Ransomware Groups May Soon Get Their Hands on Your Fingerprints.

You have to give us your fingerprint

By Dominic Alvieri

Aug. 13th, 2023

@AlvieriD

"You have no choice, the company is switching over."

Imagine being forced to give your biometric fingerprint away to third party. Now imagine your employer mandating this and you having no choice in the matter? Well imagine no more.

Meet the Kronos Biometric fingerprint time clock. Can you guarantee that my biometrics are safe. Where is the security answer please? 

I am so opposed to this and I can't do a thing about it. Being forced does not constitute consent.

For the record I object again. 

Which finger?

 Point in fact Kronos settled a lawsuit in 2022 stemming from their data breach in 2021.

Millions of workers are being forced to hand over their fingerprints. There is no consent. You are required to abide by company rules and companies are switching over to fingerprint readers because Kronos is switching over to biometric time clocks. 

Period. You have no choice. Once again I am so against this.

Fairly soon ransomware groups may be able to get their hands on your fingerprints.

I cannot state this point any clearer, you have NO choice except to clock in with your finger. 

I am strongly opposed to the forceful relinquishment of and collection of biometric data

Stay safe.

Dominic Alvieri

@AlvieriD

The Cyber Show 

Social Media Accounts For Sale

Twitter Account with 185k Followers or an Instagram Public Figure with 90k for Sale

Social Media Accounts Caught for Sale

September 27th, 2021

By Dominic Alvieri

Several new social media accounts have been unveiled and are currently being offered for sale online. This isn't taking place on the DarkWeb but right here on the ClearNet. One Twitter account with up to 185k followers is for sale. A Facebook fans page and a YouTube channel are also available. Topping the intrigue list is the public figure Instagram account.

185k followers

Newly created TwitterSale[.]com obviously not related to Twitter has offered social media accounts for sale.

Instagram public figure social media account names don't match

 Instagram account offered

A Facebook fans group page and a YouTube channel by the name of Dj DangDut (unavailble) offered. This site has offered a meme or cartoonish account for sale as well.

Associated to this Twitter profile

How important are followers?

I have 90 followers on Twitter and reporting a fake account for sale with 90k followers. How important exactly are followers? This is a great time to bring up the fake infosec Twitter female account that had 50k followers. Theses accounts are around. Don't automatically dismiss a small account or validate a larger one just by the followers. Remember I have 90 followers. 

As of press time the site "Twitter Sale' is still active. 

The Cyber Show by Dominic Alvieri

Twitter @AlvieriD

Not on Facebook

US DMV Information Comes From China

Fake DMV Links to Chinese Phishing Company

By Dominic Alvieri

April 21, 2021

GEICO has just reported a data breach. Customer drivers license numbers stolen from a bug for unemployment and other nefarious end goals according to Zack Whittaker. A similar DL breach was reported last month. 

This is data theft 101. Every state has victims of identity theft.

It doesn't matter where you live your data is available online. The simple annoying scam of it all.

The stolen data often gets resold after original criminals get what they can from them.

The stolen lists often trickle down to these types of cyber criminals.

Drivers from California to New York are dealing with a variety of DMV spoofs. The Division of Motor Vehicles doesn't send out refunds or rebates.

That would be nice.

If it sounds to good to be true...

...it usually is.

The same scam group runs a myriad of Amazon, Apple, Netflix and others phishing scams run on a daily basis.

The problem is that all of these scams are coming from the same malicious group in China. Scam after scam all coming from the same building location. A phishing company. The 21st century fishermen.

Same DMV IP address

IP Geolocation

Avoiding the plebian effort goes without saying but in this case the cybersecurity ears go up.

Direct spoofs are always annoying coming from a stolen data list and resold countless times over to different scammers on the DarkWeb. 

I can pinpoint the physical address and even pick it up on satellite. Official agencies have to follow up and apprehend the guilty party. This isn't as advanced as the GEICO bug breach but those lists wind up in these spoofing hands.

The Cyber Show on Google Blogger

by Dominic Alvieri

Caught in The Capitol Building

 

CNN Live Stream and Posted Video Allows 

Researcher to Find Man Carrying Fire 

Extinguisher in The US Capitol

This is a Person of Interest

By Dominic Alvieri, Twitter @AlvieriD

Reporter for The Cyber Show

January 14th, 2021

The two men pictured below are part of an extreme group that came to cause havoc. The man with the stars and stripes bandana around his neck has hidden items under his jacket. Both are wearing bullet proof vests and appear to have weapons.

This man is caught with a fire extinguisher in the Capitol.

