How did Coronavirus starts and what animals came into Coronavirus

4/22/2020 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjspGg4qBIqGvDcXgHUvNLHGdLmoeasBGrw2l8cf4ZpKbkqOcjPp9oKNHa0goNhQJ0BQL6cBvSV8YOZ0O1KbiPgf3U4ha60WreRXAXMSsuEhO1dQ_baft9hoX3BFN_zvyG3X78TwIiSirH1/s1600/How+did+Coronavirus+starts+and+what+animals+came+into+Coronavirus.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="How did Coronavirus starts and what animals came into Coronavirus" border="0" data-original-height="540" data-original-width="650" height="331" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjspGg4qBIqGvDcXgHUvNLHGdLmoeasBGrw2l8cf4ZpKbkqOcjPp9oKNHa0goNhQJ0BQL6cBvSV8YOZ0O1KbiPgf3U4ha60WreRXAXMSsuEhO1dQ_baft9hoX3BFN_zvyG3X78TwIiSirH1/s400/How+did+Coronavirus+starts+and+what+animals+came+into+Coronavirus.jpg" title="How did Coronavirus starts and what animals came into Coronavirus" width="400" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">How did Coronavirus starts and what animals came into Coronavirus</td></tr>
</tbody></table>
<br />
<div style="text-align: justify;">
To find out how the deadly corona virus reached humans from animals efforts are going on.In a region of China, <b>a bats, while hovering in the sky, released the residue of the coronavirus through its droppings which fell on the ground in the forest</b>. A wild animal, possibly a pangolin, smelled it and through it it spread to the rest of the animals.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
The infected animal came in contact with the person and a person got that disease. After this, it started spreading among the workers of the wild life market and this led to the global transition.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Scientists are trying to prove the story that the corona virus spread from animals. Professor Andrew Cunningham of the Zoological Society of London says that a string of events are being added. He says that this discovery seems like a 'detective story'.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
According to Cunningham, many wild animals may be sources of the corona virus, but <b>bats are in particular a large number of different types of corona virus</b>.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
But how much do we know about its infection or spread? When scientists will be able to understand the new virus in the patient's body, then the situation will be clear about the Chinese bats.</div>
<div style="text-align: justify;">
<br /></div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUx0eNyuycfJzpAMC-q1kQZDUNNiA-qxMNRWkIDRLZNq24YW0-jLajyCoMrKdJNSAg690tg9fgwaZLzuW62j5XkuAJ2PGTP6Ft5JI1B4vq7hVIpbv8SmPVEi9Biu3IH1uIQsRiV8YZV1Ku/s1600/How+did+Coronavirus+starts+and+what+animals+came+into+Coronavirus.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="How did Coronavirus starts and what animals came into Coronavirus" border="0" data-original-height="280" data-original-width="462" height="385" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUx0eNyuycfJzpAMC-q1kQZDUNNiA-qxMNRWkIDRLZNq24YW0-jLajyCoMrKdJNSAg690tg9fgwaZLzuW62j5XkuAJ2PGTP6Ft5JI1B4vq7hVIpbv8SmPVEi9Biu3IH1uIQsRiV8YZV1Ku/s640/How+did+Coronavirus+starts+and+what+animals+came+into+Coronavirus.jpg" title="How did Coronavirus starts and what animals came into Coronavirus" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">How did Coronavirus starts and what animals came into Coronavirus</td></tr>
</tbody></table>
<br />
<div style="text-align: justify;">
Professor Jonathan Ball of the University of Nottingham says that these are mammals, so it is feared that they can either infect humans directly or through someone else. ''</div>
<div style="text-align: justify;">
<b>Mammal animals are found in every continent. They seldom fall ill by themselves, but they spread germs very fast</b>. According to Professor Kate Jonas of University College London (UCL), there is evidence that bats have changed themselves in many cases. He says, "If bats fall ill, they hit a large number of viruses. There is no doubt that like bats live, viruses thrive in them.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>The second puzzle</b> is about the <b>identity of a mysterious animal from whose body the infection of the corona virus spread</b> in Wuhan, China. One of them is a suspected pangolin. Pangolin is said to be the most commonly smuggled around the world. It is on the verge of extinction.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
It is in high demand in Asia. It is used in the manufacture of traditional Chinese medicines. <b>Many people also eat its meat with great fervor. The corona virus has been found in pangolins.</b> Some people are claiming that it resembles the novel human virus. <b>Were genetics exchanged between bats and pangolin viruses before infection spread to humans?</b></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Experts are taking precaution to reach any conclusion in this matter. The complete data of the study on pangolin has not been released yet. In such a situation it is difficult to confirm.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Professor Kaningam says that the background and research related to the pangolin is very important. For example, from where the animals were taken or whether one animal was taken from somewhere or from the meat market.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Pangolins and other wildlife including many species of bats are all sold in the meat market. Professor Kaningam says <b>that here viruses get a chance to go from one organism to another. He says, "The market of meat is the best place to spread germs from one organism to another. Here humans are also infected.</b></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
As far as we know, bats and pangolins are not listed here, but China will have information about which animal meat was sold here. Professor Ball says, <b>"Once the infection has spread, you want to know whether it will happen again because it is very important for health." In such a situation, we have to know which species of which animal caused the infection. '</b>'</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
<b>In recent years, we have come in contact with many types of viruses. Ebola, HIV, SARS and now corona virus.</b> Professor Jonas says that the increase of infectious diseases from wild life may also show human greed. According to Professor Jonas, man is encroaching in their lives. He says, "The whole landscape is changing.<b>"</b> <b>The way human populations have come into contact with new viruses in recent years has never happened in the past.</b></div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
