krebsonsecurity

Spend a few minutes looking at the spam list threads linked in the article. This is not just a few people complaining. E.g.:

https://www.mail-archive.com/search?l=mailop%40mailop.org&q=...

There was a ton of material I did not include in the story, including a story from a company that had a client have 40 million phishing emails sent through their Sendgrid account, which it turns out was set up by an employee long ago who was no longer with the company and had not turned on 2FA (and probably was re-using passwords).

I started reporting this story almost a month ago after receiving more than 3 emails from different IT experts who were really frustrated with the amount of malware and phishing coming from Sendgrid accounts. They were frustrated because they couldn't block Sendgrid outright because too many companies they were expecting regular emails from used the platform.

The day before I published the story, I head from someone else who was getting phishing attacks spoofing Aruba Networks.

With the exception of Amex and Discover and a few others that issue their own cards, Visa and MasterCard don't issue the cards. Thousands of banks and credit unions do. They're the ones responsible for managing fraud on those accounts.

The banks decided the PIN part of chip and PIN only protects against physical theft -- what they call "lost and stolen" fraud.

Assuming that is accurate, given the costs associated in dealing with customers who forget their PINs, and the fact that Visa massively pushed for chip and signature, it's not hard to see why none of the banks wanted to be the hardest card to use in the wallet: Lost and stolen is an infinitesimal amount of loss for them when compared to counterfeits and e-commerce fraud.

It was meant as a joke. From the caption: "Yes, I realize hooded hacker stock photos have become a meme, but that’s the point."

This appears to be related: https://twitter.com/InternetIntel/status/1247100092575813635

https://www.ripe.net/support/service-announcements/accidenta...

Last week a large BGP routing leak (>20k prefixes) occurred in Russia briefly impacted internet traffic around the world.

See the interactive 3D visualization of the incident here: https://map.internetintel.oracle.com/leaks#/id/20764_12389_1...

This story looks familiar. Oh wait: https://krebsonsecurity.com/2019/05/a-tough-week-for-ip-addr...

Thank you for your comment. Made me recall an important bit of reporting that I somehow omitted from the original story (now updated and rectified). O'Connor told me that several years back he got a $20k offer from Microsoft for the domain, but at the time he thought that was too low and didn't reflect the market value of the domain. He turned it down.

This kind of reply reminds me of the vitriolic replies that companies leveled back in the day against the guys who registered donotreply.com.

They would try to alert companies using a domain they didn't own for communications to their customers that this was a bad idea, and soon after got nastygrams from the company's lawyers saying they'd stolen their intellectual property and wiretapped their communications.

http://voices.washingtonpost.com/securityfix/2008/03/they_to...

I never took offense at victims lashing out. If my notifications were at all perfunctory, it was because time was of the essence, and on any given day there were multiple victims to notify.

I often spent huge chunks of my workday on the phone doing these notifications, and some were harder to track down just by Googling a name than others. I never faulted companies for reacting angrily or suspiciously to my calls; it's too bad that's the conclusion you come to from reading what I wrote. If I was ever bitter about anything related to these calls, it was that I rarely ever received so much as a thank you from the victim or their bank.

I generally welcomed the calls from police departments and FBI agents because in many cases it was an opportunity to educate them about a prolific and often hugely damaging form of fraud that they simply weren't aware of at the time. Some of these companies actually went out of business as a result of these attacks, and I did everything I could to minimize that outcome.

Anyway, I almost always found that the law enforcement person on the other end of the line genuinely appreciated my explaining my methods and how these schemes work.

It would be nice if that were the case, but in my experience it just isn't so. Very few police departments have the resources or expertise to tackle complex cybercrime cases, and all of the examples mentioned in the story are multi-jurisdictional.

Consider that the attackers are in different countries that are beyond the reach of U.S. federal law enforcement. The machines they used to send the spam and remote into the victim systems are usually elsewhere. The money mules are and their corresponding banks are scattered across the U.S. and Europe. The victim's bank may or may not be located in the same place as the victim. And so on. Where did the crime take place? That's a monumental challenge for federal law enforcement, and frankly the local PD is just not up to it, especially when they're up to their eyeballs in fighting crimes (often violent ones) where their jurisdiction is quite clear.

I can attest that the FBI has in fact been tracking these guys for more than a decade, and some of them were indicted previously. What I can't understand is why it took so long for this latest, more broad action, and why there is such a huge time gap between the victims referenced in the indictments. There are victims listed from 2010 and 2011 and then some this year (2019), but hardly any in between.

That said, the FBI is not in the pre-crime business (with few exceptions), so they're not really set up to warn businesses like I did for so many years.