlessness and cowardice by their leader. Imagine that: Being afraid of cowards makes you one.

2025-02-28 20:18:59 UTC

New, from me:
One of the most notorious providers of abuse-friendly “bulletproof” web hosting for cybercriminals has started routing its operations through networks run by the Russian antivirus and security firm Kaspersky Lab, KrebsOnSecurity has learned. Kaspersky did not respond to multiple requests for comment.
Security experts say the Russia-based service provider Prospero OOO (the triple O is the Russian version of “LLC”) has long been a persistent source of malicious software, botnet controllers, and a torrent of phishing websites. Last year, the French security firm Intrinsec detailed Prospero’s connections to bulletproof services advertised on Russian cybercrime forums under the names Securehost and BEARHOST.
"If you need a server for a botnet, for malware, brute, scan, phishing, fakes and any other tasks, please contact us," BEARHOST's ad on one forum advises. "We completely ignore all abuses without exception, including SPAMHAUS and other organizations."
https://krebsonsecurity.com/2025/02/notorious-malware-spam-host-prospero-moves-to-kaspersky-lab/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/083/353/323/378/955/original/f72e2645154f15da.png

2025-02-26 13:28:34 UTC

- reply

Strong disagree. The federal government is being made to publish imaginary figures, and it is very much the job of the media to hold them to account on that. We need more, not less, careful documentation of the hypocrisy, greed, conflicts of interest etc.

2025-02-26 12:56:53 UTC

The top story on WaPo right now deserves its spot: "Elon Musk’s business empire is built on $38 billion in government funding."
"Government infusions at key moments helped Tesla and SpaceX flourish, boosting Musk’s wealth"
https://www.washingtonpost.com/technology/interactive/2025/elon-musk-business-government-contracts-funding/?itid=hp-top-table-main_p001_f001
That's more than half of what the DOGE website says it has "saved" through layoffs, firings, contract terminations and funding freezes.
BTW the NYT had a story yesterday that talked about how DOGE quietly removed many billions from its "wall of receipts" after a slew of media outlets called total BS on their math.
https://www.nytimes.com/2025/02/25/upshot/doge-spending-cuts-changed.html
"These were the original five largest savings on its list:
An $8 billion cut at Immigration and Customs Enforcement. The actual contract in question was worth $8 million. The mistake seemed to stem from an earlier, erroneous entry in a federal contracting database. But contracting experts said that the service should have known better: ICE’s entire budget is about $8 billion, making it implausible that one contract could be so large. The U.S. DOGE Service adjusted the figure on the site after The Times wrote about it, and said in a post on Mr. Musk’s X platform that it had “always used the correct $8M in its calculations.”
Three $655 million cuts at the U.S. Agency for International Development. This was actually a single cut that was erroneously counted three times, as first reported by CBS News. That mistake also seemed to reflect a misunderstanding of the way government contracts work; they sometimes have “ceiling values” far in excess of what will be spent. Experts said this cancellation was unlikely to produce anything close to $655 million in savings even once. Now, the site lists a much smaller savings for these three cancellations: $18 million in total.
A $232 million cut at the Social Security Administration. Here, Mr. Musk’s organization appeared to have mistakenly believed that the agency had canceled a huge information technology contract with the defense contracting giant Leidos. Instead, as reported by The Intercept, it had canceled only a tiny piece of it: a $560,000 project to let users mark their gender as “X.” The DOGE site now shows that small cut instead.
Some of the new canceled contracts added this week appear to make some of the same types of errors.
The largest savings on the latest version of its list is a $1.9 billion cut at the Treasury Department. But The Times reported last week that this contract was canceled last fall, when Joseph R. Biden Jr. was president — and when DOGE did not yet exist."

2025-02-26 00:11:24 UTC

I'm trying to understand why one of the worst bulletproof hosting providers out there today -- Russia-based Prospero OOO -- is now getting transit to the larger internet via the antivirus and security firm Kaspersky Lab?
https://www.cidr-report.org/cgi-bin/as-report?as=AS200593
Prospero (AS200593) has been tied to multiple bulletproof hosting providers advertising on Russian cybercrime forums that say they will ignore all abuse complaints. It operates an insane amount of phishing domains at any given time, and it's been connected with ransomware C2s and distribution of ransom-adjacent malware operations like SocGholish and GootLoader. But don't take my word for it. Have a look at just the recent stuff:
https://urlscan.io/search/#page.asn%3Aas200593
https://www.virustotal.com/gui/search/as200593
https://www.intrinsec.com/prospero-proton66-tracing-uncovering-the-links-between-bulletproof-networks/
I understand that Kaspersky Lab (AS209030) provides DDoS protection as one of its services, and its networks do indeed seem to include several large banks (Alfa Bank, and the Russian police, e.g.). But if that's really what this is, that's almost worse than Kaspersky just letting these providers transit their network.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/067/278/914/606/081/original/47b4c83c445e5d7d.png

2025-02-25 03:22:11 UTC

- reply

Martin is in good company these days. Here's Dan Bongino, a former Secret Service agent turned conservative talk show host who was just named as deputy director of the FBI.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/062/372/556/332/081/original/8445f52ade3ce433.png

2025-02-25 03:17:06 UTC

This is the US Attorney for the District of Columbia taking a shot at the Associated Press (presumably over their refusal to call The Gulf of Mexico by another name), while calling the Justice Department "President Trump's lawyers," which I'm sure isn't infuriating at all to a lot of decent people at the DOJ. Just incredible.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/062/349/145/016/226/original/cbaaf89ac0349ce3.png