Professor Kanningam says, "If we understand the reason for the risks, then we can control things right in the beginning." Advocates to protect the environment and forests believe that even though bats are the source of viruses, they are the ecosystem. Are also necessary for He says, <b>"Insectivorous bats eat large numbers of insects. How do these mosquitoes and the insect-moths which cause damage to crops, corona virus and animals from which eat in humans. </b>At the same time, fruit bats work by spraying pollen on trees and spreading its seeds. Obviously, to control the disease, they do not need to be killed.</div>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5QJEZ4K2kcYTSKGu_z9O82kvh4nQgECvaB-7zQTYBNyCkclff2IqqPL0Q9OJxr5D03PKcm4mf_v9L1teM5dZN75wOulHor4jj9Q8B8n2qyIMHZOuGzREN1oL1VQ6YRnxpsNGtbr-bhAkB/s1600/How+did+Coronavirus+starts+and+what+animals+came+into+Coronavirus.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="How did Coronavirus starts and what animals came into Coronavirus" border="0" data-original-height="183" data-original-width="275" height="425" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5QJEZ4K2kcYTSKGu_z9O82kvh4nQgECvaB-7zQTYBNyCkclff2IqqPL0Q9OJxr5D03PKcm4mf_v9L1teM5dZN75wOulHor4jj9Q8B8n2qyIMHZOuGzREN1oL1VQ6YRnxpsNGtbr-bhAkB/s640/How+did+Coronavirus+starts+and+what+animals+came+into+Coronavirus.jpg" title="How did Coronavirus starts and what animals came into Coronavirus" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">How did Coronavirus starts and what animals came into Coronavirus</td></tr>
</tbody></table>
<br />
<div style="text-align: justify;">
After SARS in 2002–3, it was similar to the present-day corona virus. <b>During the time of SARS, the wildlife market was temporarily banned.</b> But soon the ban on wild animal market in China, Vietnam and other parts of South-East Asia was over. China has once again banned the trade of products made from wildlife. These products are mainly used in food, fur and traditional medicines. According to media reports, this ban may be forever.</div>
<div style="text-align: justify;">
<br /></div>
<div style="text-align: justify;">
As we know the responsible for the spread of disease and thousands of deaths. Professor Diana Bell of the University of East Anglia says, <b>" If we become cautious we can avoid the next dangerous virus. We are bringing animals from different countries, different climates and different lifestyles. We are mixing the living organisms in the water and the living organisms on the trees. We need to stop all this."</b></div>
<h1 style="background-color: white; box-sizing: border-box; color: #555555; font-family: "roboto condensed", sans-serif; font-size: 40px; font-weight: 300; line-height: 1.3; margin: 0px; text-align: center;">
<br /></h1>
<h1 style="background-color: white; box-sizing: border-box; color: #555555; font-family: "roboto condensed", sans-serif; font-size: 40px; font-weight: 300; line-height: 1.3; margin: 0px; text-align: center;">
Coronavirus Cases till now :</h1>
<div class="maincounter-number" style="background-color: white; box-sizing: border-box; color: dimgrey; font-family: "noto sans", sans-serif; font-size: 54px; font-weight: 700; text-align: center;">
<span style="box-sizing: border-box; color: #aaaaaa;">2,558,975</span></div>
<div class="maincounter-number" style="background-color: white; box-sizing: border-box; color: dimgrey; font-family: "noto sans", sans-serif; font-size: 54px; font-weight: 700; text-align: center;">
<span style="box-sizing: border-box; color: #aaaaaa;"><br /></span></div>
<div class="maincounter-number" style="background-color: white; box-sizing: border-box; color: dimgrey; font-family: "noto sans", sans-serif; font-size: 54px; font-weight: 700; text-align: center;">
<span style="color: #363945; font-size: 14px; font-weight: 400; text-align: left;"><br /></span></div>
<div class="maincounter-number" style="background-color: white; box-sizing: border-box; color: dimgrey; font-family: "noto sans", sans-serif; font-size: 54px; font-weight: 700; text-align: justify;">
<span style="color: #363945; font-size: 14px; font-weight: 400; text-align: left;">The </span><span style="box-sizing: border-box; color: #363945; font-size: 14px; text-align: left;">coronavirus</span><span style="color: #363945; font-size: 14px; font-weight: 400; text-align: left;"><b> COVID-19 is affecting </b></span><span style="box-sizing: border-box; color: #363945; font-size: 14px; text-align: left;">210 countries and territories</span><span style="color: #363945; font-size: 14px; font-weight: 400; text-align: left;"> around the world and 2 </span><span style="color: #363945; font-size: 14px; font-weight: 400;">international conveyances. It is affecting worldwide.</span></div>
<div class="maincounter-number" style="background-color: white; box-sizing: border-box; color: dimgrey; font-family: "noto sans", sans-serif; font-size: 54px; font-weight: 700; text-align: justify;">
<span style="color: #363945; font-size: 14px; font-weight: 400;"><br /></span></div>
<div class="maincounter-number" style="background-color: white; box-sizing: border-box; color: dimgrey; font-family: "noto sans", sans-serif; font-size: 54px; text-align: center;">
<span style="box-sizing: border-box; color: #aaaaaa;"><div style="color: black; font-family: "Times New Roman"; font-size: medium; text-align: justify;">
<span style="font-family: Arial; font-size: 12px;"><b>"COVID-19 has done irreparable damage to countries across the globe, causing sickness, death, economic disruption, and human suffering. </b>In Missouri, the impact of the virus is very real - thousands have been <b>infected and many have died, families have been separated from dying loved ones, small businesses are shuttering their doors, and those living paycheck to paycheck are struggling to put food on their table,</b>" said Schmitt. </span></div>
<div style="color: black; font-family: "Times New Roman"; font-size: medium; font-weight: 400; text-align: justify;">
<span style="font-family: Arial; font-size: 12px;"><br /></span></div>
<div style="color: black; font-family: "Times New Roman"; font-size: medium; font-weight: 400; text-align: justify;">
<span style="font-family: Arial; font-size: 12px;">"The Chinese government lied to the world about the danger  </span><span style="font-family: Arial; font-size: 12px;">and contagious nature of COVID-19, silenced whistleblowers, and did little to stop the spread of the disease. They must be held accountable for their actions," he alleged.</span></div>
</span></div>
</div>

