Russian military involved in NotPetya attacks: UK

2/16/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghzYNI6Anca1BCGPLXTKDzKA8JIHruZe9_LhR5xzxe8ZwQXo9WmTcdPFX5m1gDRJ_HRv73E1fkym1SmN75JvW1fkuPTqLa0w4zl0DvFRx01JjU-MYf3BvK9XYJvqNf-aHMNXN5ZMDQwySm/s1600/Russian+military+involved+in+NotPetya+attacks.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Russian military involved in NotPetya attacks: UK" border="0" data-original-height="450" data-original-width="800" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghzYNI6Anca1BCGPLXTKDzKA8JIHruZe9_LhR5xzxe8ZwQXo9WmTcdPFX5m1gDRJ_HRv73E1fkym1SmN75JvW1fkuPTqLa0w4zl0DvFRx01JjU-MYf3BvK9XYJvqNf-aHMNXN5ZMDQwySm/s640/Russian+military+involved+in+NotPetya+attacks.jpg" title="Russian military involved in NotPetya attacks: UK" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Russian military involved in NotPetya attacks: UK</td></tr>
</tbody></table>
<br />
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK government has officially accused the Russian government of June's disruptive and hugely costly NotPetya malware attack.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The UK Government judges that the Russian government, specifically the <a href="http://www.hackerschronicle.com/search/label/Russian%20Millitary">Russian military</a>, was responsible for the destructive NotPetya cyber-attack of June 2017," Foreign Office minister for Cyber Security, Tariq Ahmad, said in a statement.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The attack showed a continued disregard for Ukrainian sovereignty. Its reckless release disrupted organizations across Europe, costing hundreds of millions of pounds."</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Initially, NotPetya was thought to be <a href="http://www.hackerschronicle.com/search/label/Ransomeware">ransomware</a>, but security researchers quickly concluded it was more likely to be destructive <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a> designed to wipe systems.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK's National Cyber Security Centre (NCSC) today revealed it came to the same conclusion, noting that the malware was only masquerading as ransomware and its main purpose was to disrupt.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The NCSC said the Russian military was "almost certainly responsible" for the NotPetya attack.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Shipping container firm Maersk, FedEx's Dutch delivery subsidiary TNT Express, and UK firm Reckitt Benckiser were among global firms that suffered severe disruptions and several hundred million dollars in lost revenue. However, the <b>firms</b>, however, <b>were collateral damage in the ongoing conflict between Ukraine and Russia</b>.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Below is the flow of Petya Attack Flow : </div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfrK5YZfsqC6QuFhNHu1m9yN_VZ7bbK1oGuZ3gdTmJCRxM5MnqajYsWTSdyjs9ViXPqGXr_u29ZWWuvHag9u8MigR588GTZBzHjPW2xZEIGrzqxScUBcTeKBZNaJNzFkswON6w0bYBQ0vx/s1600/petya-attack-flow.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Russian military involved in NotPetya attacks: UK" border="0" data-original-height="424" data-original-width="800" height="338" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfrK5YZfsqC6QuFhNHu1m9yN_VZ7bbK1oGuZ3gdTmJCRxM5MnqajYsWTSdyjs9ViXPqGXr_u29ZWWuvHag9u8MigR588GTZBzHjPW2xZEIGrzqxScUBcTeKBZNaJNzFkswON6w0bYBQ0vx/s640/petya-attack-flow.png" title="Russian military involved in NotPetya attacks: UK" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Russian military involved in NotPetya attacks: UK</td></tr>
</tbody></table>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<br /></div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<b>NotPetya employed the NSA <a href="http://www.hackerschronicle.com/search/label/Exploits">exploits </a>for Windows known as EternalBlue and EternalRomance</b> as well as credential-dumping tools to spread internally across networks once one machine was infected. The exploits were leaked in April by The Shadow Brokers.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The malware<b> initially infected organizations via a compromised update from Ukraine</b> accounting software provider MEDoc. Its MEDoc software is one of two accounting packages required for companies doing business in Ukraine and is widely used by Ukraine agencies.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Maersk, which used MEDoc at its Ukraine offices, recently revealed it was forced to reinstall 45,000 PCs, 4,000 servers and 2,000 applications hit by NotPetya. The company reported losses of $300m due to the incident.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
NCSC notes that Ukraine's financial, energy and government institutions bore the brunt of NotPetya. However, the "indiscriminate design" of the malware caused it to spread to other European and Russian businesses.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Though it is unusual to officially blame another nation for a cyber attack, the US and Five-Eye partners blamed the WannaCry ransomware attack on North Korea. The idea, in part at least, is to name and shame nation-state attackers for their actions.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<b>Russia and North Korea have consistently denied responsibility for the NotPetya, WannaCry, and other cyber attacks.</b></div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK's Ahmad said the Kremlin has positioned Russia in direct opposition to the West.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"It doesn't have to be that way. We call upon Russia to be the responsible member of the international community it claims to be rather than secretly trying to undermine it," he said.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The United Kingdom is identifying, pursuing and responding to malicious cyber activity regardless of where it originates, imposing costs on those who would seek to do us harm."</div>
</div>

