Source Code of Tools used by Cambridge Analytica to hijack Facebook accounts leaked

3/27/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEduR2TtnILaL7oVBznbPnhekcKb7ZUMzGSSXO-DjClOz4H8ZOa0bA67PKwukye5wjLX20yb_-8wnVZUWw54q9q-qodV4ADTCvDelRzYheXpz1mmbGYVSh5jKd3sff7a1eoufQYu76eayC/s1600/facebook-data-leak.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="430" data-original-width="800" height="344" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjEduR2TtnILaL7oVBznbPnhekcKb7ZUMzGSSXO-DjClOz4H8ZOa0bA67PKwukye5wjLX20yb_-8wnVZUWw54q9q-qodV4ADTCvDelRzYheXpz1mmbGYVSh5jKd3sff7a1eoufQYu76eayC/s640/facebook-data-leak.jpg" width="640" /></a></div>
AggregateIQ – a Canadian political advertising firm that played a role in the 2016 <a href="http://www.hackerschronicle.com/search/label/US%20Elections">US election</a> and the UK's "Vote Leave" Brexit campaign – left its applications and database credentials publicly accessible, security firm Upguard <a href="https://www.upguard.com/breaches/aggregate-iq-part-one">said </a>on Monday.<br />
<br />
There's no evidence that the <a href="http://www.hackerschronicle.com/search/label/Data%20Leak">exposed code</a> or data was taken. Nor is there evidence it wasn't. It was simply left accessible to the public for an unspecified period of time.<br />
<br />
In a phone interview,  Chris Vickery, Upguard's director of cyber risk research, said AggregateIQ had installed a custom version of the open source <a href="http://www.hackerschronicle.com/search/label/GitLab">GitLab </a>software version control and collaboration system.<br />
<br />
"For whatever reason, they configured it to allow registration of new accounts by the public," he said.<br />
<br />
About a week ago, on March 20, Vickery found the code repo, hosted on a GitLab subdomain of AggregateIQ.com, <a href="http://gitlab.aggregateiq.com/">gitlab.aggregateiq.com</a>.<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhpN-mtxQ4JVaPMUSb0JYefIHe4kQbv488xyyirSu5b7ACyuNmM2V_ghqK8u1yoXGKtqPsD0njft9ZvxiSTL0GAMlWStlfg5PpnNQb19J4dbD3d_O0xjYIQ7x8CXnmissJvoTluI_07LKO/s1600/aggregatoriq-gitlab.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="968" data-original-width="1537" height="402" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhhpN-mtxQ4JVaPMUSb0JYefIHe4kQbv488xyyirSu5b7ACyuNmM2V_ghqK8u1yoXGKtqPsD0njft9ZvxiSTL0GAMlWStlfg5PpnNQb19J4dbD3d_O0xjYIQ7x8CXnmissJvoTluI_07LKO/s640/aggregatoriq-gitlab.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">AggregateIQ GitLab Repository</td></tr>
</tbody></table>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGOtwotX9_tYp5sm4XP0msxaecuw8sy07HyEmDixBoitOm26hCogCjtEwp9FCmwnY5DP6VmS7MTZQgSsLiK0Rq0E_dQpP7yruyFu-pagphtD4hFsI283U9Bkrl2TSvAJwj13bvZFxMDlBq/s1600/aggregatoriq-mamba-jamba.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="765" data-original-width="989" height="494" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGOtwotX9_tYp5sm4XP0msxaecuw8sy07HyEmDixBoitOm26hCogCjtEwp9FCmwnY5DP6VmS7MTZQgSsLiK0Rq0E_dQpP7yruyFu-pagphtD4hFsI283U9Bkrl2TSvAJwj13bvZFxMDlBq/s640/aggregatoriq-mamba-jamba.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Explanation of Primary Data Storage</td></tr>
</tbody></table>
<br />
Accessing the URL allowed him to register simply by providing an email address. After that, he was able to see the firm's tools and data.<br />
<br />
Vickery said he informed federal authorities of his findings but declined to name the specific agency, per the agency's request. He also said he informed AggregateIQ, and the biz shut down access 11 minutes later.<br />
<br />
Upguard suggests the material found – apparently used to support US Senator Ted Cruz's failed 2016 presidential campaign – raises questions about the firm's alleged ties to Cambridge Analytica, which <b>received $5.8 million for services rendered from the Cruz campaign</b>.<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgb3CUX1Yx_mfMsBIVcfaWXoXimw20oSbL7mbopFaBvD1oL2R655bmOanYDHr-UFIeUXgMWKb1JCfv4dh8upTaxvVkDpuY_qaNy_eDv4whWTR_Vjs8rqSGyOpfEKmWRkZGFGK8kWxj9H44y/s1600/ripon_voicemail_script.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="273" data-original-width="766" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgb3CUX1Yx_mfMsBIVcfaWXoXimw20oSbL7mbopFaBvD1oL2R655bmOanYDHr-UFIeUXgMWKb1JCfv4dh8upTaxvVkDpuY_qaNy_eDv4whWTR_Vjs8rqSGyOpfEKmWRkZGFGK8kWxj9H44y/s640/ripon_voicemail_script.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">US Senator Ted Cruz's VoiceMail Script: Ripon_canvas</td></tr>
