{"id":13067,"date":"2013-04-03T09:25:59","date_gmt":"2013-04-03T16:25:59","guid":{"rendered":"http:\/\/www.intego.com\/mac-security-blog\/?p=13067"},"modified":"2016-10-06T12:03:34","modified_gmt":"2016-10-06T19:03:34","slug":"flashback-author-identified-by-brian-krebs","status":"publish","type":"post","link":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/","title":{"rendered":"Flashback Author Identified by Brian Krebs"},"content":{"rendered":"

\"\"<\/p>\n

There has been a lot of discussion, since the initial Flashback variants were released in late 2011<\/a>, about Flashback’s actions. Until now, there has been little to no information about who was responsible for Flashback. Today, on the anniversary of Apple’s last XProtect update to guard against Flashback, Brian Krebs has given a thorough account<\/a> of the identity of the man who claims he is behind one of the most prolific and advanced OS X threats to date.<\/p>\n

Flashback’s focus on financial gain by redirecting infected users’ Google searches led Krebs to searching for more clues on underground Search Engine Optimization (SEO) forums. This hunch was a good one, as it turns out one of the founding members of a private Blackhat SEO site seems to be the person behind the pandemonium. His account of how he came to find this man gives a clear view of the sort of interactions that are behind much malware these days. Shadowy underground websites that vet new members by reputation, using skilled programmers as hired guns – it all reads like a nouveau gangster story. Truth is sometimes stranger than fiction.<\/p>\n

Krebs has made a name for himself out of naming and shaming online criminals, at significant personal cost. His site is frequently a target of Denial of Service attacks, and recently he was subjected to SWATing<\/a> at his own home. But as his reports have been incredibly helpful in interfering with cybercriminals, we hope he continues to keep digging – this sort of public identification increases the perceived cost of being a successful attacker.<\/p>\n

 <\/p>\n","protected":false},"excerpt":{"rendered":"