2025-02-24 18:08:34 UTC

- reply

It's interesting to see the difference with which WaPo and NYTs are treating this story. The former has it all over the top of the site. NYT needs to work on a more forceful teaser:
U.S. Clashes With European Allies at the U.N. Over Ukraine
The United States voted against a Ukrainian resolution, backed by most of Europe, demanding Russian withdrawal from Ukraine — a sharp shift in American policy.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/060/190/922/670/134/original/88324c3e6332a19a.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/060/190/983/775/210/original/0729670eb27bfa4a.png

2025-02-24 17:37:06 UTC

This apparently just happened.
"The United States voted with Russia, North Korea, Belarus and 14 other Moscow-friendly countries Monday on a resolution condemning Russian aggression in Ukraine and calling for its occupied territory to be returned that passed overwhelmingly in the U.N. General Assembly on Monday."
https://www.washingtonpost.com/national-security/2025/02/24/united-nations-ukraine-russia-trump

2025-02-24 16:28:55 UTC

What's the best thing you've read today? Mine's this, from Marisa Kabas on bsky:
"This morning at Dept of Housing and Urban Development (HUD) HQ in DC as mandatory return to office began, this video played on loop for ~5 mins on screens throughout the building, per agency source."
"Building staff couldn’t figure out how to turn it off so sent people to every floor to unplug TVs."
https://bsky.app/profile/marisakabas.bsky.social/post/3liwlwvvq6k2s

2025-02-21 01:51:38 UTC

Oh yes, this president really advocates for the working class. I'm sure whatever billionaire gets the contract to provide the mail will charge such reasonable fees.
"President Donald Trump is preparing to dissolve the leadership of the U.S. Postal Service and absorb the independent mail agency into his administration, potentially throwing the 250-year-old mail provider and trillions of dollars of e-commerce transactions into turmoil."
"Trump is expected to issue an executive order as soon as this week to fire the members of the Postal Service’s governing board and place the agency under the control of the Commerce Department and Secretary Howard Lutnick, according to six people familiar with the plans, who spoke on the condition of anonymity out of fear of reprisals."
https://www.washingtonpost.com/business/2025/02/20/trump-usps-takeover-dejoy/

2025-02-21 00:36:29 UTC

I always smile when I see a RT of this post, because it basically means I have a new follower. I've had this post pinned on my profile here for some time, which is nice because it's still true!
https://infosec.exchange/@briankrebs/109880177018417627
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/039/070/587/678/372/original/43bdce1fd36818f3.png

2025-02-20 23:51:12 UTC

- reply

I misspoke just now: We do have third-party content on the site: Google's RECAPTCHA, which is just to keep people from spamming my contact form (which most definitely DOES happen without it there). But for some reason ad blockers block that captcha, and so people contact me all indignant that my contact form doesn't work and that I'm blocking this or that. No, it's because your ad blocker doesn't like my CAPTCHA.

2025-02-20 23:14:42 UTC

I've been asked quite a bit lately from newer followers wondering how exactly I make a living grumbling publicly about security failures. I guess it seems like a somewhat desirable profession :p
What does 15 years as an independent website get you? We get between 1-2 million visitors a month (sometimes freakishly more). I don't know where it all comes from, but it's not from my promotion, which is largely limited to here and occasionally on LinkedIn. But others might. With very few exceptions, I don't attempt to influence any of that.
We have nearly 60,000 subscribers to our email newsletter, which only goes out when I publish a story -- generally two times a week. And it's pretty basic: a blurb about the new story and a link, followed by a similarly short blurb from a sponsor and a link. It's all plain text. Zero HTML in my newsletter. We did a recent review of subscribers based on domains and found we have a significant share of global financial institutions subscribed.
I also didn't realize until recently how many RSS readers we have. Last time I checked we had ~ 200,000 people who read KrebsOnSecurity content monthly with RSS.
These are some of the most loyal and long-time readers we have, but it still bothers me that their readership almost never supports the ads on the site. Which, btw, are all locally served and vetted by me. All like two dozen of them. We have no third-party content on krebsonsecurity.com. The last thing I want is for a security blog to become a security threat.
I'm writing this partly in response to a number of readers who've complained they can't access the site from a VPN or from Tor. Since the epic Mirai attack from 2016, our site has been behind the auspices of Google Shield, which seems to have been more aggressive of late in blocking access from different VPNs and from Tor (I don't have this firsthand, just from readers). My point is, there are lots of ways we make our content available for free, to anyone and everyone. That has always been my goal, and will be as long as I am still publishing.

2025-02-19 17:34:51 UTC

One frustrating aspect of trying to write about all the incredibly reckless and risky actions taken by this administration with govt data is that by the time you're done writing, half the stuff in your story is outdated already, because they've reversed themselves, or they've been reversed. Or, and this is usually the most frequent cause: Because they've gone and done something even more colossally stupid, cruel and/or unwise.
I have not missed this aspect of reporting on the Trump administration at all. But it is absolutely true that their flood-the-zone-with-stupid approach really can become something like a mental ddos on journalists. And ofc that's intentional.

