Krebs on Security

Before flagging this post to oblivion consider the source: Brian Krebs [1] is highly reputable [2]. This is very newsworthy. [1] https://krebsonsecurity.com/ [2] https://en.wikipedia.org/wiki/Brian_Krebs

Specifically on InfoSec, I would recommend: Krebs on Security https://krebsonsecurity.com Daniel Miessler https://danielmiessler.com/blog

There was another good post the other day that highlighted some good security blogs. The best in my opinion were http://www.schneier.com/blog/, https://threatpost.com/, http://krebsonsecurity.com/. In addition to these, joining some hacker forums to see the kind of shenanigans and tools they employ could be helpful.

A good blog to follow is Krebs on Security: https://krebsonsecurity.com/ He often has screenshots and other details on the working of various markets. Here is a market for ecommerce credentials: https://krebsonsecurity.com/2012/12/exploring-the-market-for-stolen-pa… What use a hacked PC has: http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revi… And even a thriving software industry for the bad guys http://krebsonsecurity.com/2013/07/one-stop-bot-chop-shops/ Counterpane is a company (now owned by BT) that sells managed network security services as an example of how you sell to the firms.

Hey, wanted to reply and drop you a note. I'm a co-founder at Aptible, and we spend a lot of time thinking about how to help developers in your situation. In terms of general reading, I'd suggest: -------------- Blogs: Bruce Schneier [0] Brian Krebs [1] -------------- Whitepapers: - Google's BeyondCorp paper touches on issues that most cloud-first companies will find familiar [2] - AWS has a few that are good for seeing how a large company communicates the scope of it's security program to customers and potential customers. [3] I'd start with "Introduction to AWS Security Processes" aka "Overview of Security Processes" and "AWS Risk and Compliance". - Verizon's Data Breach Investigations Reports [4] -------------- Standards: - Request your IaaS provider's SOC 2 Type II report - ISO 27001 is worth buying - The Cloud Security Alliance's CCM tries to cross-map different frameworks, and is a good reference for a high-level rundown of various security management controls and activities [5] -------------- In terms of books, conferences, and meetups, I'm sure there is good stuff out there that I'm not aware of because of limitations on my time, sorry. I hope this is helpful. Good luck! You (or anyone reading) can reach out to me at the email in my profile to chat about any of this. p.s. Shameless plug: We are launching a product for managing infosec + compliance programs at companies like yours. -------------- [0] https://www.schneier.com/ [1]…

In these cases, report to Brian Krebs instead. https://krebsonsecurity.com/ https://infosec.exchange/@briankrebs

I was curious about this, so for anyone else who’s interested, here’s a KrebsOnSecurity article from 2019 about how easy it was to fraudulently register a .gov domain: https://krebsonsecurity.com/2019/11/its-way-too-easy-to-get-a-gov-doma… I haven’t seen any follow-up reporting, but it looks like the process now requires some semblance of identity verification: https://get.gov/domains/before/

> I had non-technical family members bragging at Thanksgiving about how they bought at box at their local Best Buy that has an app which plays any movie or TV show they want on demand without paying anything. They didn’t understand what was happening, but they said it worked great. Sounds like one of these: https://krebsonsecurity.com/2025/11/is-your-android-tv-streaming-box-p… Probably not your problem to play tech support for these people and explain why being part of a botnet is bad, but mildly concerning nonetheless!

Here's one example. Have you not been following DOGE? You do come off like you're disingenuously concern trolling over something you don't agree with politically. https://krebsonsecurity.com/2025/04/whistleblower-doge-siphoned-nlrb-c…

A bit off topic, that 3D line chart [1] makes the data harder to read instead of clearer. A simple 2D line chart would show the trends without the distortion from perspective. The Data Visualisation Catalogue [2] is a good resource with professional examples and design principles that explain why simplicity usually works best. [1] https://krebsonsecurity.com/wp-content/uploads/2025/09/koli-loks-red-v… [2] https://datavizcatalogue.com/

tld's mean nothing anymore, but they still signal something, and to me .xyz is not a trust-inspiring tld According to this Krebs article https://krebsonsecurity.com/2024/12/why-phishers-love-new-tlds-like-sh… 13% of the xyz domains was related to phishing, not as bad as .top which ahd 30% but still bad.

Important: this is about the prosecution of Christopher Krebs, the former cybersecurity chief. Christopher Krebs is not to be confused with Brian Krebs, a reporter also active in the cybersecurity area and known via his blog: https://krebsonsecurity.com/ As far as I know, Brian Krebs is safe. His own report on the situation is here: https://krebsonsecurity.com/2025/04/trump-revenge-tour-targets-cyber-l… specifically mentioning "(no relation)".

further reading https://krebsonsecurity.com/?s=infatica https://krebsonsecurity.com/tag/residential-proxies/ https://spur.us/blog/ https://bright-sdk.com/ <- way bigger than infatica

The previous Krebs article [1] on this walks through the opsec mistake(s) but it always comes down to email address re-use and nickname/ handle re-usage. As more data breaches happen the likelihood of an opsec mistake increases. Once a handle is burned it’s best to never re-use it again… ever. Even if it’s been a decade. Also, the reuse of email or any form of contact information on a service/ web hosting or DNS registration is another common opsec oopsie [1] https://krebsonsecurity.com/2024/11/hacker-in-snowflake-extortions-may…

Brian Krebs is great. Back in 2018, I discovered a flaw in a website enabling anyone to track any US cellphone’s location without consent, and I contacted US-CERT and Krebs to break the news (https://krebsonsecurity.com/2018/05/tracking-firm-locationsmart-leaked… After checking the locations of several numbers he provided, I remember discussing his need for location privacy - and his shock when he found it was so easy to break. His opsec might be very strict, but when every cellular carrier is eager to sell off your location data, that level of security is absolutely justified.