Coronavirus COVID-19 News How did Coronavirus starts and what animals came into Coronavirus

How did Coronavirus starts and what animals came into Coronavirus To find out how the deadly corona virus reached humans from animals...

Facebook is Going To Start Dating Service: Secret Crush

5/01/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxieeq-PUmCvnI2BZnrheLsbFW6_5laXOlKSNWLB6VyfwP612CHdTGr1Ib8pi3A7O3XnTIA8WX9dTlTKRDube2O8XKtS8Jf17tITZxf6-fq9mR2bhC7fwemLdA26RDNturzrGtqxuMdBj7/s1600/Facebook-Secret-Crush.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Facebook Secret Crush" border="0" data-original-height="417" data-original-width="796" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxieeq-PUmCvnI2BZnrheLsbFW6_5laXOlKSNWLB6VyfwP612CHdTGr1Ib8pi3A7O3XnTIA8WX9dTlTKRDube2O8XKtS8Jf17tITZxf6-fq9mR2bhC7fwemLdA26RDNturzrGtqxuMdBj7/s640/Facebook-Secret-Crush.jpg" title="Facebook Secret Crush" width="640" /></a></div>
Facebook announced at its F8 conference today a new feature to its Dating repertoire, this one apparently designed to help single minglers poach potential paramours from their Friends by adding them to an ostensibly private list of people you’re crushing on.<br />
<br />
Here’s how this is supposed to go down: You add up to <a href="https://newsroom.fb.com/news/2019/04/f8-2019-day-1/">nine people</a> to a “Secret Crush” list. After you do, those nine people will receive an alert telling them someone has a crush on them. They can add their own secret crushes, and if they add you, you both get a notification and can chat about it on Messenger.<br />
<br />
Ordinarily, Facebook basic and Facebook Dating exist in two separate realms — your profile for one is not the same as your profile for another. The Secret Crush feature is the first crossover between the two (pray it’s the only one). On paper, it sounds like it might be a nice gesture, leaving an opening for shy or introverted people to express their interest in someone with no embarrassment or repercussions if the interest isn’t reciprocated.<br />
<br />
Supposedly, no one will know who your crushes are unless the two of your connect, but you just know there’s a way around that. I wouldn’t put it past some users to add and remove all of their Friends to their own Secret Crush list just to see if any of them match up — not because they feel the same way, but just for bragging rights. But that’s not what really concerns me.<br />
<br />
If you’re anything like me and have played audience to Facebook’s massive, trust-annihilating data leaks and generally cavalier attitude towards consumer data, then your gut clenched in a pre-emptive cringe at the privacy conundrum this is sure to cause. After a year of data privacy scandals, <a href="https://www.hackerschronicle.com/search/label/cambridge%20analytica">Cambridge Analytica</a> chief among them, I don’t think I’d trust Facebook with my dating interests in general, let alone a super secret list of the acquaintances I secretly long to be closer to.</div>

Dating facebook News SecretCrush Facebook is Going To Start Dating Service: Secret Crush

Facebook announced at its F8 conference today a new feature to its Dating repertoire, this one apparently designed to help single mingle...

Microsoft Outlook Breach Targeting Cryptocurrency Users

4/30/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHkvDoGBQpjT4W3SvbIPYYq3OcyhA4R4zK1748reunJHUTabTQPZrNb3Q1AnY8mD5qAX4HIbDwkHuqtXWX1cgbPJlfoVL7Tym4y3HotYKXBllGvEWyQTZRx4w1ztbekvKG5Wkl_vikSIe5/s1600/bitcoin_outlook_breach.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="963" data-original-width="1448" height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHkvDoGBQpjT4W3SvbIPYYq3OcyhA4R4zK1748reunJHUTabTQPZrNb3Q1AnY8mD5qAX4HIbDwkHuqtXWX1cgbPJlfoVL7Tym4y3HotYKXBllGvEWyQTZRx4w1ztbekvKG5Wkl_vikSIe5/s640/bitcoin_outlook_breach.jpeg" width="640" /></a></div>
<br />
Earlier this month, news broke out that hackers were not only able to access Outlook users’ email metadata as previously reported, but also email content. The breach centered around a hacker getting hold of a Microsoft customer support worker’s login credentials; from there, the hacker could dive into the content of any non-corporate Outlook, Hotmail, or MSN account, Motherboard found.<br /><br />Now, multiple victims have come forward to flag what they believe may be one of the motivating reasons behind the breach: emptying peoples’ cryptocurrency accounts.<br /><br />“The hackers also had access to my inbox allowing them to password reset my Kraken.com account and withdrawal [sic] my Bitcoin,” Jevon Ritmeester, a Microsoft user that the company alerted to the data breach, told in an email, referring to popular cryptocurrency exchange Kraken.<br /><br />For verification purposes, Ritmeester provided Motherboard with the breach notification emails he received from Microsoft, as well as a screenshot showing what he said was an email forwarding rule the hackers set up: anytime an email mentioned the term “Kraken,” his account would automatically forward it to a Gmail address presumably controlled by the hackers.<br /><br />
<blockquote class="tr_bq">
Do you know anything else about this breach? You can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com</blockquote>
<br />That would include emails such as password reset and Bitcoin withdrawal requests. Indeed, Ritmeester only found someone had requested both of those after checking the trash of his email account, he wrote in a recent post on the tech forum Tweakers. In the post, he added that he lost just over 1 bitcoin, or around $5,000 at the current exchange rate.<br /><br />It appears Ritmeester isn’t the only person who hackers stole cryptocurrency from due to the Microsoft breach.<br /><br />“My account was hacked as a direct result of this,” Reddit user shinratechlabs wrote earlier this month, adding that they lost “25,000 in crypto,” although it’s not clear what currency they may be referring to, fiat or otherwise.<br /><br />“Same exact for me only a lot less funds stolen, sucks,” another Reddit user, mickey_ficke, chimed in. Neither Reddit user responded to a request for comment.<br /><br />
<blockquote class="tr_bq">
“I feel Microsoft is trying to cover up and is not taking this seriously.”</blockquote>
<br />In his post on Tweakers, Ritmeester said he didn’t have two-factor authentication enabled on Kraken, which may have kept the hackers out of this cryptocurrency account. If he had it enabled, the hackers may have had to take control of this phone number as well in order to intercept the two-factor authentication tokens, for instance.<br /><br />A Microsoft spokesperson told on Monday that, “Customers who believe they have been impacted beyond what was outlined in the company’s notification should contact the Microsoft support team for assistance.”<br /><br />Originally, when TechCrunch and other outlets reported the Outlook data breach, Microsoft said it only impacted email metadata and customer information, such as subject lines and the names of other email addresses users communicated with. After Motherboard presented Microsoft with evidence that email content had also been impacted, Microsoft revised its statement, despite already being fully aware that content was exposed; the company had issued breach notification emails to victims saying as much. <a href="https://motherboard.vice.com/en_us/article/xwndwn/microsoft-outlook-msn-hotmail-breach-cryptocurrency-bitcoin"><span style="font-size: xx-small;">Source</span></a></div>

Bitcoin Cryptocurrency databreach News Microsoft Outlook Breach Targeting Cryptocurrency Users

Earlier this month, news broke out that hackers were not only able to access Outlook users’ email metadata as previously reported, but a...