2025-02-19 14:31:43 UTC

CNN reports the Social Security Administration's acting commissioner Michelle King’s departure from the agency over the weekend – after more than 30 years of service – was initiated after King refused to provide DOGE staffers at the SSA with access to sensitive information, the people said Monday.
White House has replaced her as acting commissioner with Leland Dudek, who currently works at the SSA.
Here's a now-deleted self-serving confession from Dudek, which speaks volumes about the pervasive cowardice that is essential for this administration to get what it wants.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/031/028/349/184/999/original/04941b05ff72ee64.png

2025-02-18 20:29:56 UTC

If you want to learn how Chinese phishing or "smishing" groups are turning phished card data into mobile wallets, check out today's story. The innovation coming out of these groups is remarkable, and includes mobile apps that let thieves relay "ghost tap" NFC transactions to a payment terminal from halfway around the world.
What I find most remarkable is how millions of businesses have spent years and billions of dollars upgrading payment terminals to use more secure chip-based cards. And now these phishers come along and just bypass all of that, creating Apple and Google mobile wallets with the phished card data and a one-time code.
Here's the lede:
Carding — the underground business of stealing, selling and swiping stolen payment card data — has long been the dominion of Russia-based hackers. Happily, the broad deployment of more secure chip-based payment cards in the United States has weakened the carding market. But a flurry of innovation from cybercrime groups in China is breathing new life into the carding industry, by turning phished card data into mobile wallets that can be used online and at main street stores.
https://krebsonsecurity.com/2025/02/how-phished-data-turns-into-apple-google-wallets/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/026/740/763/204/108/original/90f989566c8a379e.png

2025-02-16 13:28:13 UTC

Seeing as we're paving over federal websites left and right, maybe we can finally address the issue of open redirects on .gov websites? This isn't a new issue and it's not going away. But probably we shouldn't see dozens of pages of porn results all getting indexed by search engines by abusing redirects on the Centers for Disease Control (CDC) website, for example:
https://www.google.com/search?q=site:cdc.gov&client=ubuntu-sn&hs=V5N&sca_esv=4986d38ff6c52357&channel=fs&source=lnt&tbs=qdr:d&sa=X&ved=2ahUKEwjU0c2NnciLAxV6STABHey_JpoQpwV6BAgDEAg&biw=1658&bih=863&dpr=1

2025-02-15 22:20:38 UTC

For the past month I've been receiving regular emails from strangers asking why they'd been banned from the chat. I started getting concerned when one guy complained he didn't understand the rules and thought CP stood for cheese pizza.
It was clear that my contact information was being used for some sketchy chat server, but despite my replying to each message and asking for a server name or address, nobody has replied until today.
Turns out there are a bunch of illegal pay-TV streaming services that feature a link to my contact form inside their contact form. I asked ppv[.]land to remove my info from their sites. Let's see what asking nicely does.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/114/010/223/541/296/534/original/386b96a874df6c68.png

2025-02-13 20:23:57 UTC

Today's piece is another recent post here repurposed into a story.
In mid-March 2024, KrebsOnSecurity revealed that the founder of the personal data removal service Onerep also founded dozens of people-search companies. Shortly after that investigation was published, Mozilla said it would stop bundling Onerep with the Firefox browser and wind down its partnership with the company. But nearly a year later, Mozilla is still promoting it to Firefox users.
It’s a win-win for Mozilla that they’ve received accolades for their principled response while continuing to partner with Onerep almost a year later. But if it takes so long to find a suitable replacement, what does that say about the personal data removal industry itself?
https://krebsonsecurity.com/2025/02/nearly-a-year-later-mozilla-is-still-promoting-onerep/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/998/437/688/833/102/original/fbc12c1a33ef18a4.png

2025-02-12 15:19:30 UTC

A group of 20-somethings with names like "Big Balls" gain unauthorized access to your servers, delete data, take your website down, and now you can't serve your customers and your organization goes belly up unless you pay money to a mafia boss.
Sounds a lot like ransomware, doesn't it? When your government starts imitating ransomware playbooks, it's a four-alarm fire. At least in theory one can negotiate with ransomware actors.

2025-02-11 18:49:19 UTC

The NYT has published a useful graphic showing all the agencies with investigations into or regulatory battles with of Musk's companies that have seen staffing cuts, including the firing of top officials.
https://www.nytimes.com/2025/02/11/us/politics/elon-musk-companies-conflicts.html
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/986/737/102/705/605/original/a14749095e92d332.png

2025-02-10 17:15:48 UTC

Judd Legum writes: "Today, the NSA is planning a "Big Delete" of websites and internal network content that contain any of 27 banned words, including "privilege," "bias," and "inclusion," a NSA source tells Popular Information."
"The massive purge is creating chaos, taking down "mission-related" work"
https://bsky.app/profile/juddlegum.bsky.social/post/3lhtdftmwvk2i
https://popular.info/p/the-nsas-big-delete
The list of prohibited words is kinda bonkers, not least of which because it totally ignores the fact that some of these are actually technical terms of art in intel gathering and cybersecurity. For example: "confirmation bias," "privilege," "equity."
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/980/710/653/576/187/original/5959da0579f0b8ef.png

2025-02-09 22:41:15 UTC

- reply

Looks like Inventry is a VC project of Michael Fertik, a venture capitalist and ceo of the AI company modelcode.ai.
https://heroicvc.com/
Fertik's website says he is also the chairman and founder of reputation.com.
https://www.michaelfertik.com/
Seems like a nice guy.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/976/332/818/558/130/original/fd01f69cc3fa4c37.png

