Blog Posts | CarmeloWalsh[.]com | Carmelo Walsh's Personal Website and Blog.

Uber Accounts, $1

Posted on March 30, 2015 by Carmelo

Stolen Uber Customer accounts are for sale on the Dark Web for the low price of $1.00.

Though most of the credit cards are masked, the last four and the expiration date are still available. The rest of the data includes name, password, email address (hope you don’t use the same credentials on other sites!) and telephone numbers. Uber has investigated and found no breach… Was there a ticked off insider with access? It can be assumed that this goes back to when a private key was posted on Github.

Motherboard investigated and called three of the accounts that were for sale and upon telling the victims their password, were greeted with “Go***mit!”

The seller has apparently thousands and has good reviews on the Dark Web.

Remember that buying stolen logins is illegal. Diversify your password for separate logins too! Also, don’t post raw code into github! Clean it up!

Posted in Security Blog | Tagged 2015, breach, cyber risk, dark web, hackers, passwords, privacy, risk, uber | Comments Off

Neil Moore, Conman Extraordinaire!

Posted on March 29, 2015 by Carmelo

Neil Moore was imprisoned for stealing 3 million dollars by posing as staff from Barclays Bank, Lloyds Bank and Santander. While serving his time, he was able to get his hands on a phone and he set up a fake web domain closely resembling that of the court service’s official address. He used it to email the prison’s custody inbox with instructions for his release… They let him go!

Neil felt guilty and turned himself back in.

Posted in Security Blog | Tagged email fraud, fraud, lol, Security Awareness, sorta phishing | Comments Off

A Car is a Computer with Wheels

Posted on March 27, 2015 by Carmelo

Your car is totally hackable.

See more posts on Car Hacking

Posted in Security Blog | Tagged 2015, car hacking, hacked, hacking, Internet of Things, Security Awareness, telematics hacking | Comments Off

Got $60? Reduce your Insurance Rates! Hack Your Car!

Posted on March 27, 2015 by Carmelo

For the low price of $60, Eric Evenchick is selling a gadget that will allow a person to use a CANtact to talk directly to a vehicle’s CAN(controller area network)bus through the laptop, connected via USB to the CANtact device that can be plugged into a vehicle’s OBDII port.
Source code is already on Github.

Most vehicles can be hacked remotely. DARPA is currently working on some ‘unhackable’ software to prevent all seen in this video below.

Can someone re-write their vehicle so it tricks user based insurance devices, like the Progressive Snapshot, into always thinking the driver is driving the vehicle safely? Ultimately committing fraud and reducing their rates?

The lesson here is that today’s average vehicles don’t really have any protection against hackers, nor do devices that plug into vehicles. I believe that will change soon as more of these problems get published and enter mainstream media.

This photo below is from 2 years ago… 2 Years ago! What is possible now? The possibilities are endless.

See all posts on Car Hacking!

Posted in Security Blog | Tagged 2015, CANtact, car hacking, hacking, python, Security Awareness | Comments Off

Vawtrack Trojan Capabilities

Posted on March 26, 2015 by Carmelo

Vawtrak is a banking Trojan that has been spreading in recent months. It infects victims via malware downloaders, exploit kits, or through drive-by downloads (e.g. spam email attachments or links). AVG has a white paper (pdf) full of details.

Vawtrak performs the following actions:

Disables antivirus protection.
Communicates with remote Command & Control servers – executes commands from a remote server, sends stolen information, downloads new versions of itself and web-injection frameworks.
Hooks standard API functions, injects itself into new processes.
Steals passwords, digital certificates, browser history, and cookies.
Logs keystrokes.
Takes screenshots of desktop or particular windows with highlighted mouse clicks.
Captures user actions on desktop in an AVI video.
Opens a VNC (Virtual Network Computing) channel for a remote control of the infected machine.
Creates a SOCKS proxy server for communication through the victim’s computer.
Changes or deletes browser settings (e.g. disable Firefox SPDY) and history.
Vawtrak supports three major browsers to operate in – Internet Explorer, Firefox, and Chrome. It also supports password stealing from the other browsers.
Modifies browser communication with a web server.
Stores internal settings into encrypted registry keys.