Bodybuilding.com confirms Data Breach

4/24/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjav4fT_vy7AeU-yBoFGrd1P0avUFMV_V3pVWbMrJnnzVZTdh9WNajlxHgh7WH3clxT3ByH0VgxReB0_Cod9GEQWwfNLirHPGCoUEYnFJ0nEtY2-tDMBaa4TzgiV8_i9EjE8FaEjB2RlnSm/s1600/bodybuilding-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bodybuilding.com hacked" border="0" data-original-height="425" data-original-width="1000" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjav4fT_vy7AeU-yBoFGrd1P0avUFMV_V3pVWbMrJnnzVZTdh9WNajlxHgh7WH3clxT3ByH0VgxReB0_Cod9GEQWwfNLirHPGCoUEYnFJ0nEtY2-tDMBaa4TzgiV8_i9EjE8FaEjB2RlnSm/s640/bodybuilding-hacked.jpg" title="Bodybuilding.com hacked" width="640" /></a></div>
<br />
Bodybuilding.com, the internet's biggest online store and online forum for fitness and bodybuilding enthusiasts, has disclosed last week a security breach that impacted its IT systems.<br />
<br />
Customer data might have been exposed, the company said in a <a href="https://www.bodybuilding.com/help?notifications&data-incident">short message</a> posted on its website. Its staff isn't sure if the attacker accessed customer data, though.<br />
<br />
A third-party security firm was hired to help with the investigation, but forensics experts couldn't confirm that customer data was stolen from Bodybuilding.com's servers, either.<br />
<br />
Bodybuilding.com said investigators traced the unauthorized activity to a phishing email its staff received in July 2018. At least one employee appears to have fallen for this email.<br />
<br />
Hackers used the data they obtained from this phishing email to access the company's network in February 2019. Bodybuilding.com didn't say when it detected the intrusion, but it said it finished its investigation on April 12. It went public with the security breach a week later, on April 19.<br />
<br />
<blockquote class="tr_bq">
We became aware of a data security incident involving unauthorized access to our systems in February 2019. We engaged one of the leading data security firms to conduct a thorough investigation, which traced the unauthorized activity to a phishing email received in July 2018. On April 12, 2019, we concluded our investigation and could not rule out that personal information may have been accessed.</blockquote>
<br />
Despite not knowing if hackers accessed customer data, Bodybuilding.com decided to do the right thing and notify all of its customers of the security incident, as a precaution.<br />
<br />
It also reset all users' passwords as well, to prevent any abuse in case attackers did manage to steal any data.<br />
<br />
According to the company, if hackers did manage to access and steal customer data, possibly exposed details will include name, email address, billing/shipping addresses, phone number, order history, any communications with Bodybuilding.com, birthdate, and any information included in BodySpace profiles.<br />
<br />
Social Security numbers and payment card details were not exposed, the company said, as the site never collected this information in the first place.<br />
<br />
Besides notifying users of the breach, Bodybuilding.com is also alerting users that scammers might also try to imitate its data breach disclosure notifications for online fraud or phishing attacks.<br />
<br />
<blockquote class="tr_bq">
Please note that the email from Bodybuilding.com does not ask you to click on any links or contain attachments and does not request your personal data. If the email you received about this issue prompts you to click on a link, suggests you download an attachment, or asks you for information, the email was not sent by Bodybuilding.com and may be an attempt to steal your personal data. Avoid clicking on links or downloading attachments from such suspicious emails. Any link included in our email to users directs users to insert the Bodybuilding.com FAQs URL into your browser and does not request your personal data.</blockquote>
<a href="https://www.zdnet.com/google-amp/article/bodybuilding-com-discloses-security-breach/"><span style="font-size: xx-small;">Source</span></a></div>

bodybuilding.com databreach Hacking News News Phishing Security Bodybuilding.com confirms Data Breach

Bodybuilding.com, the internet's biggest online store and online forum for fitness and bodybuilding enthusiasts, has disclosed last ...

Saposhi a new malware to take down all IoT devices is out

3/09/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ8p7qWG1DwmBPgKLhzzWdUqUSRexWf70vpudaCzjinTSUdHMKaE0_AZwb1d8bUoIhdL-tpGAdYEPROknhA8DhDrAq9wy5caeaAv26qLpkHmmO5kzkSKNxBtR4vv5R83lUiTNqHsbbyYy9/s1600/Saposhi-DDoS-Malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Saposhi a new malware to take down all IoT devices is out" border="0" data-original-height="750" data-original-width="1000" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ8p7qWG1DwmBPgKLhzzWdUqUSRexWf70vpudaCzjinTSUdHMKaE0_AZwb1d8bUoIhdL-tpGAdYEPROknhA8DhDrAq9wy5caeaAv26qLpkHmmO5kzkSKNxBtR4vv5R83lUiTNqHsbbyYy9/s640/Saposhi-DDoS-Malware.jpg" title="Saposhi a new malware to take down all IoT devices is out" width="640" /></a></div>
<br />
Cybersecurity agencies detected a new malware <b>Saposhi</b> , which can cripple the entire industries by taking over electronic devices and turning them into 'bots', which can be used for <a href="http://www.hackerschronicle.com/search/label/DDoS">Distributed Denial of Service</a> (DDoS) attacks .<br />
<br />
The <b>new malware Saposhi was detected around 15 days ago</b> according to a report of the Hindu, and is currently being watched and studied.<br />
<br />
<b>“Saposhi is similar in its intensity to Reaper, which was taking over millions of devices at the rate of 10,000 devices per day.</b> Various cybersecurity agencies are currently keeping tabs on it to get a better idea of what it is capable of,” he said.<br />
<br />
A Central Government organisation <b>'the Computer Emergency Response Team (CERT)', had issued an alert about malwares </b>Mirai, and Reaper, but has not yet issued any alert regarding the new malware.<br />
<br />
<b>“We need to first ensure that the information we have is indeed substantiated before raising alarm bells.</b> Right now, what we know for sure is that Saposhi exists, and is highly capable. Factors like whether it is aimed at any particular kind of device, or has a specific purpose are still being verified,” a officer said.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Malwares">Malwares </a>which are primarily aimed at DDoS attacks first creates a 'botnet,'network of bots, these botnet are used to ping a server at the same time. If the<b> number of pings increases beyond the server’s capacity, the server crashes and denies service.</b> Saposhi, Reaper and Mirai are DDoS attack malwares.<br />
<br />
In July 2016, small and medium internet service providers in Maharashtra fell prey to a DDoS attack, which caused disruption in the services of several Internet Service Providers (ISP) in the State.<br />
<br />
In 2016, Mirai, using a botnet of 5 lakh devices, had caused the servers of Dyn, a leading domain name service provider, to crash, affecting services of popular websites like Twitter, Netflix and Reddit.<br />
<br /></div>

Botnet CyberSecurity DDoS Malwares Mirai News Reaper Saposhi Saposhi a new malware to take down all IoT devices is out

Cybersecurity agencies detected a new malware Saposhi , which can cripple the entire industries by taking over electronic devices and t...

