Microsoft Outlook Breach Targeting Cryptocurrency Users

4/30/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHkvDoGBQpjT4W3SvbIPYYq3OcyhA4R4zK1748reunJHUTabTQPZrNb3Q1AnY8mD5qAX4HIbDwkHuqtXWX1cgbPJlfoVL7Tym4y3HotYKXBllGvEWyQTZRx4w1ztbekvKG5Wkl_vikSIe5/s1600/bitcoin_outlook_breach.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="963" data-original-width="1448" height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHkvDoGBQpjT4W3SvbIPYYq3OcyhA4R4zK1748reunJHUTabTQPZrNb3Q1AnY8mD5qAX4HIbDwkHuqtXWX1cgbPJlfoVL7Tym4y3HotYKXBllGvEWyQTZRx4w1ztbekvKG5Wkl_vikSIe5/s640/bitcoin_outlook_breach.jpeg" width="640" /></a></div>
<br />
Earlier this month, news broke out that hackers were not only able to access Outlook users’ email metadata as previously reported, but also email content. The breach centered around a hacker getting hold of a Microsoft customer support worker’s login credentials; from there, the hacker could dive into the content of any non-corporate Outlook, Hotmail, or MSN account, Motherboard found.<br /><br />Now, multiple victims have come forward to flag what they believe may be one of the motivating reasons behind the breach: emptying peoples’ cryptocurrency accounts.<br /><br />“The hackers also had access to my inbox allowing them to password reset my Kraken.com account and withdrawal [sic] my Bitcoin,” Jevon Ritmeester, a Microsoft user that the company alerted to the data breach, told in an email, referring to popular cryptocurrency exchange Kraken.<br /><br />For verification purposes, Ritmeester provided Motherboard with the breach notification emails he received from Microsoft, as well as a screenshot showing what he said was an email forwarding rule the hackers set up: anytime an email mentioned the term “Kraken,” his account would automatically forward it to a Gmail address presumably controlled by the hackers.<br /><br />
<blockquote class="tr_bq">
Do you know anything else about this breach? You can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com</blockquote>
<br />That would include emails such as password reset and Bitcoin withdrawal requests. Indeed, Ritmeester only found someone had requested both of those after checking the trash of his email account, he wrote in a recent post on the tech forum Tweakers. In the post, he added that he lost just over 1 bitcoin, or around $5,000 at the current exchange rate.<br /><br />It appears Ritmeester isn’t the only person who hackers stole cryptocurrency from due to the Microsoft breach.<br /><br />“My account was hacked as a direct result of this,” Reddit user shinratechlabs wrote earlier this month, adding that they lost “25,000 in crypto,” although it’s not clear what currency they may be referring to, fiat or otherwise.<br /><br />“Same exact for me only a lot less funds stolen, sucks,” another Reddit user, mickey_ficke, chimed in. Neither Reddit user responded to a request for comment.<br /><br />
<blockquote class="tr_bq">
“I feel Microsoft is trying to cover up and is not taking this seriously.”</blockquote>
<br />In his post on Tweakers, Ritmeester said he didn’t have two-factor authentication enabled on Kraken, which may have kept the hackers out of this cryptocurrency account. If he had it enabled, the hackers may have had to take control of this phone number as well in order to intercept the two-factor authentication tokens, for instance.<br /><br />A Microsoft spokesperson told on Monday that, “Customers who believe they have been impacted beyond what was outlined in the company’s notification should contact the Microsoft support team for assistance.”<br /><br />Originally, when TechCrunch and other outlets reported the Outlook data breach, Microsoft said it only impacted email metadata and customer information, such as subject lines and the names of other email addresses users communicated with. After Motherboard presented Microsoft with evidence that email content had also been impacted, Microsoft revised its statement, despite already being fully aware that content was exposed; the company had issued breach notification emails to victims saying as much. <a href="https://motherboard.vice.com/en_us/article/xwndwn/microsoft-outlook-msn-hotmail-breach-cryptocurrency-bitcoin"><span style="font-size: xx-small;">Source</span></a></div>

Earlier this month, news broke out that hackers were not only able to access Outlook users’ email metadata as previously reported, but a...

