Information security
fromThe Hacker News
8 hours agoNo Exploit Needed: How Attackers Walk Through the Front Door via Identity-Based Attacks
Stolen credentials remain the primary entry point for attackers, despite advancements in cybersecurity.
The French case illustrates how attackers used a fake police raid and violence to force a Bitcoin transfer worth $1 million, bypassing encryption entirely by compelling the victim to authorize the transaction.
Several state lawmakers have reported receiving hundreds of form emails generated by Citizens For Affordable Rates, an organization funded by Uber, supporting Gov. Hochul's auto insurance proposal. One email was sent from Leslie Jenkins, who died in 2015, raising questions about the legitimacy of these communications.
Last month, I sat across from one of the brightest people I know as he explained how he'd lost nearly everything to a sophisticated scam. This wasn't some naive teenager or technophobe. This was my friend from university days, a retired executive who'd navigated corporate politics for decades and made shrewd investment decisions his whole life. Watching him piece together how it happened was like watching someone solve a puzzle in reverse.
QR codes are two-dimensional images with glyphs of various sizes that store not just numbers, but text. When scanned, your phone extracts the encoded information and can act on it. For example, QR codes often embed URLs, allowing you to scan, say, a parking meter to launch a webpage where you can pay online.
The ease of use means the ease of stealing. There are pieces of software and devices that are doing exactly the same thing that a point of sale does and it's transacting on your phone or on your credit card and if you don't have a thumbprint or a biometric on your phone, they can walk up and if you're not paying attention in a crowded area, they get close enough and they touch your phone they can do a transaction.
The email seen by at least some customers of the Emma email platform was a phishing scam. Hackers hoped to inspire instant panic with the words, 'As part of our commitment to supporting U.S. Immigration and Customs Enforcement (ICE), we will be adding a Support ICE donation button to the footer of every email sent through our platform.'
The service, referred to as 1Campaign, provides hackers with a one-stop-shop for running malicious ads and enabling fraud "at scale," a recent report by cybersecurity company Varonis uncovered. Using just a single dashboard, hackers can cloak malicious content from security researchers, ad platform reviewers, and automated scanners - who instead see a benign white page - and target general users with phishing or scam attempts.
Calls where no one responds are rarely accidental. In many cases, they are automated reconnaissance events. Fraud operations run at industrial scale, and before they invest human effort in a target, they validate that a number is active and answered by a real person.
As well as millions of customer names and contact details, the databases show how much money people had spent at the stores. The hacker the BBC spoke to says he purchased the spreadsheets for $300,000 (£224,000) in order to target the biggest spenders. He claims to have used the information along with details from another stolen database to scam multiple Coinbase users out of at least $1.5m (£1.1m) in crypto.