Feed aggregator

CLEVELAND (WCMH) — A former central Ohio basketball coach is facing charges in Cuyahoga County alleging he was caught performing a sexual act in a car at a Target parking lot. According to North Olmstead police, officers responded to a call from a witness who reported a man in a black pickup was following people [...]

COLUMBUS, Ohio (WCMH) – A study ranking the best state capitals to live placed Columbus near the top of the list.  WalletHub released its analysis on Monday, examining the capitals of all 50 states across four key dimensions, including affordability, economic well-being, quality of education and health, and quality of life. “A state’s capital city [...]

COLUMBUS, Ohio (WCMH) -- It's the last full day of action from the Milan Cortina Olympics as we have reached the eve of the Closing Ceremony. But don't fret because this Saturday has a lot going on. Dozens of medals will be handed out and history may unfold as Johannes Hoesflot Klaebo attempts to win [...]

LIBERTY TOWNSHIP, Ohio (WCMH) -- The Columbus Zoo and Aquarium has filed another appeal in its legal battle with Liberty Township. It comes after a judge ruled the zoo must collect and pay a fee to the township for emergency services. The now months-long dispute started last July, when Liberty Township passed an ordinance imposing [...]

COLUMBUS, Ohio (WCMH) -- A local legal expert is weighing in on the five-hour video deposition of Ohio's richest man, Les Wexner. Members of the House Oversight Committee traveled to New Albany this week to question Wexner about his connection to convicted sex offender Jeffrey Epstein. Wexner has not been charged with a crime and maintains [...]

COLUMBUS, Ohio (WCMH) -- The penultimate day of the Winter Olympics is Saturday and it will be the last time you have an all day affair of watching sports. We have a plethora of medal events going on but the one everyone will be talking about is the men's 50km cross-country ski, where Norway's Johannes [...]

ATHENS, Ohio (WCMH) — The Athens community is still buzzing after the U.S. women's hockey team defeated Canada for the gold medal on Thursday, especially because one of Team USA's players is from Athens. “Everybody is so happy for her and so proud that somebody from Athens was able to do something like that," said [...]

COLUMBUS, Ohio (WCMH) -- The Winter Olympics are not the only place to see ice skating in action. Disney on ice is back here in Columbus at Nationwide Arena.   Disney on Ice is presenting “Mickey's Search Party.” The show will feature numbers from classics like The Little Mermaid and Beauty and the Beast.   “It's very special,” Shay [...]

COLUMBUS, Ohio (WCMH) -- An officer who was acquitted in the death of a 21-year-old pregnant woman has agreed to part ways with the Blendon Township Police Department. Officer Connor Grubb will resign from the department and be paid $150,000 to cover any lost benefits and potential backpay, according to a township spokesperson. Blendon Township [...]

MILAN, Italy (WCMH) -- As the United States men's hockey team continues its pursuit of its first Olympic medal since 2010, the memory of former Blue Jacket Johnny Gaudreau lives on in the Americans' locker room. "He's probably a guy that would've been here," Blue Jackets and U.S. defenseman Zach Werenski said. Gaudreau's No. 13 [...]

Most phishing websites are little more than static copies of login pages for popular online destinations, and they are often quickly taken down by anti-abuse activists and security firms. But a stealthy new phishing-as-a-service offering lets customers sidestep both of these pitfalls: It uses cleverly disguised links to load the target brand’s real website, and then acts as a relay between the target and the legitimate site — forwarding the victim’s username, password and multi-factor authentication (MFA) code to the legitimate site and returning its responses.

There are countless phishing kits that would-be scammers can use to get started, but successfully wielding them requires some modicum of skill in configuring servers, domain names, certificates, proxy services, and other repetitive tech drudgery. Enter Starkiller, a new phishing service that dynamically loads a live copy of the target login page and records everything the user types, proxying the data to the legitimate site and back to the victim.

According to an analysis of Starkiller by the security firm Abnormal AI, the service lets customers select a brand to impersonate (e.g., Apple, Facebook, Google, Microsoft et. al.) and generates a deceptive URL that visually mimics the legitimate domain while routing traffic through the attacker’s infrastructure.

For example, a phishing link targeting Microsoft customers appears as “login.microsoft.com@[malicious/shortened URL here].” The “@” sign in the link trick is an oldie but goodie, because everything before the “@” in a URL is considered username data, and the real landing page is what comes after the “@” sign. Here’s what it looks like in the target’s browser:

Image: Abnormal AI. The actual malicious landing page is blurred out in this picture, but we can see it ends in .ru. The service also offers the ability to insert links from different URL-shortening services.