Calendar app in Mac App Store is openly mining cryptocurrency in background

3/13/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnp2gfb-T4DnvsHXezl5oNNba6XRwuEuLIfSdCLiBD_8951TnC2rwl-U5icAfUFJTACq-v6ieYzJ7S48td97pqrXtcWOGBZKiELIxK6COmmBPKi-jlDcb5YNr38xxmHg7UHKq0Bzwntt4-/s1600/calendar-2-mining-monero.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Popular Calendar 2 app openly mines Monero by default" border="0" data-original-height="582" data-original-width="571" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnp2gfb-T4DnvsHXezl5oNNba6XRwuEuLIfSdCLiBD_8951TnC2rwl-U5icAfUFJTACq-v6ieYzJ7S48td97pqrXtcWOGBZKiELIxK6COmmBPKi-jlDcb5YNr38xxmHg7UHKq0Bzwntt4-/s640/calendar-2-mining-monero.jpg" title="Popular Calendar 2 app openly mines Monero by default" width="625" /></a></div>
A schedule application in the Mac App Store <b>Calendar 2</b> has been mining <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency">cryptocurrency </a>out of sight in return for giving clients extra highlights — and an alternative to quit mining has been broken. Up until this point, Apple has not taken the booking application Calendar 2 down, even after Ars Technica informed the organization that <a href="https://itunes.apple.com/us/app/calendar-2/id415181149?mt=12">Calendar 2</a> has been mining virtual currency. <br />
<br />
The application is a buffed-up variant of Apple's Calendar application in <a href="http://www.hackerschronicle.com/search/label/macOS">macOS</a>, yet as of late, its designer, Qbix, added additional code to mine <a href="http://www.hackerschronicle.com/search/label/Monero">monero</a>, an advanced coin propelled in April 2014 and intended to be a more unknown adaptation of bitcoin, as you can't see exchanges on an open record. That makes Calendar 2 something of an irregularity in the App Store — there don't have all the earmarks of being other mining applications in the store, not to mention applications that utilization mining as an approach to get extra an incentive from non-paying clients. <br />
<br />
The miner keeps running in return for giving the clients a chance to get to more premium highlights. Clients can quit by keeping premium highlights off or paying for them through the App Store. <br />
<br />
Be that as it may, as Ars noticed, the application had a bug that kept the digger running, regardless of whether clients endeavored to quit, and a moment bug that made the excavator expend a larger number of assets than initially proposed. A client noted on Twitter that the application "<b>ate 200% CPU until the point that I discovered it and murdered it. I didn't expect a mineworker contamination from an App Store seller. Amazing</b>." The application's present rating is two out of five in the App Store, with numerous current surveys docking stars due to the undesirable mining. Qbix expressed that it was highly involved with distributing a fix for the bugs. <br />
<br />
Mining programs tend to support Monero over <a href="http://www.hackerschronicle.com/search/label/Bitcoin">Bitcoin </a>or Ethereum, as Monero has a more CPU-friendly hashing calculation. </div>

Calendar app in Mac App Store is openly mining cryptocurrency in background

Apple App Store Calender2 cryprocurrency mining Cryptocurrency Cryptocurrency Malware Cryptomining mac software macOS Monero Calendar app in Mac App Store is openly mining cryptocurrency in background

A schedule application in the Mac App Store Calendar 2 has been mining cryptocurrency out of sight in return for giving clients extra h...

Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

3/10/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdV7v7ncahe3qwjXHcok_B73pE_DNqfje6O7Q30mp3Zo1V1TZtqUKjP9luc1VvqZjcL9DdzR6EFbGO_wBBFmTFmxdrlzDHmgnmqmGYuzhv3nT1eZGKUJLuuB-GTvK96Byo-Te-UdzKKiDq/s1600/cryptoccurency-mining-malware-RedisWannaMine.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hackers are targeting Redis and Windows servers for cryptomining " border="0" data-original-height="465" data-original-width="720" height="411" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdV7v7ncahe3qwjXHcok_B73pE_DNqfje6O7Q30mp3Zo1V1TZtqUKjP9luc1VvqZjcL9DdzR6EFbGO_wBBFmTFmxdrlzDHmgnmqmGYuzhv3nT1eZGKUJLuuB-GTvK96Byo-Te-UdzKKiDq/s640/cryptoccurency-mining-malware-RedisWannaMine.jpg" title="Hackers are targeting Redis and Windows servers for cryptomining " width="640" /></a></div>
<br />
Security researchers at Imperva have come across a new <a href="http://www.hackerschronicle.com/search/label/Cryptojacking">cryptojacking </a>worm that infects Redis and Windows servers with cryptomining <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a>.<br />
<br />
The attack, which has been dubbed <a href="http://www.hackerschronicle.com/search/label/RedisWannaMine">RedisWannaMine </a>by researchers from security firm Imperva, scans for <b>misconfigured Redis deployments and Windows Servers that are still vulnerable to the Eternal Blue SMB <a href="http://www.hackerschronicle.com/search/label/Exploits">exploit</a>.</b><br />
<br />
While investigating an attack against a web server that attempted to exploit the <b>CVE-2017-9805</b> vulnerability in Apache Struts, the Imperva researchers located a command-and-control server hosting multiple attack scripts. One of those scripts was a new cryptomining downloader that exhibited worm-like behavior.<br />
<br />
When executed, the script attempts to install a variety of packages through apt-get or yum—depending on the Linux distribution—creates entries in crontab for persistence and adds a new authorized SSH key for authentication. It then proceeds to download a tool called masscan from GitHub and compiles it.<br />
<br />
<b>Masscan is a high-performance TCP port scanner</b> and is used by <b>RedisWannaMine </b>to scan external and internal IP addresses for Redis deployments. Redis is an in-memory data store that can be used as a database, cache or message broker. It is usually deployed on internal networks, but thousands of such servers have been found exposed on the internet in the past. The project page of <a href="https://github.com/robertdavidgraham/masscan">Masscan</a> describes it as “<b>TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes</b>.”<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJMVXe1axhx_0ifPV9UQfCDbpGj7tB7CVqo97UHjD9NP-PWON8uni3Mt8IizLcBToJNJ3Zc3mHPcVqbcw_SYEPegsRg_gD2szWYtMy7mTf1mTMDI4OlM-LLyM33gKHR8POmdvnMP3Doms/s1600/mascan-TCP-Scanner.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Masscan a high-performance TCP port scanner" border="0" data-original-height="206" data-original-width="845" height="155" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJMVXe1axhx_0ifPV9UQfCDbpGj7tB7CVqo97UHjD9NP-PWON8uni3Mt8IizLcBToJNJ3Zc3mHPcVqbcw_SYEPegsRg_gD2szWYtMy7mTf1mTMDI4OlM-LLyM33gKHR8POmdvnMP3Doms/s640/mascan-TCP-Scanner.png" title="Masscan a high-performance TCP port scanner" width="640" /></a></div>
<br />
<br />
When an unprotected Redis server is discovered, the script installs cryptomining malware on it and creates crontab entries for persistence. The script then launches another scan, this time for Windows Servers that accept SMB connections.<br />
<br />
The goal of the second scan is to find servers that are vulnerable to the Eternal Blue SMB exploit used by <a href="http://www.hackerschronicle.com/search/label/WannaCry">WannaCry</a>, <a href="http://www.hackerschronicle.com/search/label/notPetya">NotPetya </a>and other malware attacks over the past year. When such a servers are identified, the script downloads and installs a different cryptomining component for Windows.<br />
<br />
Compared to past cryptojacking attacks that primarily target servers available on the internet, <b>RedisWannaMine also spreads laterally through local networks, making it much more dangerous to companies.</b><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXH9YAByWecwOsKjw_3-Hh9YEHhFJv6d1_vJ60su3ELwMZLe2IYggemN0gZj5AgFg-YHsy7XiuYUfviIo26KgUk77daHKbinqPVTKH208B9EnAWqf4wGQRsgcdyX-K9WbO6NlKtrHbzQgI/s1600/working-of-RedisWannaMine.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Working of RedisWannaMine Malware" border="0" data-original-height="570" data-original-width="1024" height="355" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXH9YAByWecwOsKjw_3-Hh9YEHhFJv6d1_vJ60su3ELwMZLe2IYggemN0gZj5AgFg-YHsy7XiuYUfviIo26KgUk77daHKbinqPVTKH208B9EnAWqf4wGQRsgcdyX-K9WbO6NlKtrHbzQgI/s640/working-of-RedisWannaMine.png" title="Working of RedisWannaMine Malware" width="640" /></a></div>
<br />
The malware “is more complex in terms of evasion techniques and capabilities,” the Imperva researchers said in a report. “It demonstrates a worm-like behavior combined with advanced exploits to increase the attackers’ infection rate and fatten their wallets. In a nutshell, cryptojacking attackers have upped their game and they are getting crazier by the minute!” </div>

Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Cryptocurrency Cryptojacking Cryptomining CVE-2017-9805 Redis RedisWannaMine Windows Server Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Security researchers at Imperva have come across a new cryptojacking worm that infects Redis and Windows servers with cryptomining malwa...