</tbody></table>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEkbL_0FhZWFF1BjqlH0tqpr5avCuvpYFn-e6o7gd1U1mSRyde4al4xu8kdQezEI2JHujT5zyDwJtgMVV_Dlz9fnEN9xpNwvNXzU7_GIqcZkCZH4Jx6hOoagX8Yn3mFNFGKc_ujgTrKSjK/s1600/ripon_dialer_commit.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="288" data-original-width="992" height="184" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiEkbL_0FhZWFF1BjqlH0tqpr5avCuvpYFn-e6o7gd1U1mSRyde4al4xu8kdQezEI2JHujT5zyDwJtgMVV_Dlz9fnEN9xpNwvNXzU7_GIqcZkCZH4Jx6hOoagX8Yn3mFNFGKc_ujgTrKSjK/s640/ripon_dialer_commit.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Ripon_dialer utilizing phonebanking utility.</td></tr>
</tbody></table>
<br />
<a href="http://www.hackerschronicle.com/search/label/cambridge%20analytica">Cambridge Analytica</a>, a UK-based data analytics firm, stands at the center of the current Facebook privacy scandal, a consequence of the biz obtaining about 50 million Facebook profiles from a researcher who took advantage of the social media site's former policy of letting app devs gather info on app users and all of their friends.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/aggregateiq">AggregateIQ </a>has been linked to Cambridge Analytica in press reports; Cambridge Analytica CEO Alexander Nix (currently suspended after undercover video of him discussing his company's tactics) has acknowledged using AggregateIQ in the past to develop software applications.<br />
<br />
A Guardian/Observer report from May 2017 alleges that Wylie, the whistleblower who helped bring the Facebook data scandal to the fore, brought AggregateIQ and Cambridge Analytica together.<br />
  <br />
Read More About: <a href="http://www.hackerschronicle.com/2018/03/facebook-data-breach.html">Facebook Data Leak</a><br />
<br />
The report asserts that at one point, AggregateIQ’s address and phone number were the same as the address and phone listed for SCL Canada on Cambridge Analytica’s website.<br />
<br />
On Saturday, AggregateIQ issued a statement to distance itself from Cambridge Analytica and its parent company SCL and to assert that it has never knowingly been involved in illegal activity.<br />
<br />
"AggregateIQ has never been and is not a part of Cambridge Analytica or SCL," the Canadian company said. "Aggregate IQ has never entered into a contract with Cambridge Analytica. Chris Wylie has never been employed by AggregateIQ."<br />
<br />
Vickery expressed skepticism about AggregateIQ's disavowal of ties to Cambridge Analytica.<br />
<blockquote class="tr_bq">
I find it hard to believe that there would be such a non-relationship as they describe," he said. "I've seen compelling evidence the to contrary.</blockquote>
<br />
Upguard says it discovered "a set of sophisticated applications, data management programs, advertising trackers, and information databases that collectively could be used to target and influence individuals through a variety of methods, including automated phone calls, emails, political websites, volunteer canvassing, and Facebook ads."<br />
<br />
The security biz also said it found various credentials, keys, hashes, usernames, and passwords to access AggregateIQ accounts, which would allow hackers who obtained the information to compromise accounts. Vickery clarified that the databases were not directly exposed.<br />
<blockquote class="tr_bq">
These are the tools used to interact with the data," he said. "These aren't the databases themselves.</blockquote>
The credentials to access the databases through these tools were available but he said he did not use them – using someone else's credentials to login without authorization carries a potential legal risk.<br />
<br />
But, said Vickery, there's mention of the Republican National Committee and a significant data store. Upguard's post contains a screenshot of an application described at the Database of Truth that combines RNC data with state voter files, consumer data, third party data providers, and other sources of information. In theory, that database could contain information on millions of US voters.<br />
<br />
Vickery said he is considering further posts about his findings but has yet to determine the details.<br />
<br />
Asked whether it is aware of Upguard's findings, a spokesperson for the Office of the Privacy Commissioner of Canada sent in the following statement:<br />
<br />
<blockquote class="tr_bq">
What we can tell you at this point is that we have been in contact with our provincial counterpart in British Columbia, which has been examining matters related to AggregateIQ and our discussions with them are ongoing. We don’t have further information to share at this time.</blockquote>
</div>

Source Code of Tools used by Cambridge Analytica to hijack Facebook accounts leaked

AggregateIQ – a Canadian political advertising firm that played a role in the 2016 US election and the UK's "Vote Leave" ...