Once Starkiller customers select the URL to be phished, the service spins up a Docker container running a headless Chrome browser instance that loads the real login page, Abnormal found.

“The container then acts as a man-in-the-middle reverse proxy, forwarding the end user’s inputs to the legitimate site and returning the site’s responses,” Abnormal researchers Callie Baron and Piotr Wojtyla wrote in a blog post on Thursday. “Every keystroke, form submission, and session token passes through attacker-controlled infrastructure and is logged along the way.”

Starkiller in effect offers cybercriminals real-time session monitoring, allowing them to live-stream the target’s screen as they interact with the phishing page, the researchers said.

“The platform also includes keylogger capture for every keystroke, cookie and session token theft for direct account takeover, geo-tracking of targets, and automated Telegram alerts when new credentials come in,” they wrote. “Campaign analytics round out the operator experience with visit counts, conversion rates, and performance graphs—the same kind of metrics dashboard a legitimate SaaS [software-as-a-service] platform would offer.”

Abnormal said the service also deftly intercepts and relays the victim’s MFA credentials, since the recipient who clicks the link is actually authenticating with the real site through a proxy, and any authentication tokens submitted are then forwarded to the legitimate service in real time.

“The attacker captures the resulting session cookies and tokens, giving them authenticated access to the account,” the researchers wrote. “When attackers relay the entire authentication flow in real time, MFA protections can be effectively neutralized despite functioning exactly as designed.”

The “URL Masker” feature of the Starkiller phishing service features options for configuring the malicious link. Image: Abnormal.

Starkiller is just one of several cybercrime services offered by a threat group calling itself Jinkusu, which maintains an active user forum where customers can discuss techniques, request features and troubleshoot deployments. One a-la-carte feature will harvest email addresses and contact information from compromised sessions, and advises the data can be used to build target lists for follow-on phishing campaigns.

This service strikes me as a remarkable evolution in phishing, and its apparent success is likely to be copied by other enterprising cybercriminals (assuming the service performs as well as it claims). After all, phishing users this way avoids the upfront costs and constant hassles associated with juggling multiple phishing domains, and it throws a wrench in traditional phishing detection methods like domain blocklisting and static page analysis.

It also massively lowers the barrier to entry for novice cybercriminals, Abnormal researchers observed.

“Starkiller represents a significant escalation in phishing infrastructure, reflecting a broader trend toward commoditized, enterprise-style cybercrime tooling,” their report concludes. “Combined with URL masking, session hijacking, and MFA bypass, it gives low-skill cybercriminals access to attack capabilities that were previously out of reach.”

The Federal Communications Commission (FCC) is looking for qualified applicants for Field Agents in seven Enforcement Bureau (EB) offices across the United States: Atlanta, GA; Boston, MA; Chicago, IL; Dallas, TX; New Orleans, LA; New York, NY, and Portland, OR. Incumbents will resolve Radio Frequency (RF) interference, educate users, and enforce regulations. The GS levels for this position hav...

COLUMBUS, Ohio (WCMH) -- The U.S. Department of Justice has sued OhioHealth, alleging the health care provider is limiting competition and driving up costs for patients. The lawsuit accuses OhioHealth of restricting "commercial health insurers from offering health plans that allow patients to share in the savings that come from choosing OhioHealth's lower-cost rivals." OhioHealth, [...]

Central Ohio Catholic churches are offering meatless meals, such as fish fries, to those observing Lent from February 20th to March 27th.

Solar activity returned to low levels this past week. The strongest
event of the period was a C1.8 flare on February 17 from region
4374. This region was also responsible for a C1.4 flare on February
18. The only other flare of note was a C1.1 flare on February 17
from an unnumbered plage region near S05E85. (A plage region is a
bright, intensely hot region in the Sun's chromosphere, typically
found ...

ARRL The National Association for Amateur Radio®’s new book, Digital Networking for Ham Radio, a practical, hands-on guide to designing and implementing high-speed data networks for amateur radio stations, is now shipping.

Written by Glen Popiel, KW5GP, the book brings together in one comprehensive resource the knowledge needed to build, configure, and expand digital networks for ham radio. From...

COLUMBUS, Ohio (WCMH) — A suspect believed to be involved in a 13-year-old homicide who was arrested near Dayton after a police shootout two years ago, has been extradited to Columbus to face murder charges. Breyon Bryant, who was wanted in the 2013 strangulation death of Daivena Clay, is in a Franklin County courtroom Friday [...]