A man from Texas has been convicted of operating a website dedicated to publishing stories detailing the sexual abuse of children.

Brewster County resident Thomas Alan Arthur was convicted by a federal jury on January 21 following a trial that lasted three days. 

According to trial evidence, the 64-year-old started operating a website called Mr. Double in 1996. The website was devoted to publishing writings that described the sexual abuse of children, including the rape, torture, and murder of infants and toddlers. 

The website, which Arthur administered from his home, proved popular, and in 1998 he began charging a membership fee.

According to NewsWest9, Arthur stated in an interview with the FBI that his site had over 800 subscribers who paid up to $90 a year to access content.

Arthur invited members to submit material for publication on the site in return for a discounted membership fee. All of the submitted material was reviewed and approved by Arthur personally prior to being uploaded to the website. 

The evidence at trial showed that along with text, some of the author pages on the website contained drawings depicting children engaged in sexually explicit behavior. 

Arthur made enough income from the Mr. Double website for it to be his sole source of income for more than 20 years. 

The site remained online until November 2019, when the FBI executed a search warrant at Arthur’s residence near Terlingua. Additional evidence about Arthur’s illegal activities was obtained from a server in the Netherlands where the Mr. Double site was hosted.

The FBI said that the site contained several disclaimers stating that none of the stories were based on real events. However, among the site’s subscribers were a significant number of people with prior convictions for child sexual abuse and possession of child sexual abuse material. 

Arthur was found guilty of three counts of trafficking in obscene visual representations of the sexual abuse of a child, five counts of trafficking in obscene text stories about the sexual abuse of children, and one count of engaging in the business of selling obscene matters involving the sexual abuse of children.

Sentencing is scheduled for April 19, 2021.

A San Francisco law firm has launched an investigation into a data breach that took place at a subsidiary of Petco Health and Wellness Company.

The breach, which occurred over a six-month period last year, resulted in the exposure of the payment card information of tens of thousands of customers of PupBox, Inc.

PupBox, which appeared on the entrepreneurial-themed reality TV show Shark Tank, sells customized puppy subscription boxes containing toys, treats, chews, and accessories handpicked according to the animal’s age and physical characteristics. 

On October 2, 2020, PupBox announced that its website, PupBox.com, had been the target of a prolonged data breach affecting more than 30,000 of its subscribers. 

Threat actors installed an unauthorized website plug-in that allowed personal information to be captured and shared with a third-party server between February 11, 2020, and August 9, 2020.

Data potentially exposed in the breach includes subscribers’ names, addresses, email addresses, passwords, credit card numbers, credit card expiration dates, and credit card CVV codes. 

According to a security notification letter dated October 2 and signed by PupBox’ Ben Zvaifler, the company learned of the breach in September. A month later, they found out that as a result of the incident, PupBox customers may have become the victims of fraudsters.

“We are writing to inform you that on September 2, 2020, PupBox (a business unit of Petco Animal Supplies Stores, Inc.) became aware of a security incident which affected the PupBox website and may have resulted in a breach of your personal information,” reads the letter. 

“On August 7, 2020, we received a notification that fraudulent activities may have occurred on credit cards that were used on the PupBox website between February 26, 2020 and July 21, 2020.”

The incident is now under investigation by class-action lawyers at Schubert Jonckheer & Kolbe LLP, who noted that PupBox waited at least a month before notifying victims after learning the full extent of the breach.

“The Schubert Firm is investigating the conduct and cybersecurity practices of PupBox and Petco in relation to the breach. Of particular concern, the malicious plug-in was active on the PupBox website for nearly six months between February 11 and August 9, 2020,” said a spokesperson for the firm.

Professional services network Deloitte & Touche LLP today announced its acquisition of substantially all the assets of cybersecurity company Root9B, LLC (R9B).

Founded in 2011 as a cybersecurity training company with a vision of delivering military-grade technology to the private sector, Root9B provides advanced cyber-threat-hunting services and solutions. The company also offers defense forensics and incident response, tech-enabled vulnerability assessment and penetration testing, and defensive security and hunt operator training. 

R9B is headquartered in Colorado Springs, Colorado, and maintains dedicated security operations centers there and in San Antonio, Texas. 

“Deloitte continually works to provide outstanding value to our clients,” said John Peirson, Deloitte Risk & Financial Advisory CEO. 

“Adding R9B’s business to our existing cyber practice is just one more way we’re accelerating meaningful investments into the innovative approaches we offer our clients as they work to manage emerging threats.”

Deloitte said the deal will bolster its existing Detect and Respond cyber client offering with the addition of R9B’s experienced cyber-operations professionals and award-winning threat-hunting and risk-assessment solutions.

“Commercial and government entities contend with cyber adversaries who use incredibly sophisticated technology to penetrate legacy defenses and take advantage of expanding attack surfaces,” said Deborah Golden, Deloitte Risk & Financial Advisory Cyber and Strategic Risk leader and principal.

“The addition of R9B’s business will expand our complement of skilled cyber professionals and leading technologies, while also offering our clients an advantage against adversaries. Our newly combined powerful and innovative solutions for preventing, detecting and mitigating cyber threats are unlike anything we’ve seen available in today’s market.”

R9B founder and CEO Eric Hipkins described the acquisition as “a logical next step” for the company that is known around the world for its threat-hunting platform ORION. 

“Our shared commitment to our clients’ missions and recognition of the importance of combining exceptional technology, people and processes to solve the most challenging security problems of our day makes joining Deloitte a logical next step in our story,” said Hipkins.