There has been a lot of discussion, since the initial Flashback variants were released in late 2011, about Flashback’s actions. Until now, there has been little to no information about who was responsible for Flashback. Today, on the anniversary of Apple’s last XProtect update to guard against Flashback, Brian Krebs has given a thorough account […]<\/p>\n","protected":false},"author":6,"featured_media":13081,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[190,5],"tags":[153],"class_list":["post-13067","post","type-post","status-publish","format-standard","has-post-thumbnail","category-malware","category-security-news","tag-flashback"],"yoast_head":"\nFlashback Author Identified by Brian Krebs - The Mac Security Blog<\/title>\n<meta name=\"description\" content=\"There has been a lot of discussion, since the initial Flashback variants were released in late 2011, about Flashback's actions. Until now, there has been\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Flashback Author Identified by Brian Krebs - The Mac Security Blog\" \/>\n<meta property=\"og:description\" content=\"There has been a lot of discussion, since the initial Flashback variants were released in late 2011, about Flashback's actions. Until now, there has been\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/\" \/>\n<meta property=\"og:site_name\" content=\"The Mac Security Blog\" \/>\n<meta property=\"article:published_time\" content=\"2013-04-03T16:25:59+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2016-10-06T19:03:34+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2013\/04\/mystery-man-thumb.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"400\" \/>\n\t<meta property=\"og:image:height\" content=\"260\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Lysa Myers\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"Written by\" \/>\n\t<meta name=\"twitter:data1\" content=\"Lysa Myers\" \/>\n\t<meta name=\"twitter:label2\" content=\"Est. reading time\" \/>\n\t<meta name=\"twitter:data2\" content=\"1 minute\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/\"},\"author\":{\"name\":\"Lysa Myers\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#\\\/schema\\\/person\\\/12b11624d5a648c576d8dce6f93b230a\"},\"headline\":\"Flashback Author Identified by Brian Krebs\",\"datePublished\":\"2013-04-03T16:25:59+00:00\",\"dateModified\":\"2016-10-06T19:03:34+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/\"},\"wordCount\":271,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2013\\\/04\\\/mystery-man-thumb.jpg\",\"keywords\":[\"Flashback\"],\"articleSection\":[\"Malware\",\"Security News\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/\",\"name\":\"Flashback Author Identified by Brian Krebs - The Mac Security Blog\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2013\\\/04\\\/mystery-man-thumb.jpg\",\"datePublished\":\"2013-04-03T16:25:59+00:00\",\"dateModified\":\"2016-10-06T19:03:34+00:00\",\"description\":\"There has been a lot of discussion, since the initial Flashback variants were released in late 2011, about Flashback's actions. Until now, there has been\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2013\\\/04\\\/mystery-man-thumb.jpg\",\"contentUrl\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2013\\\/04\\\/mystery-man-thumb.jpg\",\"width\":\"400\",\"height\":\"260\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/flashback-author-identified-by-brian-krebs\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"Flashback Author Identified by Brian Krebs\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#website\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"name\":\"The Mac Security Blog\",\"description\":\"Keep Macs safe from the dangers of the Internet\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#organization\",\"name\":\"Intego\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"contentUrl\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/wp-content\\\/uploads\\\/2022\\\/10\\\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png\",\"width\":875,\"height\":875,\"caption\":\"Intego\"},\"image\":{\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/#\\\/schema\\\/person\\\/12b11624d5a648c576d8dce6f93b230a\",\"name\":\"Lysa Myers\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a244278f35cc41c7ec676b36673dee0464ed8c7ceafb1ff484fdf13a916d126c?s=96&d=mm&r=g\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a244278f35cc41c7ec676b36673dee0464ed8c7ceafb1ff484fdf13a916d126c?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/a244278f35cc41c7ec676b36673dee0464ed8c7ceafb1ff484fdf13a916d126c?s=96&d=mm&r=g\",\"caption\":\"Lysa Myers\"},\"url\":\"https:\\\/\\\/www.intego.com\\\/mac-security-blog\\\/author\\\/lysam\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"Flashback Author Identified by Brian Krebs - The Mac Security Blog","description":"There has been a lot of discussion, since the initial Flashback variants were released in late 2011, about Flashback's actions. Until now, there has been","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/","og_locale":"en_US","og_type":"article","og_title":"Flashback Author Identified by Brian Krebs - The Mac Security Blog","og_description":"There has been a lot of discussion, since the initial Flashback variants were released in late 2011, about Flashback's actions. Until now, there has been","og_url":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/","og_site_name":"The Mac Security Blog","article_published_time":"2013-04-03T16:25:59+00:00","article_modified_time":"2016-10-06T19:03:34+00:00","og_image":[{"width":400,"height":260,"url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2013\/04\/mystery-man-thumb.jpg","type":"image\/jpeg"}],"author":"Lysa Myers","twitter_card":"summary_large_image","twitter_misc":{"Written by":"Lysa Myers","Est. reading time":"1 minute"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/#article","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/"},"author":{"name":"Lysa Myers","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/12b11624d5a648c576d8dce6f93b230a"},"headline":"Flashback Author Identified by Brian Krebs","datePublished":"2013-04-03T16:25:59+00:00","dateModified":"2016-10-06T19:03:34+00:00","mainEntityOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/"},"wordCount":271,"commentCount":0,"publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2013\/04\/mystery-man-thumb.jpg","keywords":["Flashback"],"articleSection":["Malware","Security News"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/","url":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/","name":"Flashback Author Identified by Brian Krebs - The Mac Security Blog","isPartOf":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/#primaryimage"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/#primaryimage"},"thumbnailUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2013\/04\/mystery-man-thumb.jpg","datePublished":"2013-04-03T16:25:59+00:00","dateModified":"2016-10-06T19:03:34+00:00","description":"There has been a lot of discussion, since the initial Flashback variants were released in late 2011, about Flashback's actions. Until now, there has been","breadcrumb":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/#primaryimage","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2013\/04\/mystery-man-thumb.jpg","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2013\/04\/mystery-man-thumb.jpg","width":"400","height":"260"},{"@type":"BreadcrumbList","@id":"https:\/\/www.intego.com\/mac-security-blog\/flashback-author-identified-by-brian-krebs\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.intego.com\/mac-security-blog\/"},{"@type":"ListItem","position":2,"name":"Flashback Author Identified by Brian Krebs"}]},{"@type":"WebSite","@id":"https:\/\/www.intego.com\/mac-security-blog\/#website","url":"https:\/\/www.intego.com\/mac-security-blog\/","name":"The Mac Security Blog","description":"Keep Macs safe from the dangers of the Internet","publisher":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.intego.com\/mac-security-blog\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.intego.com\/mac-security-blog\/#organization","name":"Intego","url":"https:\/\/www.intego.com\/mac-security-blog\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/logo\/image\/","url":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","contentUrl":"https:\/\/www.intego.com\/mac-security-blog\/wp-content\/uploads\/2022\/10\/intego-organization-logo-for-google-knowledge-graph-875x875-1.png","width":875,"height":875,"caption":"Intego"},"image":{"@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.intego.com\/mac-security-blog\/#\/schema\/person\/12b11624d5a648c576d8dce6f93b230a","name":"Lysa Myers","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/a244278f35cc41c7ec676b36673dee0464ed8c7ceafb1ff484fdf13a916d126c?s=96&d=mm&r=g","url":"https:\/\/secure.gravatar.com\/avatar\/a244278f35cc41c7ec676b36673dee0464ed8c7ceafb1ff484fdf13a916d126c?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/a244278f35cc41c7ec676b36673dee0464ed8c7ceafb1ff484fdf13a916d126c?s=96&d=mm&r=g","caption":"Lysa Myers"},"url":"https:\/\/www.intego.com\/mac-security-blog\/author\/lysam\/"}]}},"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/13067","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/users\/6"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/comments?post=13067"}],"version-history":[{"count":9,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/13067\/revisions"}],"predecessor-version":[{"id":13089,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/posts\/13067\/revisions\/13089"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media\/13081"}],"wp:attachment":[{"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/media?parent=13067"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/categories?post=13067"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intego.com\/mac-security-blog\/wp-json\/wp\/v2\/tags?post=13067"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}