4000 Government Websites Hacked in less than 4 Hours to Mine Cryptocurrency

3/03/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnJjqeIjcqU3MGFmsgNnL0NeymCNjU4wfbAPOJzO7r3dusjiHbjsAgXgK-3KytrKTYX_nru_Xf_Jd3jVU4bICc1ulejSq4tNjczTh46yG_aqNpuXbOMn6J4zp77oKxIdldi_BFDqmSTFwa/s1600/United-States-courts-portal-Hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Government Websites Hacked to mine Cryptocurrency" border="0" data-original-height="360" data-original-width="1000" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnJjqeIjcqU3MGFmsgNnL0NeymCNjU4wfbAPOJzO7r3dusjiHbjsAgXgK-3KytrKTYX_nru_Xf_Jd3jVU4bICc1ulejSq4tNjczTh46yG_aqNpuXbOMn6J4zp77oKxIdldi_BFDqmSTFwa/s640/United-States-courts-portal-Hacked.jpg" title="Government Websites Hacked to mine Cryptocurrency" width="640" /></a></div>
Over four thousand high profile government websites have been compromised by <a href="http://www.hackerschronicle.com/search/label/Dark%20Web" target="_blank">dark web</a> hackers across the globe, mining virtual currency secretly, and particularly Monero.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>has become one of the popular cryptocurrency recently especially on the ‘<a href="http://www.hackerschronicle.com/search/label/Dark%20Web" target="_blank">dark web</a>’– a section of the internet that can only be accessed using a special browser which is capable of anonymizing your browsing location as well as identity. Dark web criminals are taking advantage of this anonymity by trading illegal commodities, substances and services using virtual currencies.<br />
<br />
<b>4,275 websites including those in the U.K., the U.S., Ireland, Australian and Canada with government websites with hundreds of thousands of visitors were hacked in less than a period of four hours</b> and unwittingly mined for <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency </a>exploiting a security breach. Some of the compromised websites include the <b>United States courts online portal</b>, the <b>United States Information Commissioner Office</b>; the <b>National Health Service</b> in the <b>United Kingdom</b> and the <b>Victorian Parliament </b>website in <b>Australia</b>. The attack by a cryptojacking code hit common websites which had the text-to-speech accessibility script Browsealoud for the visually impaired from Texthelp company.<br />
<br />
Recently, Monero has grown in popularity with a market capitalization of $4 billion. Its privacy feature has contributed to its momentum on the dark web making it harder to track compared to bitcoin.<br />
<br />
The prices of virtual currency in the market skyrocketed recently and as a scheme that has drawn the attention of criminals. <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime" target="_blank">Cybercrimes </a>increased especially on cryptocurrency as criminals tried to cash in on the skyrocketing crypto prices. The cybercrime industry is recently believed to be overtaking the illegal drug trafficking industry in terms of revenue and hence attracting criminals.<br />
<br />
The hacking process involved insertion of a <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malicious </a>code that takes over a portion of a victim’s computer and central processing. Therefore the hacker has the ability of opening a website using a browser in order to mine virtual currency.<br />
<br />
The process of mining digital coins requiring less processing power such as Monero is much easier compared to mining bitcoin from websites as it requires powerful specialized computers and software, making Monero mining a better fit for saving on time and energy, making it a very attractive option to criminals.<br />
<br />
The dark web hackers had an easier time as they did not compromise each of the 4,275 websites at once, but rather hacked a globally-used plugin named ‘<b>Browsealoud</b>’ which is capable of reading out text from websites for the blind.<br />
<br />
After the Browsealoud code was hacked, <b>CoinHive’s Monero miner</b> was silently and secretly injected. Thereafter, any website using the Browsealoud plugin was automatically compromised.<br />
<br />
However the cyber-attack was deemed successful as there were basic regulatory measures and requirements over accessibility of some of these government websites that have not been met.</div>

Cryptocurrency Cyber Crime Dark Web Hacking News Monero News 4000 Government Websites Hacked in less than 4 Hours to Mine Cryptocurrency

Over four thousand high profile government websites have been compromised by dark web hackers across the globe, mining virtual currency...

