A student at East Carolina University has been charged with cyber-stalking after allegedly posing as a member of a rival fraternity to upload a racist post to social media.

A police investigation was launched after an offensive message, purporting to be from the university’s Theta Chi chapter, was uploaded anonymously to Yik Yak in August. 

The post read:  “Theta Chi rush party, PNMs (potential new members) and girls only. No blacks. Girls 5$ @door. Call or text.”

The party invitation then listed the name and contact information of a genuine member of the Theta Chi fraternity. 

The rush event mentioned in the post never took place, and the members of Theta Chi fraternity have denied having anything to do with the Yik Yak post. 

Officers at the Greenville Police Department traced the Yik Yak invite to James Daniel Edwards IV, a black 19-year-old political science major at ECU.

Edwards was charged with cyber-stalking and turned himself in to the Pitt County Detention Center on October 1. 

The investigation by Greenville PD found no affiliation between Edwards and the Theta Chi fraternity. 

“It is the Greenville Police Department’s understanding he is a member of another ECU fraternity,” said police.

In an email to McClatchy News, Greenville PD spokesperson Kristen Hunter wrote: “The motive is still under investigation; however, the post was made during Rush Week, when fraternities try to recruit members, so we believe that was a factor.”

According to The Finger Lake Times, East Carolina University said that Edwards is a member of the Pi Lambda Phi fraternity. On Pi Lambda Phi’s website, Edwards is reportedly listed as vice president of recruitment for the fraternity.

Edwards told news source WITN that he couldn’t comment on the incident until he had obtained a lawyer. 

In a statement, East Carolina University said: “We appreciate the efforts of the Greenville Police to identify the individual who made the post and to clear the name of the student and the Theta Chi fraternity listed in the original post. We will continue to work with our students and campus to build a welcoming and inclusive community for all.”

An authentication error left the personal data of hundreds of thousands of BrewDog customers and Equity for Punks shareholders exposed for a year and a half. 

The gaffe involving an API bearer token was discovered by researchers at security consulting and testing company Pen Test Partners. 

“Every mobile app user was given the same hard-coded API Bearer Token, rendering request authorization useless,” wrote the researchers in a blog post published today.

The mistake allowed any user to access the personal identifiable information (PII) belonging to another user. Other information exposed in the incident included users’ shareholding details and bar discount.

Researchers said that the details of over 200,000 shareholders “plus many more customers” were exposed “for over 18 months.”

The token error left BrewDog vulnerable to theft, according to researchers, who noted that shareholders can claim a free beer in the three days before or after their birthday under the terms of the Equity for Punks scheme. 

“One would simply access an account with the required date of birth, generate the QR code and the beers are on BrewDog!” wrote the researchers.

Pen Test Partners has criticized BrewDog’s handling of the cybersecurity issue, claiming that “disclosure was rather fraught.”

“Instead of being ‘cool’ as we had hoped, given their reputation as being a bit counter-culture, BrewDog instead declined to inform their shareholders and asked not to be named,” said Pen Test.

The security consulting company added: “It took four failed fixes to properly resolve the problem.”

Michael Isbitski, technical evangelist at Salt Security, told Infosecurity Magazine: “BrewDog all but laid out customers’ private information on a silver platter for attackers.”

Isbitski said that instead of using the kind of dynamic, expiring authorization tokens typically seen within a proper OAuth2 implementation, the brewer used static authorization tokens, which were hard coded within the application source code. 

“Those static tokens granted access to BrewDog’s back-end APIs, which attackers could call directly to extract data,” said Isbitski. 

“Additionally, BrewDog used account identifiers which could be easily predicted, making it a trivial task for an attacker to enumerate through user accounts and siphon PII.”

An international psychic mail fraud scheme that sold the promise of good fortune to tens of thousands of victims has been shut down by a United States court.

Earlier today, the US District Court for the Southern District of Florida entered a permanent injunction against three residents of France and two corporate defendants who had been carrying out the highly lucrative scheme.

According to a complaint, Robert Lhez, Mireille Dayer and Julie Poulleau, using Arcana Center, a company in Delaware, and a Swiss corporation named Partners VAD International Sàrl, mailed hundreds of thousands of solicitations to victims in the United States.

The mailouts were purportedly sent on behalf of companies or individuals offering psychic, clairvoyant, or astrological services. 

Individuals targeted by the scheme were told that they would come into some money soon if they paid an upfront fee. However, none of the victims who handed over their cash received any of the promised benefits.

“These solicitations were riddled with false and misleading statements that gave the false impression that in exchange for payment of a small fee, typically of $45 or $50, the individual recipient would come into good fortune resulting in an imminent financial windfall though the lottery, inheritance or other game of chance,” said the Department of Justice Office of Public Affairs in a statement. 

Thousands of victims, most of whom were elderly or vulnerable, sent payments totaling millions of dollars to the defendants. From March 2017 to June 2018 alone, the defendants received more than $1.4m from more than 34,000 payments. 

According to Eric Shen, inspector in charge of the US Postal Inspection Service’s Criminal Investigations Group, the defendants “have been known to Postal Inspectors for years, constantly changing their fraudulent schemes in the attempt to stay one step ahead of the law.” 

Lhez, Dayer, Poulleau and the two companies are now barred from operating or otherwise engaging in a psychic mailing scheme and, more broadly, from engaging in any mass-mail or prize-promotion marketing in the United States.

