Whiffy malware stinks after tracking location via Wi-FI No one likes malware, but malicious code that tracks your location is particularly unlovable. Case in point, a new piece of nasty code dubbed "Whiffy Recon" by researchers from Secureworks. First spotted being deployed by the venerable Smoke Loader botnet earlier this month, Secureworks said the malware uses scans of Wi-Fi …
“The infection routine starts with social engineering emails that carry a malicious zip archive. That turns out to be a polyglot file containing both a decoy document and a JavaScript file. ref. Whiffy Recon persists on the system by creating the wlan.lnk shortcut in the user's Startup folder.” ref
"T-Mobile, without any authority from or contact with Kroll or its employee, transferred that employee's phone number to the threat actor's phone at their request"
No. Just no.
I don't care what the sob story was, the fact that T-Mobile accepted to do so means that it is T-Mobile that is guilty of handing out that data to the wrong person.
I just can't imagine why, in 2023, a communications company would still be able to do so. This is not a new kind of attack. There should be procedures in place preventing this from happening. And, if an employee ignores those procedures, he should be fired, because this is exactly what the procedures are meant to prevent.
T-Mobile, you are responsible for the proper management of your customers' data, and that includes their SIM data.
You utterly failed to uphold your responsibility.
If I were a T-Mobile customer, I'd be reviewing my options for leaving.
"Ransomware actors don't like cyber insurance, becuase if their target has a policy it can cover the cost of remediation, therefeore reducing the incneitve to pay a ransom."
OTOH the victim may be better placed to pay if they can claim on insurance. I'm not sure this is a carefully worked out approach.
The big ones, Apple and Google, already hold accurate geolocation information on their users using a variety of techniques. The problem with this information is that its proprietary and so if you or I were to want to access it then it would probably involve paying them some fee. So its natural that wannabes, especially those involved in shady activities, to try to imitate some of A&G's capabilities. Its not anything particularly sinister, just business.
(....and so I want anyone tracking me wherever I go? That's an entirely different issue altogether. But its a pretty good bet that if a 'state actor' wanted to know where I was that they wouldn't resort to DiY mechanisms unless they were really desperate.)
Burner phone, laptop, etc.
For those more technically inclined, a device with user replaceable storage and WLAN, preinstalled and activated OS. Ideally with a legit Windows key linked to an anonymous email account created on a burner phone.
Tracking users by Windows key went out with the Stone Age so natch.
Can you track someone using the smart battery serial number?!
AC
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2024