2025-02-09 19:37:51 UTC

Was reading this Substack post about US gov cloud servers being pointed at AI companies. It observed that a number of US gov cloud servers on AWS are now pointing to IPs at a company called inventry.ai
https://cyberintel.substack.com/p/doge-exposes-once-secret-government
I checked on a few of the IPs mentioned in this writeup, and it checks out. E.g., the IP address 18.253.166.131 from 2020-2024 was tied to us-gov-east-1.compute.amazonaws.com and is part of the gov cloud infrastructure at AWS. Loading that IP into DomainTools Iris, we can see the SSL cert assigned to them is for inventry.ai.
Methinks we need to know more about Inventry.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/975/597/478/835/418/original/a17a3ddd8ef4e5f6.png
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/975/597/487/986/907/original/cfeb5aae35a91631.png

2025-02-09 16:56:08 UTC

U.S. intelligence, law enforcement candidates face Trump loyalty test
Candidates for top intelligence and law enforcement jobs were asked to give “yes” or “no” responses to questions such as: Was Jan. 6 “an inside job?”
These people said that two individuals, both former officials who were being considered for positions within the intelligence community, were asked to give “yes” or “no” responses to the questions: Was Jan. 6 “an inside job?” And was the 2020 presidential election “stolen?”
These individuals, who did not give the desired straight “yes” answers, were not selected. It is not clear whether other factors contributed to the decision.
https://www.washingtonpost.com/national-security/2025/02/08/trump-administration-job-candidates-loyalty-screening/

2025-02-09 00:08:29 UTC

- reply

Here's one of but many examples.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/971/007/026/009/072/original/f817ad747a082507.png

2025-02-08 19:54:10 UTC

I've started posting on LinkedIn all the unconstitutional shit Trump and Musk are doing to undermine the security and integrity of our government. Mainly because that crowd needs to hear it most. It's incredible how many people in the infosec space are still defending the actions of DOGE and its dear leader(s). And they're not all crypto bros and AI peddlers; we're talking about people in some pretty important roles, tech-wise.
But at least when they reply with the inevitable "stay in your lane" or "I used to like you when you stayed out of politics," they are on record as complicit and totally okay with what is going on.

2025-02-08 16:46:54 UTC

Just, wow.
@npub14j8…pjuf has an important piece about the Trump administration's threat to pull funding from the National Center for Missing and Exploited Children (NCMEC) unless they remove all referenced to LGBTQ+ issues starts "deadnaming" trans kids.
"After years of screaming “save the children” while baselessly accusing others of exploiting kids, the Trump administration is now trying to destroy the actual infrastructure that saves children. This one crosses from standard MAGA hypocrisy into genuinely evil territory.
I’m one of those people who doesn’t think you can (or should) call most people inherently “bad,” but if you support what the Trump administration is doing here, you are a bad person.
According to multiple reports, including former NCMEC board member Don McGowan and independent journalist Maria Kabas (who has been breaking story after story lately), the Justice Department informed the National Center for Missing and Exploited Children that it will pull their entire funding if it doesn’t remove all references to LGBTQ+ issues and starts “deadnaming” trans kids. According to the Verge, NCMEC has already started complying and has removed at least three documents..."
This fits every single example of illegal stuff this administration has done so far: Accuse others of what you intend to do all along.
https://www.techdirt.com/2025/02/07/magas-sickening-hypocrisy-from-save-the-children-to-defund-the-org-that-actually-saves-children/

2025-02-08 01:22:40 UTC

So I finally turned a recent popular post here into a proper story.
Teen on Musk’s DOGE Team Graduated from ‘The Com’
Wired reported this week that a 19-year-old working for Elon Musk‘s so-called Department of Government Efficiency (DOGE) was given access to sensitive US government systems even though his past association with cybercrime communities should have precluded him from gaining the necessary security clearances to do so. As today’s story explores, the DOGE teen is a former denizen of ‘The Com,’ an archipelago of Discord and Telegram chat channels that function as a kind of distributed cybercriminal social network for facilitating instant collaboration.
https://krebsonsecurity.com/2025/02/teen-on-musks-doge-team-graduated-from-the-com/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/965/641/346/625/291/original/13b1e643c915f696.png

2025-02-06 21:47:26 UTC

You've probably read lots of stories about how the upstart Chinese AI chat company DeepSeek could be a security threat, but where's the beef? Well, the people at the mobile app security firm NowSecure have published a security and privacy analysis of the app's design and behavior, and it's not pretty. Here's the lede:
"New mobile apps from the Chinese artificial intelligence (AI) company DeepSeek have remained among the top three “free” downloads for Apple and Google devices since their debut on Jan. 25, 2025. But experts caution that many of DeepSeek’s design choices — such as using hard-coded encryption keys, and sending unencrypted user and device data to Chinese companies — introduce a number of glaring security and privacy risks."
https://krebsonsecurity.com/2025/02/experts-flag-security-privacy-risks-in-deepseek-ai-app/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/959/057/511/514/988/original/3703a451c3bd97e1.png

2025-02-06 17:31:59 UTC

- reply

I almost forgot this detail about about the other Path employee, Eric Taylor: He was involved in a website called Exposed[.]su, which hard doxed a ton of celebrities and people working in top government jobs, including the FBI director, the First Lady, and others.
Taylor was part of a crew that would alert TMZ when they were about to dox and then swat a celebrity, so that cameras could be on the scene when the police arrived in force.
https://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/
https://krebsonsecurity.com/2013/03/credit-reports-sold-for-cheap-in-the-underweb/
https://krebsonsecurity.com/2013/04/swatting-incidents-tied-to-id-theft-sites/