'Biggest Leak in History' : iPhone source code LEAKED

2/08/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTCpeNjQs-nRH19WHT0uo3TGM3QzlaCoLEL9HNvuBaGcH_oNbmXIs7_4F-0-rh8Z8oAXu9cDxitDTxsYpjzC_RimkEKFsnzifm9jjBbqGJ9dtaLLrCdh0aIngAkJnvBQAkQ8xKfnL8lo0Z/s1600/iPhone-code-leaked.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="350" data-original-width="590" height="376" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjTCpeNjQs-nRH19WHT0uo3TGM3QzlaCoLEL9HNvuBaGcH_oNbmXIs7_4F-0-rh8Z8oAXu9cDxitDTxsYpjzC_RimkEKFsnzifm9jjBbqGJ9dtaLLrCdh0aIngAkJnvBQAkQ8xKfnL8lo0Z/s640/iPhone-code-leaked.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">'Biggest Leak in History' : iPhone source code leaked</td></tr>
</tbody></table>
<br />
Someone just posted what experts say is the <a href="http://www.hackerschronicle.com/search/label/Source%20Code" target="_blank">source code</a> for a core component of the iPhone’s operating system on GitHub, which could pave the way for hackers and security researchers to find vulnerabilities in iOS and make iPhone jailbreaks easier to achieve.<br />
The GitHub code is labeled “<b>iBoot</b>,” which is the part of iOS that is responsible for ensuring a trusted boot of the operating system. In other words, it’s the program that loads iOS, the very first process that runs when you turn on your iPhone. It loads and verifies the kernel is properly signed by Apple and then executes it—it’s like the iPhone’s BIOS.<br />
<br />
The code says it’s for iOS 9, an older version of the operating system, but portions of it are likely to still be used in iOS 11.<br />
<br />
Apple has traditionally been very reluctant to release code to the public, though it has made certain parts of <a href="http://www.hackerschronicle.com/search/label/iOS" target="_blank">iOS</a> and MacOS open source in recent years. But it has taken particular care to keep iBoot secure and its code private; bugs in the boot process are the most valuable ones if reported to Apple, which values them at a max payment of $200,000. “<b>This is the biggest leak in history</b>,” Jonathan Levin, the author of  on iOS and Mac OSX internals, told me in an online chat. “It’s a huge deal.”<br />
<br />
Levin said the code appears to be the real iBoot code because it aligns with code he <a href="http://www.hackerschronicle.com/search/label/Reverse%20Engineering" target="_blank">reverse engineered</a> himself. A second security researcher familiar with iOS also said they believe the code is real. We don’t know who is behind the leak. Apple did not respond to a request for comment.<br />
Having access to the source code of iBoot gives iOS security researchers a better chance to find vulnerabilities that could lead to compromising or jailbreaking the device, Levin said. That means hackers could have an easier time finding flaws and bugs that could allow them to crack or decrypt an iPhone. And, perhaps, this leak could eventually allow advanced programmers to emulate iOS on non Apple platforms.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjU63mWjBrFYlpcwlnVfohdJ3jJYYUz3pFHIjjJ9SMS2KhaSZoi1vjJki5mM2UC_mjSFhiO_dLHxvYOsiwY48cUww3Qv2BBsj5jAKJmBg8HeRn65NyZdg5cAB6c35aF7ey3kLZXmS3qCEXB/s1600/ios-code.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="482" data-original-width="640" height="301" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjU63mWjBrFYlpcwlnVfohdJ3jJYYUz3pFHIjjJ9SMS2KhaSZoi1vjJki5mM2UC_mjSFhiO_dLHxvYOsiwY48cUww3Qv2BBsj5jAKJmBg8HeRn65NyZdg5cAB6c35aF7ey3kLZXmS3qCEXB/s400/ios-code.png" width="400" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
<br /></div>
<div class="separator" style="clear: both;">
<a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">Vulnerabilities </a>in previous versions of iBoot allowed jailbreakers and hackers to brute-force their way through the iPhone’s lock screen and decrypt a user’s data. But newer iPhones have a chip , which has hardened the security of the device.</div>
<div class="separator" style="clear: both;">
<br /></div>
<div class="separator" style="clear: both;">
For regular users, Levin added, this means that tethered jailbreaks, which require the phone to be connected to a computer when booting, could soon be back. These jailbreaks used to be relatively easy to pull off and were common, but are now extremely hard to come by on up-to-date iOS devices, which have advanced security mechanisms that make it hard for even highly skilled researchers from even looking for bugs, as they need to first jailbreak the device before beginning to probe the device.</div>
<div class="separator" style="clear: both;">
It’s these security improvements . Nowadays, finding bugs and vulnerabilities in iOS is something that requires a significant amount of time and resources. That’s why the jailbreaking community gets excited for any leak of source code or any exploit.</div>
<div class="separator" style="clear: both;">
<br /></div>
<div class="separator" style="clear: both;">
“iBoot is the one component <a href="http://www.hackerschronicle.com/search/label/Apple" target="_blank">Apple </a>has been holding on to, still encrypting its 64 bit image,” Levin said. “And now it’s wide open in source code form.”</div>
<br /></div>