DDoS Exploit code to shutdown all vulnerable Memcached Servers Released online

3/08/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY_2biyz6S2H06vEQZNYt30moJnaKa9N1pO73gCZfgMo8cGLLI66wvY61YLyK_XtqjucFRcLrrwNEmDa3pBhJpig0791kXy2_uaPo5hU5-D2hMUlZIG2zQfPmrgfr-3safsS6y51p6X4xI/s1600/Memfixed-Mitigation-Tool.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="MEMFIXED DDOS MITIGATION TOOL" border="0" data-original-height="455" data-original-width="822" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY_2biyz6S2H06vEQZNYt30moJnaKa9N1pO73gCZfgMo8cGLLI66wvY61YLyK_XtqjucFRcLrrwNEmDa3pBhJpig0791kXy2_uaPo5hU5-D2hMUlZIG2zQfPmrgfr-3safsS6y51p6X4xI/s640/Memfixed-Mitigation-Tool.png" title="memfixed-ddos-mitigation-tool" width="640" /></a></div>
<br />
For the last few days, Vulnerable Memcached Servers were targeted by hackers to conducted DDoS attacks including the <a href="http://www.hackerschronicle.com/2018/03/github-hit-with-biggest-ddos-attack.html" target="_blank">world’s largest ever 1.7 Tbps of DDoS attack on Github</a> website.<br />
<br />
After the massive attacks on memcache servers worldwide <b>three PoC codes were published online to exploit the thousands of Memcache servers still vulnerable</b>. Along with PoC code a <b>list of 17,000 vulnerable servers were also published</b>. The PoC codes could allow even script-kiddies to launch massive <a href="http://www.hackerschronicle.com/search/label/DDoS" target="_blank">DDoS </a>attacks using UDP reflections easily.<br />
<br />
But now the researchers at <a href="https://twitter.com/SpuzNiq">SPUZ.me</a> have released a new tool to shutdown all vulnearble sers at one go. The tool is named as <a href="http://www.hackerschronicle.com/search/label/Memfixed" target="_blank"><b>Memfixed</b></a>. According to the publisher: Memfixed is DDoS mitigation tool for sending flush or shutdown commands to vulnerable <a href="http://www.hackerschronicle.com/search/label/Memcache" target="_blank">Memcached </a>servers obtained using Shodan API.<br />
<br />
This tool is written in python and this allows you to shutdown/flush vulnerable Memcached servers obtained from <b>Shodan </b>search engine and utilising the killswitch published by a security researcher dormando. He has discovered a “kill switch” to counteract the Memcached vulnerability that recently fueled some of the largest distributed denial-of-service (DDoS) attacks in history. The tool also has the capability of shutting down or flushing specific vulnerable memcached servers for companies/services being attacked (assuming the user knows its IP address).<br />
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1K4iyFU004iDBDOTT5G39GzNB3E6VyxpcWew_pRnlbq6zzYuTjkPAd_9oDOpjdOTM4RBJ2R4KvVWTtl-wN-KHX3HnJDmCB7_KOy8EXBMKSgtusro5x01MdFQjlOAqRQI_hHJS64ZG7-Ls/s1600/Memcrashed-DDoS-Exploit.PNG" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Memcached DDoS Exploit Code" border="0" data-original-height="588" data-original-width="592" height="634" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1K4iyFU004iDBDOTT5G39GzNB3E6VyxpcWew_pRnlbq6zzYuTjkPAd_9oDOpjdOTM4RBJ2R4KvVWTtl-wN-KHX3HnJDmCB7_KOy8EXBMKSgtusro5x01MdFQjlOAqRQI_hHJS64ZG7-Ls/s640/Memcrashed-DDoS-Exploit.PNG" title="memcached-ddos-exploit-code" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Poc code to exploit vulnerable Memcache servers</td></tr>
</tbody></table>
<br />
Memcached is a popular open source distributed memory caching system, which came into news earlier last week when researchers detailed how hackers could abuse it to launch amplification/reflection DDoS attack by sending a forged request to the targeted Memcached server on port 11211 using a spoofed IP address that matches the victim's IP.<br />
<br />
For those unaware, Memcached-based amplification/reflection attack amplifies bandwidth of the DDoS attacks by a factor of 51,000 by exploiting thousands of misconfigured Memcached servers left exposed on the Internet.</div>

DDoS Exploit Memcache Memfixed News DDoS Exploit code to shutdown all vulnerable Memcached Servers Released online

For the last few days, Vulnerable Memcached Servers were targeted by hackers to conducted DDoS attacks including the world’s largest eve...