Tesla's Cloud Servers Hacked to mine Cryptocurrency

2/21/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s1600/Tesla-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Kubernetes Consoles Breached" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s640/Tesla-Servers-Hacked.png" title="Kubernetes Consoles Breached" width="640" /></a></div>
<br />
Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency</a>. The incident took place last year when hackers gained access to Tesla's Kubernetes server, an open-source application used by large companies to manage API and server infrastructure deployed on cloud hosting providers.<br />
<br />
Cloud security firm RedLock —whose experts discovered the hacked server— said hackers found a "pod" inside the <a href="http://www.hackerschronicle.com/search/label/Kubernetes" target="_blank">Kubernetes </a>console that stored login credentials for one of Tesla's AWS cloud infrastructure.<br />
<br />
RedLock says the <a href="http://www.hackerschronicle.com/search/label/AWS" target="_blank">AWS </a>buckets appeared to have been storing sensitive data such as telemetry, but a Tesla Motors spokesperson told  in an email the data was from "internally-used engineering test cars only." While there's no evidence intruders stole any data, they did install a mining application that utilized the vast computational resources of Tesla's AWS servers to mine the <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero cryptocurrency</a>.<br />
<br />
A Tesla spokesperson told that the company received a notification about the incident and secured the server immediately. RedLock said today the incident took place because Tesla engineers forgot to secure the Kubernetes console with an access password.<br />
<br />
"We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it," Tesla said. "The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way.”<br />
<br />
It is very clear that these hackers knew what they were doing, as they set up a private mining pool to use for their illegal mining operations only, hid the mining pool behind CloudFlare, configured the mining software to listen for commands on a non-standard port, and throttled the mining software to use only a small portion of <a href="http://www.hackerschronicle.com/search/label/Tesla" target="_blank">Tesla's</a> AWS CPU resources. All of these configuration changes were made to avoid detection. Because they used a custom mining pool, it is unclear how much money this hacker group made.</div>

AWS Cryptocurrency Hacking News Kubernetes Monero News Tesla Tesla's Cloud Servers Hacked to mine Cryptocurrency

Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the cryptocurrency ....

Thousands of Jenkins Servers Hacked to mine Monero

2/18/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s1600/JenkinsMinerMalware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Hacked-to-Mine-Monero" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s640/JenkinsMinerMalware.png" title="Jenkins-Hacked-to-Mine-Monero" width="640" /></a></div>
A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency.<br />
<br />
Hackers are targeting <a href="http://www.hackerschronicle.com/search/label/Jenkins" target="_blank">Jenkins</a>, a continuous integration/deployment web application built in Java that allows dev teams to run automated tests and execute various operations based on test results, including deploying new code to production servers. Because of this, Jenkins servers are extremely popular with both freelance web developers, but also with large enterprises.<br />
<br />
A cyber security research firm announced it uncovered the footprint of a large hacking operation targeting Jenkins servers left connected to the Internet.<br />
<br />
<b>Hackers using Jenkins RCE flaw</b><br />
Attackers were leveraging <a href="https://jenkins.io/security/advisory/2017-04-26/" target="_blank">CVE-2017-1000353</a>, a vulnerability in the Jenkins Java deserialization implementation that allows attackers to run malicious code remotely without needing to authenticate first. Hackers used this vulnerability to make Jenkins servers download and install a <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>miner (minerxmr.exe).<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s1600/Jenkins-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Servers-Hacked" border="0" data-original-height="438" data-original-width="894" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s640/Jenkins-Servers-Hacked.png" title="Jenkins-Servers-Hacked" width="640" /></a></div>
The miner was being downloaded from an IP address located in <a href="http://www.hackerschronicle.com/search/label/Chinese%20Hackers" target="_blank">China </a>and assigned to the Huaian government network. It is unclear if this is the attacker's server, or a compromised server used to host the miner on behalf of the hackers.<br />
<br />
The attackers have been active for months. This has allowed them to mine and already <b>cash out over 10,800 Monero, which is over $3.4 million</b>, at the time of writing.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s1600/Monero-Mining-Malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Monero-Mining-Malware" border="0" data-original-height="475" data-original-width="1175" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s640/Monero-Mining-Malware.png" title="Monero-Mining-Malware" width="640" /></a></div>
Researchers say the group appears to have compromised mostly Jenkins instances running on Windows operating systems.<br />
<br />
<b>Over 25,000 Jenkins servers left exposed online</b><br />
Attackers aren't the only ones who've noticed the large number of Jenkins servers available online. In mid-January, security researcher Mikail Tunç published <a href="https://emtunc.org/blog/01/2018/research-misconfigured-jenkins-servers/" target="_blank">research</a> highlighting that there were over 25,000 Jenkins servers left exposed to Internet connections at the time of his research.<br />
<br />
Also on Friday, Researchers released new research on other hackers leveraging the <b>CVE-2017-10271</b> flaw to infect Oracle WebLogic servers with malware. This vulnerability has been under active exploitation <b>since early December 2017</b>, and one group has already made <b>more than $226,000</b>.<br />
<br />
Besides Jenkins and <b>Oracle WebLogic</b> servers, hackers are also targeting <b>Ruby on Rails, PHP, and IIS </b>servers, also deploying Monero-mining malware.<br />
<br />
Monero-mining malware is already this year's biggest <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware trend/problem</a>, with numerous malware distribution campaigns spreading such payloads on any unsecured computer/server crooks can get their hands on.</div>

