Yet another reason to never use PayPal

I have always hated eBay/PayPal corporation because of their brain-dead approach to security. I drop-kicked them to the curb over 2 years ago because they wanted me to prove my identity (simply because they didn't like the company hosting my e-mail address) using more documentation than the bank required when I got my mortgage.

Well, just in case you didn't think that mattered, security researcher Brian Krebs just reported that his account was hacked - twice in one day - by a hacker with likely ties to terrorism using nothing more than a phone call to customer support and publicly available information (like a social security number and an old credit card number.)

PayPal's official response to this was that they couldn't do anything to prevent it. But they could require Mr. Krebs to send over copies of lots of sensitive ID documents in order to try and get his account back.

It's slim comfort to know that I'm still right about how PayPal is run by a gang of mindless jerks. They make it trivially easy for a hacker to steal your account, but they make it insanely difficult for the legitimate account owner to get his access back.

Am I the only one who thinks it couldn't be worse if it was run by the criminal syndicates themselves? And based on everything I read, I'm not so sure they're not.

Read the rest of the story: 2016 Reality: Lazy Authentication Still the Norm

Hacker Who Sent Brian Krebs Heroin Faces Charges in U.S.

Hacker Who Sent Me Heroin Faces Charges in U.S.

A Ukrainian hacker who once hatched a plot to have heroin sent to my Virginia home and then alert police when the drugs arrived had his first appearance in a U.S. court today, after being extradited to the United States to face multiple cybercrime charges.

It's a very interesting read and a warning about what you may have to deal with if you make a career out of exposing cybercriminals. Fortunately, this story has a good ending.

The old "we're from windows" scam

Three times this past week, I've gotten phone calls with the "Windows tech support" scam.

For those unfamiliar, you get a phone call from someone (often with a Russian accent) claiming to be an employee of "Windows". No, not Microsoft, they are very clear to point that out. They claim your computer is full of viruses and that you need to install their software to let them clean it up.

If you're dumb enough to do this, their software locks your computer. You then have to pay these people several hundred dollars every months in order to use your computer. When you stop paying, their software bricks your computer.

So far, I've been threatening to report these people to the FBI, but unfortunately, they are using spoofed caller ID numbers (the most recent one is from 474-475-1328 - which is a non-existent area code. As a result, the national do-not-call list is useless, as is Verizon's service for tracking down criminal abuse of the phone system.

Does anyone have a clue what else I can do to find the bastards and nail their balls to the floor? If you know someone in the FBI or other appropriate government agency and can forward this to them, please do so. I'll testify in court. Heck, I'll flip the switch if they can be given the death penalty.