Millions of email servers affected with Remote Code Execution

3/07/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhs3nrpYY0xcgrriLMt2O8YgpcAxx5VzOhM11lO3WVKA192oTRV8TYnnOQRrpAVvr_65JrSEFVQQSc1hjo4B0dPZSyLKKS0TFbho4HQJb_mckC_cRlrB1Ih-gSHfi07DVFxX40dShzoZHdJ/s1600/remote-code-vulnerability-in-exim.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Vulnerability Affects millions of the Email Servers" border="0" data-original-height="570" data-original-width="1344" height="268" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhs3nrpYY0xcgrriLMt2O8YgpcAxx5VzOhM11lO3WVKA192oTRV8TYnnOQRrpAVvr_65JrSEFVQQSc1hjo4B0dPZSyLKKS0TFbho4HQJb_mckC_cRlrB1Ih-gSHfi07DVFxX40dShzoZHdJ/s640/remote-code-vulnerability-in-exim.PNG" title="Vulnerability Affects millions of the Email Servers" width="640" /></a></div>
<br />
<br />
A critical vulnerability affects millions of email servers. A fix has been released but this flaw affects more than half of the Internet's <a href="http://www.hackerschronicle.com/search/label/Email">email servers</a>, and patching the issue will take a couple of days.<br />
<br />
The vulnerability in <a href="http://www.hackerschronicle.com/search/label/Exim">Exim, a mail transfer agent</a> (MTA) —software that runs on email servers and which relays emails from senders to recipients.According to a survey conducted in March 2018, 56% of all of the Internet's email servers run Exim, with over <b>63,36,687</b> available online at the time.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsc0CuLvNkFMrSfewAAPIZwjDjoWEPgkyD8p6oPc3XB6-9nNG-_sMsKxDDc646zSfVVxTQOQyJVzWRuoS5LRqJR-rirTSGEGlehkVCO2kmy5WBfeJcJwBqkJvl1ieLAFNaQdxGTJBmB_M/s1600/vulnerable-exim-servers.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Vulnerability Affects millions of the Email Servers" border="0" data-original-height="413" data-original-width="1328" height="198" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsc0CuLvNkFMrSfewAAPIZwjDjoWEPgkyD8p6oPc3XB6-9nNG-_sMsKxDDc646zSfVVxTQOQyJVzWRuoS5LRqJR-rirTSGEGlehkVCO2kmy5WBfeJcJwBqkJvl1ieLAFNaQdxGTJBmB_M/s640/vulnerable-exim-servers.PNG" title="Vulnerability Affects millions of the Email Servers" width="640" /></a></div>
<br />
A Taiwanese security researcher named Meh Chang discovered the bug, which he <a href="https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/">reported</a> to the Exim crew on February 2. The Exim team released Exim distribution 4.90.1 on February 10 that fixes the RCE issue.<br />
<br />
The bug —tracked as <b>CVE-2018-6789</b> is categorized as a "pre-auth <a href="http://www.hackerschronicle.com/search/label/Remote%20Code%20Execution">remote code execution</a>," meaning an attacker could trick the Exim email server into running malicious commands before the attacker would need to authenticate on the server.<br />
<br />
The actual bug is a <b>one-byte buffer overflow</b> in the base64 decode function of Exim and affects all Exim versions ever released. Chang described the bug in a blog post released earlier today, detailing basic steps for exploiting Exim's SMTP daemon.<br />
<br />
In a security advisory, the Exim team publicly acknowledged the issue. "Currently we're unsure about the severity, we believe, an exploit is difficult. A mitigation isn't known," the <a href="https://exim.org/static/doc/security/CVE-2018-6789.txt">Exim team said</a>.<br />
<br />
Since Exim 4.90.1's release, updated Exim versions have trickled down to Linux distros used primarily in data centers, but the question remains about the number of unpatched systems that remain online. Taking into account that Exim is by far the most popular mail agent, CVE-2018-6789 opens a large attack surface, and Exim server owners should look into deploying the Exim 4.90.1 update as soon as possible.<br />
<br />
At the time of writing, there is no public exploit code for taking advantage of vulnerable Exim servers, but this will likely change in the days following Chang's blog post.<br />
<br /></div>

CVE-2018-6789 Email Exim News Remote Code Execution Vulnerability Millions of email servers affected with Remote Code Execution

A critical vulnerability affects millions of email servers. A fix has been released but this flaw affects more than half of the Interne...

Chinese Firm selling Smartphones with pre-installed Banking Malwares

3/05/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWokGpvxoy8oZjI0OOsnHmsDJZF42nU3B2PxFze5HaOa9uatC4LEkVg6JPnXiv6LK5yg0JGyZjpvyd3JgOk3TNKrvx_vJDxS5UWTw4GiOwILGCCyX7he3Pua0OTE6aDE_PpfX0qkCaaIb0/s1600/triada-trojan-preinstalled-on-brand-new-smartphones.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Triada Trojan pre-installed brand new Smartphones" border="0" data-original-height="840" data-original-width="1280" height="420" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWokGpvxoy8oZjI0OOsnHmsDJZF42nU3B2PxFze5HaOa9uatC4LEkVg6JPnXiv6LK5yg0JGyZjpvyd3JgOk3TNKrvx_vJDxS5UWTw4GiOwILGCCyX7he3Pua0OTE6aDE_PpfX0qkCaaIb0/s640/triada-trojan-preinstalled-on-brand-new-smartphones.jpg" title="Triada Trojan pre-installed brand new Smartphones" width="640" /></a></div>
<br />
More than 40 models of low-cost Android smartphones are sold already infected with the Triada banking trojan, says Dr.Web, a Russia-based antivirus vendor. The security vendor published today a list of 42 Android models its researchers analyzed and found to be infected with the Android.Triada.231 trojan.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Triada" target="_blank">Triada </a>is a very powerful Android banking trojan discovered in early 2016. It can root devices and then infect Zygote, a core <a href="http://www.hackerschronicle.com/search/label/Android" target="_blank">Android operating system</a> process, where it's almost impossible to remove without wiping the entire device and reinstalling the OS. Dr.Web says <b>it found the trojan on newly shipped devices from</b> lesser-known brands —mostly based in <b>China</b>— such as Leagoo, Doogee. Vertex, Advan, Cherry Mobile, and others.<br />
<br />
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCB5gEGCxF-NDcRb8zROpOkYNcfqXWrJuWu5nGZ7-WKEfCP56LQWC_pGRKufzMaaE1kdwqnC7yqDCV_RXJoF38NysnwpRwrV6AX9zqdeI-2twH-AP21yv4X4I5g-g81ZbGbh-Dc1_dzjTM/s1600/how-triada-works.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="1600" data-original-width="1229" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCB5gEGCxF-NDcRb8zROpOkYNcfqXWrJuWu5nGZ7-WKEfCP56LQWC_pGRKufzMaaE1kdwqnC7yqDCV_RXJoF38NysnwpRwrV6AX9zqdeI-2twH-AP21yv4X4I5g-g81ZbGbh-Dc1_dzjTM/s400/how-triada-works.png" width="306" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">How Triada Works</td></tr>
</tbody></table>
<br />
<br />
"<b>The <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware </a>is present in the devices which are sold not only in Russia but globally</b>," a Dr.Web spokesperson told <b>Bleeping Computer</b> earlier today via email. "For instance, in Poland, Indonesia, China, the Checz Republic, Mexico, Kazakhstan and Serbia."<br />
<br />
Dr.Web's recent discovery isn't new, but it's a continuation of previous research. Back in July 2017, researchers found the same Triada trojan on four low-cost Android smartphone models —Leagoo M5 Plus, Leagoo M8, Nomu S10, and Nomu S20. Researchers continued to look into the matter and eventually discovered 42 smartphone models that were coming with malware pre-installed out of the box.<br />
<br />
Experts say that their discovery over the summer didn't deter whoever was behind this action to stop. For example, they found Triada pre-installed on Leagoo M9 phones, a model launched in December 2017.<br />
<br />
The antivirus vendor says it contacted all affected vendors, believing one of their shared resellers was injecting the trojan before shipping devices forward. Instead, researchers figured out that a <b>software developer from Shanghai was most likely the source of the Triada infection</b>.<br />
<br />
"This company provided Leagoo with one of its applications to be included into an image of the mobile operating system, as well as with an instruction to add third-party code into the system libraries before their compilation," researchers say. "Unfortunately, this controversial request did not evoke any suspicions from the manufacturer. Ultimately, Android.Triada.231 got to the smartphones without any obstacles."<br />
<br />
Researchers say this Triada-infected application developed by the Shanghai company was signed with the same certificate that was seen in another malware infection, in November 2016 —an Android app with over 1 million downloads on the Google Play Store that was infecting users with the Android.MulDrop adware.<br />
<br />
In the end, this is just another case when users suffer the consequences of companies that fail to validate their software supply chain.<br />
<br />
The list of Android smartphone models that Dr.Web found infected with the Triada trojan right out of the box is below:<br />
<div class="content shadow-radial">
Leagoo M5<br />
Leagoo M5 Plus<br />
Leagoo M5 Edge<br />
Leagoo M8<br />
Leagoo M8 Pro<br />
Leagoo Z5C<br />
Leagoo T1 Plus<br />
Leagoo Z3C<br />
Leagoo Z1C<br />
Leagoo M9<br />
ARK Benefit M8<br />
Zopo Speed 7 Plus<br />
UHANS A101<br />
Doogee X5 Max<br />
Doogee X5 Max Pro<br />
Doogee Shoot 1<br />
Doogee Shoot 2<br />
Tecno W2<br />
Homtom HT16<br />
Umi London<br />
Kiano Elegance 5.1<br />
iLife Fivo Lite<br />
Mito A39<br />
Vertex Impress InTouch 4G<br />
Vertex Impress Genius<br />
myPhone Hammer Energy<br />
Advan S5E NXT<br />
Advan S4Z<br />
Advan i5E<br />
STF AERIAL PLUS<br />
STF JOY PRO<br />
Tesla SP6.2<br />
Cubot Rainbow<br />
EXTREME 7<br />
Haier T51<br />
Cherry Mobile Flare S5<br />
Cherry Mobile Flare J2S<br />
Cherry Mobile Flare P1<br />
NOA H6<br />
Pelitt T1 PLUS<br />
Prestigio Grace M5 LTE<br />
BQ 5510</div>
</div>