Data Leak iOS News Source Code 'Biggest Leak in History' : iPhone source code LEAKED

'Biggest Leak in History' : iPhone source code leaked Someone just posted what experts say is the source code for a core comp...

Bitcoin Bank Hacked, Theft of $6,20,000

3/04/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqrBYVYzRsfVnaUNr447VTqFtwzKDZUNcHJocKWkQNtZ8KpPCHCykPNCC3c7qhrtW8-6iSe2wkHrqQlrUmXalRzjg02z5mPShMs1qQUbx3BBnMJTaUE_JmKor5wZMN-9_bo7jtvuaQohGm/s1600/bitcoin-hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bitcoin Bank Hacked, Theft of $6,20,000" border="0" height="225" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgqrBYVYzRsfVnaUNr447VTqFtwzKDZUNcHJocKWkQNtZ8KpPCHCykPNCC3c7qhrtW8-6iSe2wkHrqQlrUmXalRzjg02z5mPShMs1qQUbx3BBnMJTaUE_JmKor5wZMN-9_bo7jtvuaQohGm/s1600/bitcoin-hacked.png" title="Bitcoin Bank Hacked, Theft of $6,20,000" width="400" /></a></div>
<br />
Flexcoin, famous for making <a href="http://www.hackerschronicle.com/search/label/Bitcoin" target="_blank">bitcoin</a> banking as easy as regular banking, is no more. The company shut its doors on Tuesday morning after hackers stole 896 bitcoins (nearly $620,000) from its vault on Sunday. And the most unsettling thing? That wasn't even the only bitcoin heist last weekend.<br />
To <a href="https://en.bitcoin.it/wiki/Flexcoin" target="_blank">Flexcoin's</a> credit, it wasn't completely cleaned out by hackers. Hackers did clean out Flexcoin's hot wallet, but an undisclosed number of bitcoins in cold storage were untouched. "Cold storage" simply means that the bitcoins were kept in computers <a href="https://en.bitcoin.it/wiki/Cold_storage" target="_blank">not connected to the internet</a>, an extra level of security for which customers pay an extra 0.5 percent. Flexcoin will give those bitcoins back to customers. Those whose bitcoins were stolen are, well, they're shit out of luck because bitcoins aren't insured like good ol' greenbacks are in most banks.<br />
If this sounds like a familiar story, that's because it is. On Tuesday, another bitcoin firm called <a href="https://bitcointalk.org/index.php?topic=499580" target="_blank">Polonix</a> also admitted that hackers broke in and stole 12.5 percent of its reserves, though it plans on replenishing the lost 'coin itself. And who could forget the infamous implosion of Mt.Gox, the Japan-based bitcoin exchange that filed for bankruptcy last week and announced that $424 million worth of cryptocurrency was lost and gone forever. Those just a couple of the major heists and boondoggles on a growing list of heists and boondoggles.<br />
But what do you expect. The burgeoning bitcoin industry is famously unstable and <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerable</a>. Sure, it's an exciting idea for the sake of liberty and anarchy and whatever! It's just not the safest way to store your money right now, is all.</div>

Bitcoin Cyber Crime Hacking News News Russian Hackers Source Code Bitcoin Bank Hacked, Theft of $6,20,000

Flexcoin, famous for making bitcoin banking as easy as regular banking, is no more. The company shut its doors on Tuesday morning after...

Source Code of Tools used by Cambridge Analytica to hijack Facebook accounts leaked

'Biggest Leak in History' : iPhone source code LEAKED

Bitcoin Bank Hacked, Theft of $6,20,000

Popular

Comments

Archive