Russian military involved in NotPetya attacks: UK The UK government has officially accused the Russian government of June's di...

Millions of android devices Hacked

2/15/2018 The Hackers Chronicle 0

Android Cryptocurrency Hacking News Malwares News Millions of android devices Hacked

Millions of android devices Hacked The Android operating system and its apps are usually more exposed to security problems and the pr...

Western Union Money Transfer, Hacked

2/14/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpuAeT0_k1iZ9oL_nMOItMpEKtDe1t1oZ5fH2p9Yc7WrANYtc_enEGiSKIQ55TfJ-NmhT3Q6_FJk9DwIerAFLmaPCZHzPjbYpark9xpyPfIreyirI3DIc2LAUQQTW_tMbWA9yNviuWh30/s1600/WU_hacked.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="512" data-original-width="800" height="408" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpuAeT0_k1iZ9oL_nMOItMpEKtDe1t1oZ5fH2p9Yc7WrANYtc_enEGiSKIQ55TfJ-NmhT3Q6_FJk9DwIerAFLmaPCZHzPjbYpark9xpyPfIreyirI3DIc2LAUQQTW_tMbWA9yNviuWh30/s640/WU_hacked.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Western Union Money Transfer, Hacked</td></tr>
</tbody></table>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br />
Western Union has confirmed one of its IT suppliers was hacked, and that customer information was exposed to miscreants.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
Someone, who wished to remain anonymous, showed us a copy of a letter dated January 31 that he received from the money-transfer outfit. The missive admitted that a supposedly secure data storage company used by Western Union was compromised: a database full of the wire-transfer giant's customer records was vulnerable to plundering, and hackers were quick to oblige.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"We have discovered that <b>some of your information may have been accessed without authorization as a result of a computer intrusion against an external vendor system formerly used by Western Union for secure data storage</b>," the letter read.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<span style="font-size: 16.0000400543213px; line-height: 24.0000610351563px;">"We promptly moved our external secure storage to a different vendor's system. We immediately notified law enforcement, and are actively cooperating with its investigation. Expert assistance was also immediately engaged to determine what personal information may have been compromised."</span></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
In other words, it sounds as though a <a href="http://www.hackerschronicle.com/search/label/Cloud%20Storage">cloud-based</a> or off-site backup storage provider was hacked. Now that system has been shut down, the cops alerted, and digital forensics teams are probing the network intrusion.</div>
<h3 class="crosshead" style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 1.0625em; margin: 0px 0px 5px;">
<span style="box-shadow: rgb(230, 231, 231) 0em -0.56em 0px inset;">Suspicious</span></h3>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"Upon detecting suspicious activity, Western Union permanently discontinued all use of the vendor's system and the system was taken offline," a spokesperson for Western Union told.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"<a href="http://www.hackerschronicle.com/search/label/Western%20Union">Western Union</a> took immediate action upon learning of this intrusion to notify law enforcement authorities. The company has notified affected individuals and regulators as appropriate. Affected individuals received a customized notification that explains the specific types of his or her personal data that may have been affected."</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
According to the letter, the storage archive contained customers' contact details, bank names, Western Union internal customer ID numbers, as well as transaction amounts, times and identification numbers. Credit card data was definitely not taken, it stressed.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<i>El Reg</i> tweeted a redacted copy of the letter earlier this week:</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrNxpVuL9cK13AgvKiH_UJiZswdFY6KOAXN2MDQ2fo2E7YUK7fj9eAWdPvJDPmO0dWVGME_LGJ-_pxm4JQPHvx2S8nPKhb1nZwWbQ2gR5XJzfRdS_xRF343Kw4dHMGph60yyMdOBnirsU/s1600/DV3ExpCVwAAp3Mg.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Western Union Money Transfer, Hacked" border="0" data-original-height="899" data-original-width="1199" height="478" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrNxpVuL9cK13AgvKiH_UJiZswdFY6KOAXN2MDQ2fo2E7YUK7fj9eAWdPvJDPmO0dWVGME_LGJ-_pxm4JQPHvx2S8nPKhb1nZwWbQ2gR5XJzfRdS_xRF343Kw4dHMGph60yyMdOBnirsU/s640/DV3ExpCVwAAp3Mg.jpg" title="Western Union Money Transfer, Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;"><br /></td></tr>
</tbody></table>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<span style="font-size: 16px;">The </span><b style="font-size: 16px;">red-faced biz was quick to point out that none of its internal payment or financial systems were affected in the attack</b><span style="font-size: 16px;">. It also isn’t saying who the third-party storage supplier was, giving other customers of the slovenly provider time to check whether or not they have been hacked too.</span></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
Western Union says that, so far, it isn't aware of any fraudulent activity stemming from the data security cockup, but just to be on the safe side it is enrolling affected customers in a year of free <a href="http://www.hackerschronicle.com/search/label/Identity%20Theft">identity-fraud</a> protection. </div>
</div>