US Capitol Police Officer Sicknick was struck in the head and killed with a fire extinguisher 

New video research from the CNN live stream of the deadly riots at the US Capitol is being released today seeking public assistance to identify the individuals responsible for the deadly attack.

Police officer Brian D. Sicknick was killed last week after being struck in the head with a fire extinguisher according to witnesses. After hearing this I remembered the event that unfolded live before I was able to record some of the events. This rioter with a fire extinguisher at the Capitol. 

Once CNN posted the video the rest was easy to tie together with other footage and angles. Now we have to identify this person of interest. 

Caught with a Fire Extinguisher

Do you know this person?

This man quickly places down the fire extinguisher once he 

notices there might be a camera recording. 

The following snapshots were taken from the live video that was steamed by CNN on January 6th at the US Capitol. During the live steam I noticed several events before I was able to record. The sound that was made by the person who kicked the fire extinguisher after it was placed on the Capitol floor was unmistakable.  

 Luckily CNN made the video available for research and I found it.

Vests, tactical gear and weapons are not required for a peaceful demonstration.

This person came with a plan

Contact the FBI if you have any information regarding the identity of this person.

The person circled meets up with friends.

The video actually shows several other people of interest. One man is seen wearing tan pants and a cheap black leather jacket scurrying past others. He was carrying a small black messenger bag briskly bypassing others around the roped pathway to enter deeper restricted areas.  

No phone recording, no selfie for this person. He looked and acted like a spy rushing to get in.

Both suspects appear to be wearing bullet proof vests.

This exclusive video research is from CNN live footage of the Capitol riots on January 6th, 2021.

I saw it as it happened and thought he either used it on a door, window or person. The Federal Bureau of Investigation has been forwarded the information.

Once again, please help law enforcement with the rioters who entered our Capitol. That was not a peaceful protest and many still have a price to pay for their actions on that fateful, hateful day incited by the President of the United States of America. 

Dominic Alvieri, Twitter @AlvieriD

Analyst, Independent Researcher, Tracker, Hacker, American. Reporter for The Cyber Show and

The CyberSecurity Show 

Ant Group, Big Brother Technology and TikTok.

Chasing Dragons, Tigers and Wolves.

Where Do Banned Companies Go?

By Dominic Alvieri, @AlvieriD
January 1st, 2021

The Ant Group IPO is being restructured.

Jack Ma can look back at his infamous "pawn shops" comment in Shanghai as the final straw as President Xi Jinping pulled the plug on the record IPO. The outspoken Mr. Ma can only abide and wait for word from Mr. Jinping now. Five new mysterious shareholders were requested to be added late before the hook. Several of the shareholders are virtually unknown.

Those shareholders hold the key. The Ant Group IPO will be coming soon.

Chinese officials in Beijing have cracked down on technology controls right before the ByteDance TikTok deal ran into issues. The US department of Defense is still weighing in and out of court on the matter. Jack Ma spoke in Shanghai in October 2020 and berated many before being benched. 

President Xi Jinping showed his power during the flip flop of TikTok which should have been a flashing red signal for Mr. Ma. TikTok is still battling for survival. 

My Big Brother and His Technology

Leon Technology Co Ltd. website.

Where do Banned Companies Go?

The United States has banned many companies, subsidiaries and people from doing business. Many other measures, companies and people will be barred in the last weeks of this current administration.

What does a company do if it is banned?  Surveillance is big business. Leon Technology Co Ltd exports their systems to over 50 countries around the world including Congo, the United Arab Emirates and Zimbabwe. 

Leon Technology Co Ltd. headquartered out of Xinjiang, China and has some amazing capabilities.

Leon is headquartered in Xinjiang, China with website traffic routed to Hong Kong servers. Leon has technology solutions and services combining software from Beijing based Megvii and another software company called SenseTime bundled in with their camera systems for a one stop surveillance solution. Leon has built combined surveillance systems with tracking and tracing software so powerful and detailed that it can determine your ethnicity.

Reeducation or Concentration?

Technology can be a weapon in evil hands. Leon has been investigated for what the company and Beijing call reeducation centers for Uighur Muslims. The rest of the world has a different term for it.

Over the past year many companies have been moving their corporate bases and obfuscating their origins to continue selling their products. For an example of the adventures of  "Leon Technology," look no further than LinkedIn. The companies appear to be connected.

No response for comment was issued from any of the companies involved before press time. This Leon Technology is based in Shenzhen, Beijing, Hangzhou, or Xinjiang? The company is either 2 years old or over 20. One company executive lists 25 years of service for Leon Technology.

Leon Technology on LinkedIn.