Because Verizon's report, while a good read, isn't the end-all-be-all of threat intelligence. https://www.wired.com/story/notpetya-cyberattack-ukraine-russia-code-c… https://krebsonsecurity.com/2020/12/u-s-treasury-commerce-depts-hacked… Software supply chain attacks are rare, but when they happen, they're usually high-impact ordeals.

The indictment is a worthwhile read on what not to do when it comes to leaving a trail behind. He might as well have skipped launching the site on Tor and do it out in the open. Also a good read from Krebs, Incognito Darknet Market Mass-Extorts Buyers, Sellers (https://krebsonsecurity.com/2024/03/incognito-darknet-market-mass-exto… - Mar 2024

Ubiquiti is trustworthy. Krebs jumped the gun on that accusation and apologized https://krebsonsecurity.com/2022/08/final-thoughts-on-ubiquiti/

Some of the ones I follow: - Mr. Money Mustache for financial independence and lifestyle: https://www.mrmoneymustache.com/ - Quastor for large-scale engineering: https://www.quastor.org/ - Krebs for IT security: https://krebsonsecurity.com/ - Lenny's newsletter for product development: https://www.lennysnewsletter.com/ - Psychotactics for marketing: https://www.psychotactics.com/ - CTO craft for CTOs: https://ctocraft.com/ - AI and Machine Learning: https://aiweekly.co/ - Programming news: https://www.programmerweekly.com/ - Startups and tech: https://tldr.tech/ - IT engineering trends: https://www.infoq.com/ - For startup founders: http://www.founderweekly.com/

Adding to this, when publicly disclosing after the grace period it may be safer to let a high profile security site [1] do the public disclosing so they receive most blow-back from the vendor. Krebs is no stranger to drama and could refer to you by your security researcher nickname that is not used anywhere else. Some of the less reputable shoddy IoT manufacturers may respond poorly to public disclosure. [1] - https://krebsonsecurity.com/

I don’t see this post when I go to https://krebsonsecurity.com/, at least on iOS Safari. Also, on the home page, when I scroll down to the list of all posts, I don’t see this one. Edit: It’s there now! Thanks to u/Pharaoh2 for the heads-up.

Did you have 2FA? If yes, contact https://krebsonsecurity.com/

Probably could have been a lot less and/or recovered by now had Ubiquiti not also gone through great lengths to cover it up and actively avoid taking appropriate mitigation action. https://krebsonsecurity.com/2021/03/whistleblower-ubiquiti-breach-cata… I mean Nick Sharp certainly took a chunk out of them but there is more to the story for why the market lost that much faith.

People love to say this, and while I agree with the general gist, there are a couple problems with this statement: 1. For large swaths of the population, hardware key-based 2FA or TOTP-based 2FA are too difficult to use, and they can also be more difficult to remediate if the user loses the hardware key or TOTP secret. 2. SMS 2FA is much better than nothing for most people. The bigger problem is when SMS can be used as just a single factor in account recovery scenarios. 3. There is a push to make telecoms more responsible for sim-swapping fraud: https://krebsonsecurity.com/2021/10/fcc-proposal-targets-sim-swapping-…

> The real problem can be condensed into – how do you prevent your employees from getting phished? And well, if you had a solution to that you would be worth many billions of dollars. Security Keys. e.g. https://krebsonsecurity.com/2018/07/google-security-keys-neutralized-e… Notice that Google deployment was almost five years ago. Completely fixes the problem. Your employer presumably doesn't do this, mine doesn't either. That's not because the solution doesn't exist, it's because they don't care.

Yeah but journalists are happy to connect the dots between the two stories and honestly my brain loves the coincidence of these two thingy being clustered: https://krebsonsecurity.com/2021/10/what-happened-to-facebook-instagra…

I haven't been able to verify these sort of claims any more than I've been able to speculate it was blanket telco Letters-of-Authorization (LoAs) [0][1] or classic SIM swaps that resulted in the account takeovers. I'm not claiming you're wrong, but given the timing of the LoA fraud and the attacks, it seemed likely to me that this was not an actual web vulnerability. What makes you believe a specific exploit like that existed against Coinbase's 2FA? And if it existed, then why wasn't that caught in a routine pentest? [0]: https://krebsonsecurity.com/2021/03/can-we-stop-pretending-sms-is-secu… [1]: https://lucky225.medium.com/its-time-to-stop-using-sms-for-anything-20…

You can tell this is political drivel because the only thing here is speculation on the motivation of the delivery of the information, not on the veracity of the information itself. Krebson Security's take on this is the best one I've seen. Their conclusion is solid: https://krebsonsecurity.com/2021/09/lawsuits-indictments-revive-trump-…

> Why then do we not take income into account in credit worthiness? Income is definitely considered in large loans. You’re not going to get a mortgage or a car loan on your credit score alone. Credit firms also collect a lot of payroll data, but it’s kept separate from what you know as your credit score because they inherently can’t have payroll data for everyone that also has credit history data. The scores must be kept separate as a result. Here’s just one example of credit worthiness companies expanding their payroll data collection: https://krebsonsecurity.com/2021/07/intuit-to-share-payroll-data-from-…

The Case for Limiting Your Browser Extensions "The incident is a reminder that browser extensions — however useful or fun they may seem when you install them — typically have a great deal of power and can effectively read and/or write all data in your browsing sessions." https://krebsonsecurity.com/2020/03/the-case-for-limiting-your-browser…