Cloud Storage Cyber Attack Data Leak Hacking News News Western Union Western Union Money Transfer, Hacked

Western Union Money Transfer, Hacked Western Union has confirmed one of its IT suppliers was hacked, and that customer information ...

Zero-day vulnerability found in Telegram

2/13/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA-cNL6Fal2i1LFz43EYL7drbl57ZLgqrdAbHhdmybDGTagsG4C6Qvx_TTS5FgwQx7SMTlAIX-brWQ4pHGnAotzHZDZF_fKnWxDOBkGxr8sFLhQOXyGuoQVR0h06wHrsIZ_FwwcA0hfPX1/s1600/telegram-zeroday-vulnerability.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="466" data-original-width="732" height="404" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA-cNL6Fal2i1LFz43EYL7drbl57ZLgqrdAbHhdmybDGTagsG4C6Qvx_TTS5FgwQx7SMTlAIX-brWQ4pHGnAotzHZDZF_fKnWxDOBkGxr8sFLhQOXyGuoQVR0h06wHrsIZ_FwwcA0hfPX1/s640/telegram-zeroday-vulnerability.png" width="640" /></a></div>
<br />
Research conducted by Kaspersky showed that the zero-day flaw was based on the <a href="https://www.fileformat.info/info/unicode/char/202e/index.htm" target="_blank">RLO </a>(right-to-left override) Unicode method, which is generally used for coding languages written from right to left, such as Arabic and Hebrew. However, it can also be used by hackers to dupe unknowing recipients into downloading malware, for example disguised as images.<br />
<br />
Kaspersky analysts identified “several scenarios of <a href="http://www.hackerschronicle.com/search/label/Zero-Day" target="_blank">zero-day</a> exploitation in the wild by threat actors.” The threats identified were two-fold. First, the exploit was used to deliver mining software, allowing hackers to use the victim’s machine to mine <a href="http://www.hackerschronicle.com/search/label/CryptoCurrency" target="_blank">cryptocurrency </a>including “Monero, Zcash, Fantomcoin and others.”<br />
<br />
Second, a backdoor was installed allowing <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime" target="_blank">cybercriminals </a>to gain remote access to the victim’s computer after which it started to “operate in a silent mode,” allowing “the threat actor to remain unnoticed in the network and execute different commands, including the further installation of spyware tools.”<br />
<br />
Kaspersky says its analysis suggests the cybercriminals are of <a href="http://www.hackerschronicle.com/search/label/Russian%20Hackers" target="_blank">Russian </a>origin, and the company has offered some tips to protect your PC against attack.  These include not downloading and opening unknown files from untrusted sources, avoiding sharing sensitive personal information in messenger apps and making sure to have reliable antivirus software installed on your machine.<br />
<br />
It appears that only Russian cybercriminals were aware of this <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerability</a>, with all the exploitation cases that we detected occurring in Russia. Also, while conducting a detailed research of these attacks we discovered a lot of artifacts that pointed to involvement by Russian cybercriminals.</div>

Hacking News Malwares News Russian Hackers Telegram Vulnerability Zero-Day Zero-day vulnerability found in Telegram

Research conducted by Kaspersky showed that the zero-day flaw was based on the RLO (right-to-left override) Unicode method, which is gen...