2025-02-06 15:55:53 UTC

- reply

Oh, and the other founder of the DDoS protection company BackConnect is a guy named Tucker Preston, who in 2020 pleaded guilty to paying a DDoS-for-hire service to launch attacks against others.
https://krebsonsecurity.com/2020/01/ddos-mitigation-firm-founder-admits-to-ddos/

2025-02-06 15:37:34 UTC

Drop what you are doing and read this incredible story from Wired, if you can. After that, come back here.
https://www.wired.com/story/edward-coristine-tesla-sexy-path-networks-doge/
It mentions that a 19 y/o man who's assisting Musk's team and who has access to sensitive government systems is Edward Coristine. Wired said Coristine, who apparently goes by the nickname "Big Balls," runs a number of companies, including one called Tesla.Sexy LLC
"Tesla.Sexy controls dozens of web domains, including at least two Russian-registered domains. One of those domains, which is still active, offers a service called Helfie, which is an AI bot for Discord servers targeting the Russian market.While the operation of a Russian website would not violate US sanctions preventing Americans doing business with Russian companies, it could potentially be a factor in a security clearance review."
The really interesting part for me is Coristine's work history at a company called Path Networks, which Wired describes generously as a company "known for hiring reformed black-hat hackers."
"At Path Network, Coristine worked as a systems engineer from April to June of 2022, according to his now-deleted LinkedIn resume. Path has at times listed as employees Eric Taylor, also known as Cosmo the God, a well-known former cybercriminal and member of the hacker group UGNazis, as well as Matthew Flannery, an Australian convicted hacker whom police allege was a member of the hacker group LulzSec. It’s unclear whether Coristine worked at Path concurrently with those hackers, and WIRED found no evidence that either Coristine or other Path employees engaged in illegal activity while at the company."
The founder of Path is a young man named Marshal Webb. I wrote about Webb back in 2016, in a story about a DDoS defense company he co-founded called BackConnect LLC. Working with Doug Madory, we determined that BackConnect had a long history of hijacking Internet address space that it didn't own.
https://krebsonsecurity.com/2016/09/ddos-mitigation-firm-has-history-of-hijacks/
Incidentally, less than 24 hours after that story ran, my site KrebsOnSecurity.com was hit with the biggest DDoS attack the Internet had ever seen at the time. That sustained attack kept my site offline for nearly 4 days.
https://krebsonsecurity.com/2016/09/krebsonsecurity-hit-with-record-ddos/
Here's the real story behind why Coristine only worked at Path for a few months. He was fired after Webb accused him of making it known that one of Path's employees was Curtis Gervais, a serial swatter from Canada who was convicted of perpetrating dozens of swattings and bomb threats -- including at least two attempts on our home in 2014. [BTW the aforementioned Eric Taylor was convicted of a separate (successful) swatting against our home in 2013.
https://krebsonsecurity.com/2017/09/canadian-man-gets-9-months-detention-for-serial-swattings-bomb-threats/
https://krebsonsecurity.com/2017/02/men-who-sent-swat-team-heroin-to-my-home-sentenced/
In the screenshot here, we can see Webb replying to a message from Gervais stating that "Edward has been terminated for leaking internal information to the competitors."
Wired cited experts saying it's unlikely Coristine could have passed a security clearance needed to view the sensitive government information he now has access to.
Want to learn more about Path? Check out the website https://pathtruths.com/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/957/678/933/886/464/original/cfbae1ab725ff25c.png

2025-02-05 23:32:41 UTC

- reply

I contacted Marigold to find out if they had any arrangement to send email for OPM or if they had sent the "fork" campaign emails offering buyouts. Their CIO declined to confirm or deny it.
"Unfortunately we are not able to provide any information to confirm or deny whether any specific entity is a current or former customer of the Marigold family of products, or whether a specific email was sent from our services."

2025-02-05 18:34:56 UTC

A Boston local news station recently interviewed a local man who had his Experian account hijacked after he'd frozen his credit with the big three consumer reporting bureaus. It's unbelievable that Experian still hasn't done jack about this problem that I've written about ad nauseum for years now. (try to ignore the many typos and grammar errors in this story).
https://www.boston25news.com/news/local/25-investigates-sutton-man-turned-credit-bureau-credit-protection-it-led-identity-theft/4LQOGEXFTBE5DJUIROK23E32IU/
Experian's system will allow anyone to assume control over your credit file and freeze merely by re-registering as you using your name, SSN, DoB but a different email address than the one on file. Experian has no problem approving that request, and instead of seeking approval from the existing email address and or phone number, they just say okay. Thieves can then unlock your credit, pull your file, apply for credit, etc. But they will send an automated email to the legitimate account holder's email, saying the account's email address has been changed. No "this wasn't me" option, no asking for approval. Nope. They just say hi we changed your email. Have a nice day!
Experian's response to the Boston news outlet is particularly infuriating, because they're basically saying the system operated as designed. Nevermind that the system is batshit crazy from a security in 2025 perspective.
"A spokesperson told us their protocols worked since Deyoe got that notification when his account was changed. In a written statement Experian said “Protecting consumers’ identities is among our highest priorities. We believe this is an incident of fraud using stolen consumer information.”
Past coverage of this:
https://krebsonsecurity.com/2022/07/experian-you-have-some-explaining-to-do/
https://krebsonsecurity.com/2023/11/its-still-easy-for-anyone-to-become-you-at-experian/