Two of Several Websites for Chinese based Leon Technology.

4 month old new website for a company that looks to be in business for over 20 years.

Ground Support for Singapore Airlines

Leon Ground Support for Singapore Airlines and others.

Airline Ground Support and Golf Carts

Secure Area Ground Support

Airline ground support as well.

Capital and Companies are on The Move.

Capital and companies are moving. There is a mass rebranding of capital and corporate identities.

Prior year investments into Hong Kong and Taiwan are now flooding into countries like Cambodia, Myanmar and Vietnam. Saigon High-tech Park in Ho Chi Minh City, Hoa Lake Hi-tech Park in Hanoi and even the smaller Da Nang High-tech Park are buzzing with activity. Two out of the three have questionable new arrivals. 

Some companies moving into Vietnam and Cambodia are well know like Mitsubishi, others are not. Many seem to be diverse like Cambodian New Juihuan Trading Co Ltd. Others are more opaque. 

Many companies appear to be new with little knowledge and new unknown shareholders and chain of command but big bank rolls. One new shareholder has obvious dubious underworld ties and that is a mild understatement. Yatai International is just one example with dubious ties in the area. Yatai  primarily deals with gaming and other investment services.

Facebook page for the Development of Cambodia, headquartered in Phnom Penh, Cambodia.

Cambodia has embarked on an aggressive campaign to draw investment into Cambodia. Special economic zones are set up all over the south east region. China has set an additional 50 special economic zones as part of their aggressive belt and road initiative. Follow the casino road and the money trail.

Cambodia has approximately 30 casinos with another 70 being planned. The technology parks and initiatives are growing as well. Japanese entrepreneur Izuka Takeshi has an interesting venture at Kirirom University training Cambodians for free in computer science and cybersecurity with job offers in Japan upon graduation. By all accounts a worthwhile venture for all parties involved.

There are a few new trails to traverse to get to the bottom of the shell flipping challenges of today.

Several new leads have been uncovered with complex twists and ties.   

This type of entanglement would have scared Einstein as well. 

Happy New Year. 2021 will be better. Stay safe and stay tuned. 

The Cyber Show, The CyberSecurity Show.

Dominic Alvieri, @AlvieriD

The Cyber Show on Google Blogger

The CyberSecurity Show

Is This The End Of Facebook?

 The FTC and States File Antitrust Lawsuits Against Facebook.

What Will Facebook Lite Look Like?

By Dominic Alvieri, @AlvieriD

December 9th, 2020.

Official law suits to split Facebook have been filed.

What will Facebook Lite be in the future?

What will Facebook be in the Future? Without Instagram? Facebook without what now?

Facebook Lite? The next MySpace?

Is this the end of Facebook as we know it?

The FTC and 48 states filed antitrust lawsuits against Facebook today in official calls to split up the social media giant. Google has long been a target as well.

The pieces may be worth more apart now with historically high IPO valuations. Prices continue to rise with the flood of new issues like DoorDash today. Probably not on the thoughts of Facebook executives today but may be on their evening to do list.

Facebook may not have a choice in the near future.

Calls to split up Facebook are now official.

This may turn out to be a historic day in retrospect.

With the calls to break up Facebook now official the company may not have a choice but to sell off units to appease the litigators. Facebook and Google have long been the targets of cybersecurity attacks and litigation. The stakes are all on the table now.

At what point is a company to large to continue to grow without harming competition?

Will splitting up Facebook change anything?

With associations in place, competition fierce and alliances made, will splitting Facebook up help or hinder competition? How big is too big?

That is a difficult question to answer and usually is settled in a court of law.

What will Facebook be in the future?

Is this the end of Facebook? Probably not. Is this the end of Facebook as we know it today?

That remains to be answered more likely now in a court of law. Time always tells.

Facebook is now officially on the clock as the net has been cast.

Once the net is cast there is usually a price to be paid. Once again, time will tell. 

Stay tuned.

Dominic Alvieri, @AlvieriD

The Cyber Show 

The CyberSecurity Show on Google Blogger and YouTube

by Dominic Alvieri, @AlvieriD

Analyst, Researcher and Tracker.

How to Slow a Social Engineer

Hacking Bitcoins by Night...

     The Port of it All. 

By Dominic Alvieri, @AlvieriD

December 4th, 2020.

Do you know Bitcoin Jack or jack about Bitcoin? 

Porting a number is easier than you think.

The test was simple. Would a representative transfer the account?

The phone rings, "hello thank you for calling (Enter Firm Name Here) how may I help you?