New AndroRAT found, exploiting Rooting Vulnerability

2/13/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQaGho1rE0MYQqEGOAPLEjLxhg3aSXXE0WWpln3Vjy1GTlEcjUDJ9AR4Hwe1Gy-XrSiCg-avCQOt8RYwD6MABqpfekK-k-HBHikdwSv3Kdk1s8kVsu9TgZX4r-m90syf-YyYRwJ_o14zI/s1600/AndroRAT_malware.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="468" data-original-width="888" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQaGho1rE0MYQqEGOAPLEjLxhg3aSXXE0WWpln3Vjy1GTlEcjUDJ9AR4Hwe1Gy-XrSiCg-avCQOt8RYwD6MABqpfekK-k-HBHikdwSv3Kdk1s8kVsu9TgZX4r-m90syf-YyYRwJ_o14zI/s640/AndroRAT_malware.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">New AndroRAT found, exploiting Rooting Vulnerability</td></tr>
</tbody></table>
<br />
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
Trend Micro detected a new variant of Android Remote Access Tool (AndroRAT) (identified as ANDROIDOS_ANDRORAT.HRXC) that has the ability to inject root exploits to perform malicious tasks such as silent installation, shell command execution, WiFi password collection, and screen capture. This AndroRAT targets <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1805">CVE-2015-1805</a>, a publicly disclosed vulnerability in 2016 that allows attackers to penetrate a number of older Android devices to perform its privilege escalation.</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
RATs have long been a common Windows threat, so <b>it shouldn't be a surprise that it has come to Android</b>. A RAT has to gain root access — usually by exploiting a <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerability </a>— in order to have control over a system.<b> Discovered in 2012, </b>the original authors intended AndroRAT — <a href="https://forum.xda-developers.com/android/apps-games/androrat-remote-administration-tool-t2734932">initially a university project </a>— as an open-source client/server application that can provide remote control of an <a href="http://www.hackerschronicle.com/search/label/Android">Android </a>system, which naturally attracted cybercriminals.</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
This new variant of AndroRAT disguises itself as a malicious utility app called TrashCleaner, which is presumably downloaded from a malicious URL. The first time TrashCleaner runs, it prompts the Android device to install a Chinese-labeled calculator app that resembles a pre-installed system calculator. Simultaneously, the TrashCleaner icon will disappear from the device’s UI and the RAT is activated in the background.</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhG_dFWhyphenhyphenokqpobyjnG8ynbQ2gJGlFK11zcZUGVZRcQluN7XUjJKE6QJpM4_oZDL2slP-VbLmcPWQauu9k4m40AcPBCGEsahR95UiL8Ah3vKqdsfZryffr1jZCtX67C1F_fL7P398YFAi0/s1600/TrachCleaner.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="139" data-original-width="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhG_dFWhyphenhyphenokqpobyjnG8ynbQ2gJGlFK11zcZUGVZRcQluN7XUjJKE6QJpM4_oZDL2slP-VbLmcPWQauu9k4m40AcPBCGEsahR95UiL8Ah3vKqdsfZryffr1jZCtX67C1F_fL7P398YFAi0/s1600/TrachCleaner.jpg" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Icon of the malicious TrashCleaner</td></tr>
</tbody></table>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4YyKssi2ASFC2VtKhwr6OrsRdetN-0OFhEBujZLtuPEGGny5IfUh71z7WEPt08JFrb8zUcBwui-oAZNQRq3XMwXyJXF0DvV4EYLS3duKHxSMFHvtq_lPCEk55mbE13HhuZvkWrdQoE3Q/s1600/AndroRAT_Calculator.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="147" data-original-width="111" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4YyKssi2ASFC2VtKhwr6OrsRdetN-0OFhEBujZLtuPEGGny5IfUh71z7WEPt08JFrb8zUcBwui-oAZNQRq3XMwXyJXF0DvV4EYLS3duKHxSMFHvtq_lPCEk55mbE13HhuZvkWrdQoE3Q/s1600/AndroRAT_Calculator.jpg" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Icon of the Chinese-labeled calculator app</td></tr>
</tbody></table>
</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
The configurable RAT service is controlled by a remote server, which could mean that commands may be issued to trigger different actions. The variant activates the embedded root exploit when executing privileged actions. It performs the following malicious actions found in the original AndroRAT:</div>
<ul style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin: 0px 0px 0px 30px; outline: 0px; padding: 0px; vertical-align: baseline;">