2025-02-05 16:24:46 UTC

Might seem like small potatoes given that we're still dealing with a coup from an unelected billionaire, but we do what we can, right? This story from Nextgov caught my eye, because it points out that OPM didn't the capability to send millions of emails to govt employees at the scale they did recently offering widespread buyouts.
"A lawsuit filed by unnamed federal employees in Washington, D.C. on Monday alleges that OPM violated the E-Government Act of 2002 by failing to conduct and publish required Privacy Impact Assessments before deploying the new email arrangement to collect the responses from government employees."
"Just days before President Donald Trump’s inauguration, OPM did not have the capability to send a mass email of that scale, according to a person familiar with the matter. To send mass emails, the agency had used govDelivery, a cloud communications service provided by public sector IT company Granicus, a different person familiar said."
"The govDelivery contract had restrictions on the volume of emails available to send without incurring added costs, and the agency would not have been able to reach 2.3 million people, the approximate number of all civilian federal employees, the second person added. Both people were granted anonymity to be candid about the sensitive nature of OPM’s email policies."
https://www.nextgov.com/digital-government/2025/01/opms-new-email-system-sparks-questions-about-cyber-compliance/402555/
I had a look at the DNS records for opm.gov and I can't recall ever seeing a TXT record as verbose as this. It includes a large number of network blocks, and references the domain myemma.com as allowed to send email.
Myemma is an email marketing company, which in turn is run by a Nashville, TN company called Marigold.
https://meetmarigold.com/services-agreement/
It also includes Salesforce and the education technology company Leepfrog.
Here is the full TXT record, for posterity:
opm.gov
⇖·⇑·⇓·⇘ TXT
⇖·⇘ "MS=ms15252846"
"MS=ms35255137"
"tbcd7kxrzkw9py7sh6kksn5zfs19l4sy"
"miro-verification=20a9378d17adc5ca3…
9d6221caf668c258d0f7e5b"
"ms-domain-verification=9d72a4cb-
d7c8-4d15-baf9-7f5d507e2972"
"ms-domain-verification=e38d1b0f-
60ce-46ad-a462-c89c61cfe55a"
"7axh6RhNhWWjGH/6UD54HHrA3x0tNqHi2MG…
EN6MM/dyqbLwZqEnDkW+RndcBz2grhSSLNJ9…
qRSBXZxnUG96VWA=="
"v=spf1 ip4:205.131.184.50/32 ip4:
205.131.184.51/32 ip4:205.131.177.
50/32 ip4:205.131.177.151/32 ip4:
205.131.184.52/32 ip4:205.131.177.
152/32 ip4:205.131.184.125/32 "
"ip4:205.131.184.126/32 ip4:205.
131.177.125/32 ip4:205.131.177.
126/32 ip4:73.23.28.0/24 ip4:208.
76.128.0/21 ip4:66.159.72.186/32
ip4:216.230.115.73/32 ip4:216.52.
6.89/32 " "ip4:216.230.115.69/24
ip4:66.169.72.166/24 ip4:216.230.
114.66/24 ip4:216.230.101.69/24
ip4:66.169.72.176/32 ip4:173.201.
193.170/24 ip4:107.20.210.250/32
ip4:52.1.14.157/32 " "ip4:52.6.
44.126/32 ip4:52.207.153.36/32
ip4:65.196.93.7/32 ip4:96.43.152.
64/28 ip4:96.43.152.80/32 " "ip4:
149.19.38.227/32 " "ip4:149.19.
37.167 ip4:149.19.38.138 ip4:149.
19.37.159 ip4:149.19.37.32 ip4:
149.19.37.73 ip4:149.19.37.55 "
"ip4:163.120.86.44 ip4:163.120.
86.62 ip4:149.19.37.109 ip4:149.
19.37.33 ip4:149.19.37.49 ip4:149.
19.37.86 ip4:163.120.86.56 ip4:
163.120.84.26 ip4:149.19.38.45
" "ip4:163.120.84.80 ip4:149.19.
38.69 ip4:149.19.38.87 ip4:149.
19.38.105 ip4:163.120.84.62 ip4:
163.120.84.37 ip4:149.19.38.63
ip4:163.120.84.20 " "ip4:52.61.
131.175/32 ip4:52.61.131.176/28
ip4:52.61.135.175/32 ip4:52.61.
135.176/28 ip4:34.206.132.87/32
ip4:18.233.74.128/32 include:spf.protection.outlook.com" " a:usalearn…ing.net mx:usalearning.net include:e2ma.net exists:%{i}._spf.mta.salesf…orce.com include:leepfrog.com -
all" opm.gov

2025-02-04 19:06:24 UTC

Another ringing endorsement of cryptocurrency:
El Salvador Abandons Bitcoin as Legal Tender After Failed Experiment
https://ticotimes.net/2025/02/02/el-salvador-abandons-bitcoin-as-legal-tender-after-failed-experiment