Acting US Attorney Juan Antonio Gonzalez for the Southern District of Florida urged the public to question promotions that seem too good to be true and report suspected fraud to law enforcement.

Russia accounted for the majority of state-sponsored attacks over the past year, with the SolarWinds attackers dominating threat activity, according to Microsoft data.

The firm’s Digital Defense Report 2021 covers the period from July 2020 to June 2021 and details state and cybercrime activity.

Kremlin-backed raids accounted for 58% of all nation-state attacks during the period, with Nobelium (aka APT29, Cozy Bear) generating the vast majority (92%) of notifications Microsoft made to customers about attacks.

The threat group was responsible for the notorious and highly sophisticated SolarWinds campaign, which compromised at least nine US government departments.

Worryingly, Microsoft claimed that Russian state-backed attacks are increasingly successful: compromise rates jumped from 21% to 31% year on year.

They’re mainly focused on intelligence gathering from government agencies in the US, UK and Ukraine.

After Russia, the largest volume of attacks came from North Korea (23%), Iran (11%), and China (8%). It’s not always about cyber espionage: Iran has ramped up destructive attacks against Israel, while North Korea continues to generate funds by targeting cryptocurrency companies, according to Microsoft.

China appears more traditional in its intelligence-gathering activities. However, it has used a range of previously unidentified vulnerabilities to achieve these ends, particularly the Hafnium attacks on Exchange servers earlier this year.

Chinese threat groups also have a range of strategic goals but tend to focus on gleaning social, economic and political intelligence about strategic adversaries and neighboring countries.

Microsoft said it had notified customers 20,500 times about nation-state breach attempts over the past three years.

“To be clear, Microsoft does not observe every global cyber-attack. For example, we have limited visibility into attacks targeting on-premises systems that organizations manage themselves, like the Exchange Server attacks earlier this year, and attacks targeting customers of other technology providers,” it added.

“We believe sharing the data we do have on these threats is helpful to customers, policymakers and the broader security community, and we invite others to share what they’re seeing with their visibility.”

A leading UK high street bank has pleaded guilty to failing to stop a massive money-laundering operation carried out by a business customer.

Criminal charges were brought against NatWest by regulator the Financial Conduct Authority (FCA) under the UK’s Money Laundering Regulations 2007.

The lender, which is state-backed, entered a guilty plea at Westminster Magistrates Court in the first case of its kind. It covers four years between November 2012 and June 2016, during which the bank was accused of failing to monitor deposits amounting to hundreds of millions of pounds.

According to the BBC, the customer in question, Bradford-based jeweller Fowler Oldfield, was predicted to have a turnover of around £15m when NatWest onboarded it. However, it subsequently deposited £365m over the period, £264m of which was in cash, even though it was agreed the bank would not handle cash deposits.

NatWest is now likely to face a hefty fine.

John Dobson, CEO of regtech firm SmartSearch, said he hoped the case would be a wake-up call for the industry and predicted a fine above £400m.

“Change is long overdue. Despite tools being readily available to prevent this illegal activity, currently 99% of ill-gotten gains are successfully laundered by criminals, and regulated businesses need to do much more to prevent this,” he added.

“If the moral obligation to stop terrorists, drug smugglers and sex traffickers legitimizing their money isn’t enough motivation, through this case the FCA has shown it is willing to severely punish those who don’t take their responsibilities seriously.”

The scale of global money laundering is famously hard to estimate, but the UN believes it could be between 2-5% of global GDP annually, which amounts to as much as $4tn or more today.

However, global fines for anti-money laundering (AML) and data privacy compliance breaches fell by nearly 50% year-on-year in the first half of 2021.

Cyber-attacks targeting UK firms are back on the increase, reaching a rate of one every 47 seconds over the summer, according to new data from Beaming.

The business ISP had noted a 9% year-on-year drop in the second quarter, but it now appears that was a temporary blip. Attacks increased 4% between July and September over the same period last year.

The firm claimed that this amounts to an average of 168,975 attacks per company in the third quarter or 1837 per day.

IoT applications and systems attracted the most compromise attempts, amounting to 162 per day, while attempts to breach web applications increased by 21% to reach 48 per day on average.

Beaming has been recording attack traffic patterns since 2016, and Q2’s decline was the first since 2018. However, that now seems to have been merely a slight interruption of the general upward trend in attacks.

Beaming managing director, Sonia Blizzard, urged companies to remain vigilant as they transition to new hybrid working practices.

“More people are accessing company data and IT systems via personal devices and unmanaged domestic internet connections, and more data is flowing beyond traditional business boundaries that could be protected with a simple firewall,” she explained.

“There is plenty that specialist ISPs like Beaming can do to reduce the risk, but businesses need to get serious about cybersecurity too and build resilience through a combination of training, technology and documented policies.”

Her company identified over 260,000 unique IP addresses used to launch attacks on UK firms during the period, tracking a plurality of them (41,175) to China, 22,894 to the US and 16,020 to Brazil. However, that’s no indication that attacks were actually controlled from these countries, merely that compromised PCs from these locations were used.

In a study over the summer, more than half (54%) of senior executives admitted they’re struggling to adapt security policies to keep up with changes to working practices and the threat landscape.