Hackers disguised as police trick ISPs into handing over customer data
When police email addresses get compromised, data gets stolen
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
Hackers are nowstealing the identitiesof law enforcement agencies and using them to force companies into giving away sensitive customer information.
The revelation was explained in detail by researchers fromKrebsOnSecurity, acybersecurityblog.
According to the report, all crooks need is access to a singleemailaddress belonging to any law enforcement agency, and a little knowledge about something called an Emergency Data Request (EDR).
We’re looking at how our readers use VPNs with different devices so we can improve our content and offer better advice. This survey shouldn’t take more than 60 seconds of your time. Thank you for taking part.
Click here to start the survey in a new window«
A race against time
Usually, when police want data from companies such as Internet Service Providers (ISP),web hostingfirms and others, they need a court order or subpoena, which involves a relatively lengthy application process.
Sometimes, however, police need to act quickly to prevent possible injury or death. In such instances, they can submit an EDR and demand the data be handed over immediately.
When businesses receive such a request, especially if it comes from a legitimate email address, they have a choice: either investigate whether the request is valid and potentially risk someone’s death, or hand over the data.
Everything we know about Lapsus$ and Okta so far>There’s been another development in the Lapsus$ saga>This British teenager is apparently the mastermind behind Lapsus$
Data management is a major challenge, especially for large businesses, and most of these companies have dedicated departments working exclusively on such matters. At the same time, though, there are thousands of law enforcement agencies they are constantly in touch with. In the US alone, KrebsOnSecurity reminds, there are 18,000 police jurisdictions.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
Researchers have previously linked identity theft and EDR abuse with Lapsus$, a threat group that has been making headlines recently with breaches of high-profile targets such asSamsung,NvidiaandMicrosoft.
Allegedly, a person who could very well be the founder of Lapsus$ recently advertised a “subpoena service” designed to help hoodwink companies into handing over data.
ViaKrebsOnSecurity
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
A new form of macOS malware is being used by devious North Korean hackers
Scammers are using fake copyright infringement claims to hack businesses
How to turn off Meta AI