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Record audio</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Take photos using the device camera</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of system information such as phone model, number, IMEI, etc.</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of WiFi names connected to the device</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of call logs including incoming and outgoing calls</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of mobile network cell location</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of GPS location</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of contacts list</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of files on the device</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of list of running apps</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of SMS from device inbox</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Monitor incoming and outgoing SMS</li>
</ul>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
Apart from the original features of the <a href="http://www.hackerschronicle.com/search/label/AndroRAT">AndroRAT</a>, it also performs new privileged actions:</div>
<ul style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin: 0px 0px 0px 30px; outline: 0px; padding: 0px; vertical-align: baseline;">
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of mobile network information, storage capacity, rooted or not</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of list of installed applications</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of web browsing history from pre-installed browsers</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of calendar events</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Record calls</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Upload files to victim device</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Use front camera to capture high resolution photos</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Delete and send forged SMS</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Screen capture</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Shell command execution</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of WiFi passwords</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Enabling accessibility services for a key logger silently</li>
</ul>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><i style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Targeting CVE-2015-1805</i></b></div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
Google already <a href="https://source.android.com/security/advisory/2016-03-18">patched </a>CVE-2015-1805 in March 2016,<b> but devices that no longer receive patches or those with a long rollout period are at risk of being compromised by this new AndroRAT variant. </b> Older versions of Android, which are still being used by a significant number of mobile users, may still be vulnerable.</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><i style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Indicators of Compromise (IoCs)</i></b></div>
<table style="background: rgb(255, 255, 255); border-collapse: collapse; border-spacing: 0px; border: 1px solid rgb(228, 228, 228); color: #777777; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline; width: 619px;"><tbody style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<tr style="background: rgb(241, 241, 241); border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295"><b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">SHA256</b></td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108"><b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">App Label</b></td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187"><b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Package Name</b></td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295">2733377c14eba0ed6c3313d5aaa51171f6aef5f1d559fc255db9a03a046f0e8f</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108">TrashCleaner</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187">com.cleaner.trashcleaner</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295">fde9f84def8925eb2796a7870e9c66aa29ffd1d5bda908b2dd1ddb176302eced</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108">TrashCleaner</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187">com.cleaner.trashcleaner</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295">2441b5948a316ac76baeb12240ba954e200415cef808b8b0760d11bf70dd3bf7</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108">TrashCleaner</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187">com.cleaner.trashcleaner</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295">909f5ab547432382f34feaa5cd7d5113dc02cda1ef9162e914219c3de4f98b6e</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108">TrashCleaner</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187">com.cleaner.trashcleaner</td></tr>
</tbody></table>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
<br /></div>
</div>