“At Deloitte, we’ll be able to accelerate scaling and development of offerings we consider vital to proactive cyber threat hunting and remediation.”

The Russian government has issued cybersecurity guidance to businesses in the country after claiming they are at risk of US reprisals for the recent SolarWinds attacks.

The alert came late last week from the National Coordination Center for Computer Incidents (NKTsKI), an agency created in 2018 by KGB successor the Federal Security Service (FSB).

It claimed the Biden administration had threatened to carry out retaliatory attacks on Russian critical infrastructure following the large-scale cyber-espionage campaign experts say the Kremlin has waged on US government and other organizations over the past year.

In fact, Biden’s press secretary had done little but repeat previous statements that the US reserves the right to “respond at a time and manner of our choosing to any cyber-attack.”

The 15-point plan issued by NKTsKI features some pretty basic advice including updating incident response plans, correctly configuring security tools, training users how to spot phishing, avoiding third-party DNS servers and using multi-factor authentication.

Also on there are: application controls, firewalls, updated passwords, email security and prompt patching.

The US finally blamed Russia for the SolarWinds attacks earlier this month, after it emerged that Kremlin-sponsored operatives had performed a major spying operation on government departments including the Department of Justice, the State Department and the Treasury.

President Biden now has the tricky geopolitical task of seeking cooperation with Russia over arms treaties but a way to punish the Kremlin for this cyber-attack and other pressing issues.

Reports suggest he has tasked the intelligence community with investigating four key areas: the SolarWinds attack, possible interference in the 2020 election, efforts to muzzle Russian opposition leader Alexei Navalny, and a bounty program to pay Taliban fighters in Afghanistan for killing US troops.

Intel was forced to issue its financial results earlier than expected last week after an internal error made public some of the information before it was due to be released, the firm has confirmed.

Originally, Intel CFO, George Davis claimed a “hacker” had got hold of an infographic detailing the earnings, which was waiting to be published on the firm’s PR Newsroom site.

An Intel spokesperson told the Financial Times at the time: “We were notified that our infographic was circulating outside the company. I do not believe it was published. We are continuing to investigate this matter.”  

However, the chip giant since admitted that it was to blame.

“The URL of our earnings infographic was inadvertently made publicly accessible before publication of our earnings and accessed by third parties,” noted a new statement. “Once we became aware of the situation we promptly issued our earnings announcement. Intel’s network was not compromised and we have adjusted our process to prevent this in the future.”

In the end, the chip giant published its financials only minutes before they were due to go live anyway, although it meant traders had six minutes before the markets closed to act on the report.

The strong financials showed Intel beating Wall Street estimates, thanks to a 33% boost in the volume of PC chips it sold over the previous quarter, due to soaring lockdown demand from home workers and students.

Intel ended the day with its share price up over 6%, although it subsequently tumbled more than 9% the following day.

Immersive Labs’ chief cyber officer, Max Vetter, argued that this may have been linked to the earnings incident, and the uncertainty created over its origins.

“The negative impact on Intel’s finances is, unfortunately, a sign of why data security has become a boardroom issue,” he argued.

Incident response plans and organizational processes must always be primed to deal with any breaking threat, Vetter added.

“The ones who will respond best are the teams that have been drilling for such events far in advance to ensure that, if the worst does happen, they have the muscle memory to respond quickly and the agility to react when the unexpected hits,” he concluded.

Security vendor SonicWall has warned its customers that threat actors may have found zero-day vulnerabilities in some of its remote access products.

An initial post on the vendor’s knowledgebase pages on Friday claimed that the NetExtender VPN client version 10.x and the SMB-focused SMA 100 series were at risk.

However, an update over the weekend clarified that impacted products were confined to its Secure Mobile Access (SMA) version 10.x offering running on SMA 200, SMA 210, SMA 400, SMA 410 physical appliances and the SMA 500v virtual appliance.

These provide customer employees with secure remote access to internal resources — capabilities in high demand during the pandemic. As such, there’s an obvious advantage to attackers in finding bugs to exploit in such tools.

“We believe it is extremely important to be transparent with our customers, our partners and the broader cybersecurity community about the ongoing attacks on global business and government,” SonicWall said in the alert.

“Recently, SonicWall identified a coordinated attack on its internal systems by highly sophisticated threat actors exploiting probable zero-day vulnerabilities on certain SonicWall secure remote access products.”

There’s no more info for now on what the attackers were after and how they performed the intrusion.

However, SonicWall also clarified that its firewall products, SonicWave APs and SMA 1000 Series product line are unaffected.

“Current SMA 100 Series customers may continue to use NetExtender for remote access with the SMA 100 series. We have determined that this use case is not susceptible to exploitation,” it added. “We advise SMA 100 series administrators to create specific access rules or disable Virtual Office and HTTPS administrative access from the internet while we continue to investigate the vulnerability.”

Since the start of the COVID-19 crisis, security and infrastructure providers have come under increasing scrutiny as attackers look for holes in products which could provide them with large-scale access to customer environments.

Back in April, it emerged that sophisticated ransomware groups were exploiting flaws in VPN products to attack hospitals, while in October, the US warned that APT groups were chaining VPN exploits with the Zerologon flaw to target public and private sector organizations.

Products from Fortinet (CVE-2018-13379), MobileIron (CVE-2020-15505), Juniper (CVE-2020-1631), Pulse Secure (CVE-2019-11510), Citrix NetScaler (CVE-2019-19781) and Palo Alto Networks (CVE-2020-2021) were all highlighted as at risk.