2025-02-02 15:25:40 UTC

Among all of the grossly unqualified sycophants that Trump has nominated to his cabinet, Kash Patel's nomination to be director of the FBI is probably the most dangerous so far. Here is Patel defending his support for a song he helped produce and promote that glorified the actions of the Jan. 6 rioters.
Patel has asserted that the FBI is an "utterly corrupt" agency. He has repeatedly referred to the news media as "the most powerful enemy of the United States that it's ever seen," and said that he would put "the entire fake news mafia press corps" on his list.
"We're going to come after the people in the media who lied about American citizens, who helped Joe Biden rig the election," Patel told Steve Bannon. "We're going to come after you whether it's criminally or civilly."
The FBI is a lot of things, but corrupt is not one of them, AFAICT. I've never met a bigger of bunch of rule-following people in my life. This man cannot be confirmed.
https://www.youtube.com/watch?v=giesiNFuiVk

2025-01-31 21:16:55 UTC

- reply

Just a bit more from the WaPo exclusive, because it's chilling to think that Musk is now the U.S. Digital Service? WTAF?
Musk has sought to exert sweeping control over the inner workings of the U.S. government, installing longtime surrogates at several agencies, including the Office of Personnel Management, which essentially handles federal human resources, and the General Services Administration, which manages real estate. (Musk was seen on Thursday visiting the GSA, according to two other people familiar with his whereabouts, who also spoke on the condition of anonymity to describe internal matters. That visit was first reported by the New York Times.) His Department of Government Efficiency, originally conceived as a nongovernmental panel, has since replaced the U.S. Digital Service.

2025-01-31 21:12:43 UTC

If it walks, talks, and quack like a coup attempt....
WASHINGTON, Jan 31 (Reuters) - Aides to Elon Musk charged with running the U.S. government human resources agency have locked career civil servants out of computer systems that contain the personal data of millions of federal employees, according to two agency officials.
"Since taking office 11 days ago, President Donald Trump has embarked on a massive government makeover, firing and sidelining hundreds of civil servants in his first steps toward downsizing the bureaucracy and installing more loyalists."
https://www.reuters.com/world/us/musk-aides-lock-government-workers-out-computer-systems-us-agency-sources-say-2025-01-31/
And from The Washington Post:
"The highest-ranking career official at the Treasury Department is departing after a clash with allies of billionaire Elon Musk over access to sensitive payment systems, according to three people with knowledge of the matter, who spoke on the condition of anonymity to describe private talks."
"Typically only a small number of career officials control Treasury’s payment systems. Run by the Bureau of the Fiscal Service, the sensitive systems control the flow of more than $6 trillion annually to households, businesses and more nationwide. Tens, if not hundreds, of millions of people across the country rely on the systems, which are responsible for distributing Social Security and Medicare benefits, salaries for federal personnel, payments to government contractors and grant recipients, and tax refunds, among tens of thousands of other functions."
https://www.washingtonpost.com/business/2025/01/31/elon-musk-treasury-department-payment-systems/

2025-01-31 13:50:32 UTC

- reply

The NYT reports Paramount is in talks to settle a Trump lawsuit against 60 Minutes, which accused the company of deceptively editing an interview with former Vice President Kamala Harris.
Paramount is thinking about settling b/c it's the easiest way to ensure the administration doesn't block their planning multibillion-dollar merger with another company.
All these media companies settling with Trump over flimsy allegations of censorship reminds me of billion dollar companies paying ransomware purveyors thinking it will make them go away. No it won't: It will just encourage them to do it to others. This is no different.
https://www.nytimes.com/2025/01/30/business/media/paramount-trump-cbs-news-settlement.html

2025-01-31 13:39:12 UTC

- reply

The point of mentioning that Alfa Bank story is to show what this administration does to people who report potential security issues. It wasn't to relitigate whether there was anything there or not.

2025-01-30 16:35:25 UTC

- reply

More spineless capitulation to Trump's bullying lawsuits: Meta agrees to pay Trump $25 million to settle a lawsuit he filed in 2021 alleging they'd wrongfully censored him.
https://www.nytimes.com/2025/01/29/technology/meta-trump-lawsuit-settlement.html

2025-01-29 14:13:00 UTC

I'm still marveling at the number of readers who wrote a private "thanks" to say that it took guts to write Monday's story about the new administration's disruptive week for federal cybersecurity efforts. As if the story was somehow taking a big risk, when it was just reporting facts.
https://krebsonsecurity.com/2025/01/a-tumultuous-week-for-federal-cybersecurity-efforts/

2025-01-28 16:15:33 UTC

This is more than just an extremely fragile ego. We will continue to see more of this BS legal DDoS against more media organizations, because it occasionally works (as in the case of ABC News settling for $15M). But even if these lawsuits are tossed they still waste a ton of time and resources that could otherwise be spent on holding our leaders to account.
"Lawyers for board members of the Pulitzer Prizes have asked a Florida court to pause a defamation lawsuit filed against them by President Donald Trump until he has left the White House, arguing that a state court cannot exert direct control over a sitting president. The case centers on the board’s defense of prizes awarded in 2018 to the New York Times and The Washington Post for reporting on Russian interference in the 2016 election."
"How the circuit court rules could have broader implications, particularly if Trump continues to pursue litigation in state courts against media companies or other entities.
In recent months, Trump has sued the Des Moines Register and its former veteran pollster, and CBS over a “60 Minutes” interview with Vice President Kamala Harris. Those cases hinge on a perceived violation of consumer protection laws and are now in federal court."
https://www.washingtonpost.com/style/media/2025/01/27/pulitzers-trump-defamation-board-court/

2025-01-28 04:10:40 UTC

Ever felt like this?
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/904/015/896/680/614/original/04e8d02adc64a528.png

2025-01-27 15:30:50 UTC

- reply

Here's a question: When companies start to see that China's open source AI model Deepsink (R1) can achieve what they hoped with a fraction of the investment needed for OpenAI, will they rip and replace, or double down? It's easy to see how this could go from bad to worse in a very short time.

