Some of the victims of a new scam where threat actors impersonated police to steal sensitive data from tech companies' endpoints have been revealed, and they're big news.
A Bloomberg report claims that both Meta (Facebook’s parent company) and Apple fell for the trick, with the two companies reportedly sharing user IP addresses, phone numbers, and home addresses with the fraudsters.
Besides Meta and Apple, a number of other major tech companies have reportedly been targeted, including Snap and Discord, although it’s unclear whether or not these companies fell for the scam.
Snap and Discord targeted
Commenting on the news, Meta’s policy and communications director, Andy Stone, told The Verge that the company reviews every data request for legal sufficiency and uses “advanced systems and processes” to validate law enforcement requests and detect abuse.
“We block known compromised accounts from making requests and work with law enforcement to respond to incidents involving suspected fraudulent requests, as we have done in this case,” he said in a statement.
“This tactic poses a significant threat across the tech industry,” Peter Day, Discord’s group manager for corporate communications said. “We are continuously investing in our Trust & Safety capabilities to address emerging issues like this one.”
In the original report from KrebsOnSecurity, it was said that a group of threat actors, possibly the same people that later formed Lapsus$, managed to compromise email accounts from law enforcement agencies, most likely via phishing or viruses.
They then used those emails to reach out to large companies with an EDR - Emergency Data Request. Law enforcement agencies reach out to companies all the time, with the request to provide data on users and customers. These requests, however, need to be in compliance with certain regulations and usually take a little time to be processed.
EDRs, however, bypass all of that, as they’re used in a matter of life and death (or serious injury). By playing the EDR card, threat actors force businesses to either risk someone’s life by taking their time to confirm the sender’s identity, or risk leaking data, by hurrying to share it without double-checking who the sender is.
Via: The Verge