Attackers will spam with authentic looking emails, with items that are pricy, playing on victims to feel that someone hacked their Amazon account and forces them to immediately investigate by checking the order number. Hovering over the hyperlinks reveals that, unmaintained and compromised WordPress sites carry a drive-by download, waiting for a victim to visit.

The best way to avoid Vawtrack, stay vigilant to online phishing scams, click bait, and wandering off the trusted paths on the Internet.

Posted in Security Blog | Tagged 2015, malware, phishing, Security Awareness, social engineering, trojan, Vawtrack | Comments Off

NYPD Auxiliary Officer Hacking into NYPD Computer + FBI Database

Posted on March 24, 2015 by Carmelo

Yehuda Katz, a New York City Police Department (NYPD) Auxiliary Deputy Inspector assigned to the 70th Precinct in Brooklyn, executed a scheme to hack into a restricted NYPD computer and other sensitive law enforcement databases. He was caught and brought in.

“Katz used his position as an auxiliary officer to hack into restricted computers and networks in order to obtain the personal information of thousands of citizens in a scheme to enrich himself through fraud,” stated United States Attorney Loretta E. Lynch. “The threat posed by those who abuse positions of trust to engage in insider attacks is serious, and we will continue to work closely with our law enforcement partners to vigorously prosecute such attacks.”

Katz installed multiple electronic devices in the Traffic Safety Office of the NYPD’s 70th Precinct that allowed him to remotely access restricted NYPD computers and law enforcement databases, including one maintained by the FBI, that he did not have permission to access. One of the electronic devices installed by the defendant contained a hidden camera that captured a live image of the Traffic Safety Office and was capable of live-streaming that image over the Internet. The second electronic device was connected to one of the computers in the Traffic Safety Office and allowed the computer to be accessed and controlled remotely.

Spy equipment is cheap, during the course of your day, are you suspicious of any devices hanging around? Who would you tell and who would handle it? What do you log to make sure you don’t accuse the wrong people?

Read the FBI release here.

Posted in Security Blog | Tagged 2015, computer security, FBI, fraud, hacking, NYPD, remote attacks, spy, spy gear, Yehuda Katz | Comments Off

Car Updates to Enable Self-Driving

Posted on March 24, 2015 by Carmelo

Rachel Maddow has a video on the self-driving car and how some cars today, already have the basic functionality, and just require the update.

What isn’t covered, is how laws and law enforcement will perceive inebriated or sight impaired drivers if they are technically not driving.

I’ve said it before that laws still haven’t caught up with technology. If you get mugged, you call the police, if your house is robbed, you call the police, if your email account is hacked and used to reset your bank password, and all your money is wired to another country… you call the bank. Local law enforcement can’t do anything about it. I can think of many scenarios where one would get pulled over. How would one refute charges if they are a passenger in their own car?

As with most exciting and new technology products, has enough security testing been done? 2,000,000 vehicles use the hackable Snapshot from Progressive.

It’s exciting still to think about it, watch the video.

Posted in Security Blog | Tagged 2015, driverless cars, hacking, Progressive Insurance, Security Awareness, Snapshot | Comments Off

150,000 Records Accessed in Advantage Dental Breach

Posted on March 18, 2015 by Carmelo

Compromised data included names, Social Security numbers, birthdays, phone numbers and home addresses, but not treatment or financial information.

The information was accessed between Feb. 23-26, when Advantage’s internal IT specialists detected the security breach.

So far, no patients have reported their information was used for criminal activity, but Advantage says it’s covering the cost of an identify theft monitoring service for those affected and is working with law enforcement to determine the scope of the incident.

As a precautionary measure, since the breach, all patient data is now no longer available remotely and can only be accessed by computers within the offices.

Posted in Security Blog | Tagged 2015, Advantage Dental, breach, cyber risk, cybercrime | Comments Off

Premera Blue Cross Breach

Posted on March 18, 2015 by Carmelo

At the end of January, this year, Premera Blue Cross discovered they were breached. Possibly 11 million records of Personal/Medical and Financial information was exposed. After working with Mandiant and the FBI, the indicators of compromise date as far back as May 5th, 2014.

Premera will use normal post and will not email or call customers about the breach, to protect against phishing attacks. Premera members should avoid opening attachments and links or replying to emails about the breach.

Posted in Security Blog | Tagged 2014, 2015, Anthem, breach, credit card, cybercrime, hacked, Premera, privacy | Comments Off