Cryptocurrency Hacking News Jenkins Malwares Miner Monero News Thousands of Jenkins Servers Hacked to mine Monero

A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency. H...

Millions of android devices Hacked

2/15/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY6e9DfRhBXaB1PX0ZsVaCJn8DW8B-yU7mVYfgw8Tv9t9h0VSn6V5VGc_GzTBD3yEi-Ofhg-8lEj_RnthL73FSM7KnDBpNlpP7yKnmK5-6VxFkOcBn13vLXDEd-c9O6YnpRtUJVzoEM8C8/s1600/Millions-Of-Android-Users-Hacked-By-This-Cryptomining-Attack.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Millions of android devices Hacked" border="0" data-original-height="420" data-original-width="800" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY6e9DfRhBXaB1PX0ZsVaCJn8DW8B-yU7mVYfgw8Tv9t9h0VSn6V5VGc_GzTBD3yEi-Ofhg-8lEj_RnthL73FSM7KnDBpNlpP7yKnmK5-6VxFkOcBn13vLXDEd-c9O6YnpRtUJVzoEM8C8/s640/Millions-Of-Android-Users-Hacked-By-This-Cryptomining-Attack.png" title="Millions of android devices Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Millions of android devices Hacked</td></tr>
</tbody></table>
<br />
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
The Android operating system and its apps are usually more exposed to security problems and the presence of malware of all kinds. With the arrival of the cryptocurrencies, this was the new focus to explore the users.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
A new campaign was recently detected and was obliging the mining of these crypto-coins.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
This new campaign is equal to many others that have been known in the past and have affected Android smartphones.<b> By routing users to dedicated sites, they are making a profit for attackers, </b>either through the display of advertising or, as in this case, by offering a processor to mine crypto-coins.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
In this case, Android users were even alerted to a supposed high processing problem and should put a captcha code in order for the situation to be resolved.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
While this process was going on, in incognito, they were mining virtual currency for the attackers. It was only a few minutes, but it surrendered to those who set up this scheme.<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrX4VrCL_lj9LcuMw3XsAWRJS_WnQPskBKOD3euTVO5kR3GLw9iWe_A50_WL4q0aYw0BrqqpQWMYkhdz8MSD1UFFbFhAKMwUa5iHcv967DmHhN39cOAraM8IMQSzqHz_i6wG_qJNSdof4/s1600/IMG-6.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Millions of android devices Hacked" border="0" data-original-height="664" data-original-width="800" height="530" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrX4VrCL_lj9LcuMw3XsAWRJS_WnQPskBKOD3euTVO5kR3GLw9iWe_A50_WL4q0aYw0BrqqpQWMYkhdz8MSD1UFFbFhAKMwUa5iHcv967DmHhN39cOAraM8IMQSzqHz_i6wG_qJNSdof4/s640/IMG-6.jpg" title="Millions of android devices Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Millions of android devices Hacked</td></tr>
</tbody></table>
<br />
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
This form of attack was included and disguised in several apps, which directed users to these sites dedicated to mining, discreetly and without them realizing that they were being used.</div>
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
The number of victims is not known but is high. We have identified at least 5 domains using the same captcha and the same keys as the Coinhive site. <b>At least 2 of these sites had more than 30 million hits per month and the 5 combined domains had about 800,000 visits per day,</b> with an average of 4 minutes per visit.</div>
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
As with the browser version of this type of attack, the sum of many users makes it profitable for attackers. It is only a few minutes that, accumulated, can revert significantly to who is managing the attack.<br />
<br /></div>
</div>
</div>

Android Cryptocurrency Hacking News Malwares News Millions of android devices Hacked

Millions of android devices Hacked The Android operating system and its apps are usually more exposed to security problems and the pr...