Reporter, hacker, er, social engineer at this stage, " Yes this is (Enter Target Name Here) I have a problem with my phone and I need you to fix it right away.

This is not a step by step how-to but rather an important alert for all and specifically to service related security teams. A live security test. Your friend can be in attendance twenty feet away and silent as the account is transferred to a new phone in the possession of another right in front of him. 

Did you have your MFA on the same device?

 Once transferred many of the apps and accounts, if not all are in control. 

Please use 2FA tokenized preferred. Use any 2FA and MFA securely. Ideally you should separate your MFA from the main device if at all possible. If your device is ported you can still maintain your second factor security on some accounts as long as the 2FA or MFA wasn't on the same device that was just ported.

The engineer could have a baby crying in the background like in this instance. There is generally background noise. Always a sense of urgency, an impulsive need for you the agent to rectify a wrong. 

The simple ploy of a baby crying in the background can create an extra sense of urgency to rush the representative into giving away access to your account. The firm in question did not use any voice recognition technology to verify the identity on the other end of the line nor did it have any satisfactory second forms of authentication or security.

Use a secure 2FA app and find out what other security measures are available from your account and app providers.

Simple security questions can be cracked.

In many cases , all you would need to access an account are the basics along with horrible security low marks of the last four of an account ID and a simple security question like your mothers maiden name. Plebian forms of security.  Very twentieth century if you will with the advent of biometrics, tokenization and other technologies to authenticate and secure accounts and access points.

Citibank, PayPal and others are implementing voice recognition and other technologies to authenticate and validate the identity of an account. Many firms do not at this time.

Porting a number is easier than you think.

The phone is broken...

A phone account breach is the most intimate type of theft. All of your life in bits and bytes there for the taking. Every account, every moment. Now even a regular phish can expose extra hidden losses of not only digital photos and memories but any address, account or even email account linked to any digital assets may be at risk.

If your accounts and apps, let alone digital wallets do not use any added security features such as 2FA, backup keywords, tokenization of any type or any cold storage options, you can lose all of your Bitcoins tonight once I gain access to your accounts and port your number. Many of your assets.

You didn't have your MFA on the same device did you?

A security eye opener for the ill informed. Separate your 2FA and MFA on another device whenever possible.

Cold store and secure digital assets.

What can you do?

Start with securing your accounts. Use tokenized 2FA over SMS. Try not to have your 2FA app or MFA on the same device. You can lose both with a porting. Use end to end encryption to communicate. Back up data. Use cold storage and secure apps and services from trusted sources. Biometrics, tokenization and new technologies are available.

Have private lines and back up emails for security. Layered defense is best. 

Is there a firewall on that line in the sand?

Digital currencies are coming. Many are already here. Central Banks around the world will be issuing their own versions of a Central Bank Digital Currency (CBDC) in the near future. JD.Com is the first to accept the Chinese digital currency today. The race is on. Many countries are in the process.

A CBDC will be different from the stablecoin of today. What will back the stablecoin?

A protocol is filing for a banking license?

Decentralized finance is sounding centralized when a protocol wants to file for a banking license.

The line in the sand is clear. There is no firewall. You have to defend that line. 

 

One call can lose it all.

One call can lose it all.

Porting or transferring of ones number and account is often done off hours in the middle of the night. In many instances the account is socially engineered, stolen and transferred overnight while you are unaware and unable to reject the unwanted intrusion.

Needless to say advanced planning must be involved in targeted campaigns and targeted defense. 

Keeping your accounts securely online or offline is the difference between a secure hot and cold account. That can be the difference between red or black ink. Bread crumbs now can lead to the whole loaf if exposed.

Biometrics, MFA, secure tokenization, cold storage...

Be careful with your cryptocurrencies.

Don't just put it on the Blockchain.

If you ever hear someone say just put it on the blockchain they don't know what they are talking about. There are several types of blockchains. There are several types of cryptocurrencies. Proof of work, proof of stake, algorithms, consensus, byzantine fault tolerances, smart contracts, wrapped Bitcoin and hacked Bitcoin.

 

Databases are available online for sale. Your data. My data, It is foolish to think that it is not already in the hands of a cyber criminal right now. Secure your accounts and use backups. 

Hyper ledgers, digital currencies, smart contracts, wrapped coins...

Call your service provider and add an extra layer of defense. In may instances your phone or financial account representative would be glad to assist you. 

 

Everything is hackable. Be skilled in defense.

Take security precautions. 

The Cyber Show on Google Blogger and YouTube.

Dominic Alvieri, @AlvieriD

The Cyber Show on Google Blogger, YouTube

The CyberSecurity Show.