Content by Jeremy Kirk

FBI Removing Web Shells From Infected Exchange Servers

Jeremy Kirk  •  April 14, 2021

In an unprecedented action, the FBI is removing web shells from on-premises Microsoft Exchange servers at organizations in at least eight states that were infected in a wave of attacks earlier this year. Security experts offer an analysis of the bold move that the FBI took without notifying the organizations.

A Tale of 3 Data 'Leaks': Clubhouse, LinkedIn, Facebook

Jeremy Kirk , Mathew J. Schwartz  •  April 13, 2021

Criminals love to amass and sell vast quantities of user data, but not all data leaks necessarily pose a risk to users. Even so, the ease with which would-be attackers can amass user data is a reminder to organizations to lock down inappropriate access as much as possible.

Buying Breached Data: When Is It Ethical?

Jeremy Kirk  •  March 31, 2021

Security practitioners often tread a fine and not entirely well-defined legal line in collecting current and meaningful research. This research can also pose ethical questions when commercial sources for stolen data fall into a gray area.

Microsoft: Exchange Ransomware Activity 'Limited' So Far

Jeremy Kirk  •  March 26, 2021

Microsoft says ransomware activity against compromised on-premises Exchange servers remains limited, but it warns that organizations are far from out of the woods.

Gartner on Enterprise IoT: Segment and Isolate Everything

Jeremy Kirk  •  March 24, 2021

What's that IoT device on your network? A lot of organizations may not know. That's why Gartner analyst Tim Zimmerman says enterprises need to create IoT security policies and governance rules to reduce risk.

Accellion Data Breach Ensnares Energy Giant Shell

Jeremy Kirk  •  March 23, 2021

The Accellion File Transfer Appliance data breach continues to cause anguish. The energy company Shell has disclosed that it has been affected. Meanwhile, some customers of a Michigan-based bank have been informed that personally identifiable data has been exposed via the FTA breach.

Feds Charge Verkada Camera Hacker With 'Theft and Fraud'

Jeremy Kirk , Mathew J. Schwartz  •  March 19, 2021

A Swiss national who recently highlighted flaws in Verkada surveillance cameras has been charged with criminal hacking by a U.S. federal grand jury and accused of illegally accessing and leaking data from numerous organizations, apparently including Intel, Nissan and the U.S. National Reconnaissance Office.

Fake Telegram Desktop App Malware Campaign Persists

Jeremy Kirk  •  March 17, 2021

A malvertising campaign that purports to offer Telegram's desktop app for Windows is persisting. A security researcher based in Switzerland, who nearly fell for the ruse, takes a deep dive into the campaign.

How Did the Exchange Server Exploit Leak?

Jeremy Kirk  •  March 14, 2021

It has been an open question as to how a half-dozen hacking groups began exploiting Exchange servers in an automated fashion in the days leading up to Microsoft's patches. But there are strong signs that the exploit code leaked, and the question now is: Who leaked it?

Verkada's Camera Debacle Traces to Publicly Exposed Server

Jeremy Kirk  •  March 12, 2021

Tales of poorly secured internet-connected cameras come along regularly. But the latest installment seems especially egregious because it involves Verkada, a widely used "surveillance camera as a service" startup, and led to remote hackers being able to spy on customers via their own cameras.

List of Hacked Exchange Servers May Boost Recovery Efforts

Jeremy Kirk  •  March 10, 2021

Computer security researchers have acquired an enormous list of compromised email servers from the perpetrators of the mass Microsoft Exchange compromises. But a big question looms: How bad is this situation going to get?

Exchange Server Attacks Spread After Disclosure of Flaws

Jeremy Kirk  •  March 6, 2021

Just days after Microsoft disclosed four serious flaws in Microsoft Exchange email servers, attackers are going on a wide hunt for vulnerable machines, some security experts say. The flaws could be exploited for creating backdoors for email accounts or installing ransomware and cryptominers.

Microsoft Patches Four Zero-Day Flaws in Exchange

Jeremy Kirk  •  March 3, 2021

Microsoft issued emergency software patches on Tuesday for four zero-day vulnerabilities in its Exchange email server. The alarming vulnerabilities could allow a remote attacker into Exchange and possibly enable further lateral movement.

'Ploutus' Malware Targets ATMs in Latin America

Jeremy Kirk  •  March 2, 2021

Older ATMs across Latin America are being struck by a new version of "jackpotting" malware, which can cause the machines to dispense cash. The malware, called Ploutus, can cause ATMs made by Itautec, a Brazilian company, to discharge up to $1,700.

SonicWall Was Hacked. Was It Also Extorted?

Jeremy Kirk  •  February 22, 2021

SonicWall was recently attacked via a zero-day flaw in one of its own products. Curiously, SonicWall hasn't said much about the extent and damage of the breach since its announcement. But there are strong indications it may have been targeted by an extortion attempt.