2025-01-26 19:27:57 UTC

We're living in the most embarrassing timeline here in the US, barreling full speed ahead toward idiocracy.
The irony is that all the stupid hurts the head of people with a brain, to the point where they really don't want to read the news anymore because it's all so awful. I mean, to be fair the news is usually 95 percent bad, but it's also not usually 95 percent despair.

2025-01-26 16:17:30 UTC

- reply

One refrain I tend to hear from a lot of infosec practitioners is that if CF were to somehow make it more inhospitable for abusive sites, that they will all just move to other CDNs in nations where we don't have as much access or influence, such as DDoS-Guard in Russia. Here's the thing, though: A) that would be a nice problem to have, because then the bad sites would be 1000 times easier to block. but also B) those abusive sites already have that option, and they choose CF by an overwhelming number. E.g., in one recent investigation into nearly 5 dozen RU-based cryptocurrency platforms that exchange crypto for cash in Russian banks, all were hosted in Russia or in Russian friendly ISPs, and all but one of them were using Cloudflare. This is just one example, yes, but it's a reality we see everywhere.

2025-01-26 16:06:51 UTC

Cloudflare's CEO recently floated the idea of a service to block AI companies that scrape media content without compensation. It's an intriguing and possibly useful idea, and one that they could probably pull off to some degree. I didn't see this brief interview anywhere else so...
https://www.linkedin.com/feed/update/urn:li:activity:7287149126188691458/
Anyway, this idea is interesting coming from CF because their CEO has long argued that it doesn't want to be in the anti-abuse business absent a court order, as anything less amounts to a slippery slope of censorship. But as long as the CEO is talking about being the arbiter of good and bad, how about we start with something more prosaic, like making it easier for people to decide what parts of CF's network they don't want to see at all.
BTW, Cloudflare's mantra is that they don't "host" content in the conventional sense, but rather they are a pass-through that caches content in multiple places to make it more quickly and globally available. At the same time, their mantra on abuse has always been that selectively booting bad customers without a court order is akin to censorship, i.e. their being able to decide whether some content deserves to be online or not.
But here's the truth: Even if CF were to boot a site off its network, that doesn't "censor" the booted property, which will still have its content served from the original location. And this is why I find their argument for not doing more so disingenuous.

2025-01-23 22:21:03 UTC

Didn't take long: The Nazi in Chief just issued an executive order to support the growth of the cryptocurrency industry, calling for a new plan to regulate a business in which he has substantial personal investments.
According to the NYT, part of the plan would look at creating a national cryptocurrency stockpile, which is a horrible, horrible idea on an epic scale.
https://www.nytimes.com/2025/01/23/technology/trump-crypto-executive-order.html?searchResultPosition=2

2025-01-23 13:55:47 UTC

Some fascinating research out on hacking a Subaru via STARLINK connected vehicle service.
"On November 20, 2024, Shubham Shah and I discovered a security vulnerability in Subaru’s STARLINK connected vehicle service that gave us unrestricted targeted access to all vehicles and customer accounts in the United States, Canada, and Japan.
Using the access provided by the vulnerability, an attacker who only knew the victim’s last name and ZIP code, email address, phone number, or license plate could have done the following:
Remotely start, stop, lock, unlock, and retrieve the current location of any vehicle.
Retrieve any vehicle’s complete location history from the past year, accurate to within 5 meters and updated each time the engine starts.
Query and retrieve the personally identifiable information (PII) of any customer, including emergency contacts, authorized users, physical address, billing information (e.g., last 4 digits of credit card, excluding full card number), and vehicle PIN.
Access miscellaneous user data including support call history, previous owners, odometer reading, sales history, and more.
After reporting the vulnerability, the affected system was patched within 24 hours and never exploited maliciously."
https://samcurry.net/hacking-subaru#introduction
#cars #security #subaru @starlink

2025-01-23 00:20:42 UTC

Oh how far you've fallen, Wirecutter. Recommending HP printers? Nuh uh. They all make you want to pull your hair out, but for my money Brother sucks way less. Unless you absolutely need photo quality printouts or something. I think even Brother put something on their newer models that doesn't let you use third-party toner cartridges unless they have a special chip on them. But when I think of HP, I think of bloat, and proprietary bloat.
https://www.nytimes.com/wirecutter/reviews/best-laser-printer/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/874/799/781/040/765/original/8aec51bbf0fd993f.png

2025-01-22 15:49:55 UTC

Today's story is mostly about how not to do security response.
"The payment card giant MasterCard just fixed a glaring error in its domain name server settings that could have allowed anyone to intercept or divert Internet traffic for the company by registering an unused domain name. The misconfiguration persisted for nearly five years until a security researcher spent $300 to register the domain and prevent it from being grabbed by cybercriminals."
https://krebsonsecurity.com/2025/01/mastercard-dns-error-went-unnoticed-for-years/
https://media.infosec.exchange/infosec.exchange/media_attachments/files/113/872/793/276/514/367/original/ee8d09736c51c14b.png