Android AndroRAT Hacking News Malwares News rat Rooting Trojan Vulnerability New AndroRAT found, exploiting Rooting Vulnerability

New AndroRAT found, exploiting Rooting Vulnerability Trend Micro detected a new variant of Android Remote Access Tool (AndroRAT) (ide...

Winter Olympics website Hacked

2/12/2018 The Hackers Chronicle 0

Hacking News News Olympics Winter Olympics website Hacked

Winter Olympics website hacked The Pyeongchang 2018 Winter Olympics' website went down just before the event's Friday openi...

Millions of Netgear Routers Vulnerable

2/11/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: right; margin-left: 1em; text-align: right;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9Z1CuHPFx2gWwQnNmtt8u5RYO91uU3Cmb3Q5n9oefAJZR5kN-2QD85zJtbCtcL5WUEIeoeLjNvbBF0S_5111uomZufNqA48_3KEQ8RdbTAU3Y5fGt5P15xplZwYI0On9237wkjEkdGn1k/s1600/router_back_label.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="" border="0" data-original-height="192" data-original-width="750" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9Z1CuHPFx2gWwQnNmtt8u5RYO91uU3Cmb3Q5n9oefAJZR5kN-2QD85zJtbCtcL5WUEIeoeLjNvbBF0S_5111uomZufNqA48_3KEQ8RdbTAU3Y5fGt5P15xplZwYI0On9237wkjEkdGn1k/s1600/router_back_label.png" title="Netgear Routers wonderable to be Hacked" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Netgear Routers wonderable to be Hacked</td></tr>
</tbody></table>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEincWcxLWVnPBm6fA4JIuoYKibbxMKRm2oSGclVczATNSqHZGWsAHd-6J6LYOIejPQh99u2fEsB0E8bl3mPGUCNYEx341q3-rSCJJ9U_2QFSU3eD8t0dE4m3sjdsgXMZD9Pg3B8IbMlRfSS/s1600/netgear_password_bypass.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="400" data-original-width="680" height="188" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEincWcxLWVnPBm6fA4JIuoYKibbxMKRm2oSGclVczATNSqHZGWsAHd-6J6LYOIejPQh99u2fEsB0E8bl3mPGUCNYEx341q3-rSCJJ9U_2QFSU3eD8t0dE4m3sjdsgXMZD9Pg3B8IbMlRfSS/s320/netgear_password_bypass.png" width="320" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Netgear Routers</td></tr>
</tbody></table>
<br />
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Security firm Trustwave has disclosed the details of several vulnerabilities affecting Netgear routers, including devices that are top-selling products on Amazon and Best Buy.</span></span></strong><br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The flaws were discovered by researchers in March 2017 and they were patched by Netgear in August, September and October.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">One of the high severity vulnerabilities has been described as a password recovery and file access issue affecting 17 Netgear routers and modem routers, including best-sellers such as R6400, R7000 (Nighthawk), R8000 (Nighthawk X6), and R7300DST (Nighthawk DST).</span></span></div>
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">According to Trustwave, the web server shipped with these and other Netgear routers has a resource that can be abused to access files in the device’s root directory and other locations if the path is known. The exposed files can store administrator usernames and passwords, which can be leveraged to gain complete control of the device.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">An unauthenticated attacker can exploit the flaw remotely if the remote management feature is enabled on the targeted device. Improperly implemented cross-site request forgery (CSRF) protections may also allow remote attacks.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><b>Another high severity flaw affecting 17 Netgear routers, including the aforementioned best-sellers, can be exploited by an attacker to bypass authentication using a specially crafted reques</b>t. Trustwave said the vulnerability can be easily exploited.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">A flaw that can be exploited to execute arbitrary OS commands with root privileges without authentication has also been classified as high severity. Trustwave said command injection is possible through a chained attack that involves a CSRF token recovery vulnerability and other weaknesses.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Two other command injection vulnerabilities have been found by Trustwave researchers, but they have been rated medium severity and they only affect six Netgear router models.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">One of the flaws requires authentication, but experts pointed out that an attacker can execute arbitrary commands after bypassing authentication using the aforementioned authentication bypass vulnerability.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The other medium severity command injection is related to the Wi-Fi Protected Setup (WPS). When a user presses the WPS button on a Netgear router, a bug causes WPS clients to be allowed to execute arbitrary code on the device with root privileges during the setup process.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“In other words, <b>if an attacker can press the WPS button on the router, the router is completely compromised</b>,” Trustwave said in an advisory.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Netgear has put a lot of effort into securing its products, especially since the launch of its bug bounty program one year ago. In 2017, the company published more than 180 security advisories describing vulnerabilities in its routers, gateways, extenders, access points, managed switches, and network-attached storage (NAS) products.</span></span></div>
</div>

Hacking News Netgear Routers News Vulnerability Millions of Netgear Routers Vulnerable

Netgear Routers wonderable to be Hacked Netgear Routers Security firm Trustwave has disclosed the details of several vulnerabilit...