Android Malwares News Triada Trojan Chinese Firm selling Smartphones with pre-installed Banking Malwares

More than 40 models of low-cost Android smartphones are sold already infected with the Triada banking trojan, says Dr.Web, a Russia-base...

4000 Government Websites Hacked in less than 4 Hours to Mine Cryptocurrency

3/03/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnJjqeIjcqU3MGFmsgNnL0NeymCNjU4wfbAPOJzO7r3dusjiHbjsAgXgK-3KytrKTYX_nru_Xf_Jd3jVU4bICc1ulejSq4tNjczTh46yG_aqNpuXbOMn6J4zp77oKxIdldi_BFDqmSTFwa/s1600/United-States-courts-portal-Hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Government Websites Hacked to mine Cryptocurrency" border="0" data-original-height="360" data-original-width="1000" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnJjqeIjcqU3MGFmsgNnL0NeymCNjU4wfbAPOJzO7r3dusjiHbjsAgXgK-3KytrKTYX_nru_Xf_Jd3jVU4bICc1ulejSq4tNjczTh46yG_aqNpuXbOMn6J4zp77oKxIdldi_BFDqmSTFwa/s640/United-States-courts-portal-Hacked.jpg" title="Government Websites Hacked to mine Cryptocurrency" width="640" /></a></div>
Over four thousand high profile government websites have been compromised by <a href="http://www.hackerschronicle.com/search/label/Dark%20Web" target="_blank">dark web</a> hackers across the globe, mining virtual currency secretly, and particularly Monero.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>has become one of the popular cryptocurrency recently especially on the ‘<a href="http://www.hackerschronicle.com/search/label/Dark%20Web" target="_blank">dark web</a>’– a section of the internet that can only be accessed using a special browser which is capable of anonymizing your browsing location as well as identity. Dark web criminals are taking advantage of this anonymity by trading illegal commodities, substances and services using virtual currencies.<br />
<br />
<b>4,275 websites including those in the U.K., the U.S., Ireland, Australian and Canada with government websites with hundreds of thousands of visitors were hacked in less than a period of four hours</b> and unwittingly mined for <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency </a>exploiting a security breach. Some of the compromised websites include the <b>United States courts online portal</b>, the <b>United States Information Commissioner Office</b>; the <b>National Health Service</b> in the <b>United Kingdom</b> and the <b>Victorian Parliament </b>website in <b>Australia</b>. The attack by a cryptojacking code hit common websites which had the text-to-speech accessibility script Browsealoud for the visually impaired from Texthelp company.<br />
<br />
Recently, Monero has grown in popularity with a market capitalization of $4 billion. Its privacy feature has contributed to its momentum on the dark web making it harder to track compared to bitcoin.<br />
<br />
The prices of virtual currency in the market skyrocketed recently and as a scheme that has drawn the attention of criminals. <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime" target="_blank">Cybercrimes </a>increased especially on cryptocurrency as criminals tried to cash in on the skyrocketing crypto prices. The cybercrime industry is recently believed to be overtaking the illegal drug trafficking industry in terms of revenue and hence attracting criminals.<br />
<br />
The hacking process involved insertion of a <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malicious </a>code that takes over a portion of a victim’s computer and central processing. Therefore the hacker has the ability of opening a website using a browser in order to mine virtual currency.<br />
<br />
The process of mining digital coins requiring less processing power such as Monero is much easier compared to mining bitcoin from websites as it requires powerful specialized computers and software, making Monero mining a better fit for saving on time and energy, making it a very attractive option to criminals.<br />
<br />
The dark web hackers had an easier time as they did not compromise each of the 4,275 websites at once, but rather hacked a globally-used plugin named ‘<b>Browsealoud</b>’ which is capable of reading out text from websites for the blind.<br />
<br />
After the Browsealoud code was hacked, <b>CoinHive’s Monero miner</b> was silently and secretly injected. Thereafter, any website using the Browsealoud plugin was automatically compromised.<br />
<br />
However the cyber-attack was deemed successful as there were basic regulatory measures and requirements over accessibility of some of these government websites that have not been met.</div>

Cryptocurrency Cyber Crime Dark Web Hacking News Monero News 4000 Government Websites Hacked in less than 4 Hours to Mine Cryptocurrency

Over four thousand high profile government websites have been compromised by dark web hackers across the globe, mining virtual currency...

GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

3/02/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCA2KmPcZ6tl-1mNqQitTXlcWy_r0PhcOLRKlZI_gPKiQYsjMR1YT2KeOMAYepOISIHRnna0HJngpaUGoeSU1WKZF3L3b66Hnhef6ZozmJpocjc-vTKPseqnsxfBJOz0YAM6iTytCL4FIf/s1600/github-under-biggest-ddos-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps" border="0" data-original-height="577" data-original-width="770" height="476" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCA2KmPcZ6tl-1mNqQitTXlcWy_r0PhcOLRKlZI_gPKiQYsjMR1YT2KeOMAYepOISIHRnna0HJngpaUGoeSU1WKZF3L3b66Hnhef6ZozmJpocjc-vTKPseqnsxfBJOz0YAM6iTytCL4FIf/s640/github-under-biggest-ddos-attack.png" title="GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps" width="640" /></a></div>
On Wednesday, developer repository site <a href="http://www.hackerschronicle.com/search/label/GitHub" target="_blank">GitHub </a>was hit with a critical DDoS attack that took the site offline multiple times for a few minutes each time. According to a GitHub incident report, the first portion of the <b>attack</b> against the developer platform <b>peaked at 1.35Tbps</b>, and there was a second 400Gbps spike later. This would make it the biggest <a href="http://www.hackerschronicle.com/search/label/DDoS" target="_blank">DDoS </a>attack recorded so far. Until now, the biggest clocked in at around 1.1Tbps.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_6SU_nmV8Bv4GmW9X_53gPWM1IX0B3UkKuRnggsV_NUHpGSXvuppv8h_9tZs6xs0Adc4dC6C3Kn7ny_2BzJrOL-hyTuVn6UI80yv1Z08LzDI5DlpgY_YTiOgXuCBb7oGQCfOLrTC_OCST/s1600/GitHub-hit-by-memcached-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub Under Memcached Attack" border="0" data-original-height="515" data-original-width="1357" height="241" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_6SU_nmV8Bv4GmW9X_53gPWM1IX0B3UkKuRnggsV_NUHpGSXvuppv8h_9tZs6xs0Adc4dC6C3Kn7ny_2BzJrOL-hyTuVn6UI80yv1Z08LzDI5DlpgY_YTiOgXuCBb7oGQCfOLrTC_OCST/s640/GitHub-hit-by-memcached-attack.png" title="GitHub Under Memcached Attack" width="640" /></a></div>
<br />
According to the <a href="https://githubengineering.com/ddos-incident-report/" target="_blank">incident report</a>, <b>GitHub was offline</b> Wednesday from 17:21 to 17:26 UTC and intermittently unavailable from 17:26 to 17:30 UTC, thanks to the attack. The report noted that <b>user data wasn't at risk during the attack</b>.<br />
<br />
The GitHub attack is the latest in a string of incidents where hackers have exploited a vulnerability in the <a href="http://www.hackerschronicle.com/search/label/Memcache" target="_blank">memcached </a>protocol to amplify the impact of such an attack. Memcached is typically used to speed up websites, but an issue with its UDP protocol makes the attack amplification possible, as noted by <a href="http://www.hackerschronicle.com/search/label/CloudFlare" target="_blank">CloudFlare</a>. <br />
<br />
Memcached, as is likely inferred by the name, is a tool that uses data caching to help ease the burden on data stores, it's not necessarily meant to be used with systems that are connected to the internet. But, that hasn't stopped attackers from finding a way to use it to launch and accelerate cyberattacks. By mislabeling a victim's IP as a target address, attackers can overload their network with traffic (up to 51,200x more in acceleration) and trigger a denial of service attack.<br />
<br />
<div style="text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOkQ5ZxWG7Fi2puxFcePSQ1YyR7XFqjde3vyIWj4n7lKdSCXNiUxU-aG9KAT9JGFTMm1BRcBFg9IBvVmiemZPCSnduAH8jon0e1MAIZu2mkCAMgAzZRGRkZQ4xhs2IEB_w8OywmARvCBU9/s1600/memcache-ddos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="411" data-original-width="640" height="256" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOkQ5ZxWG7Fi2puxFcePSQ1YyR7XFqjde3vyIWj4n7lKdSCXNiUxU-aG9KAT9JGFTMm1BRcBFg9IBvVmiemZPCSnduAH8jon0e1MAIZu2mkCAMgAzZRGRkZQ4xhs2IEB_w8OywmARvCBU9/s400/memcache-ddos.png" width="400" /></a></div>
To fix its own problem, GitHub moved some of its traffic to Akamai for additional capacity at the edge. In its own post <a href="https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html" target="_blank">Akamai</a>, one of the companies who discovered the vulnerability early on, wrote that it predicts "many more, potentially larger attacks in the near future. Akamai has seen a marked increase in scanning for open memcached servers since the initial disclosure."<br />
<br />
Josh Shaul, vice president of web security at Akami told, “we modeled our capacity based on five times the biggest attack that the internet has ever seen. So I would have been certain that we could handle 1.3 Tbps, but at the same time we never had a terabit and a half come in all at once.”<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHPtaGUF_LQ_T0f-Iq0eo3WtjgLo9Jov2obzmFbqzDui0PFaAQB0TC-hzWy_JfmexZ8ix3Lvj_yZ5cEzAux-Bp8KNRUoDadmrPuBGV8uiwh1ue70RBQt4Zdx0G8T8GT0-nJHW_Kp81wNs0/s1600/GitHub-under-ddos-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub under DDOS attack" border="0" data-original-height="137" data-original-width="720" height="120" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHPtaGUF_LQ_T0f-Iq0eo3WtjgLo9Jov2obzmFbqzDui0PFaAQB0TC-hzWy_JfmexZ8ix3Lvj_yZ5cEzAux-Bp8KNRUoDadmrPuBGV8uiwh1ue70RBQt4Zdx0G8T8GT0-nJHW_Kp81wNs0/s640/GitHub-under-ddos-attack.png" title="GitHub under DDOS attack" width="640" /></a></div>
<br />
<br />
There are few parallels to the scale of the attack, with GitHub saying there were “over a thousand different autonomous systems across tens of thousands of unique endpoints.”  </div>

Cyber Attack DDoS GitHub Memcache News GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

On Wednesday, developer repository site GitHub was hit with a critical DDoS attack that took the site offline multiple times for a few ...

Hundreds of WordPress & Joomla websites infected by ionCube Malware

3/01/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCISRo1hVEm5OFH1EX19PrnmdBIUzNSp6gAAdsBSrLx5s5IaAAgkIQAr0prPNAVrgGoobG6Ffa2swbhS559R1Ho20Z1KVrXHE_G4Ke8WQH-K_8pQ3Fg3bwrEVSvnKMoZtlvlZlp57xHcUT/s1600/Wordpress-ionCube-Malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Joomla infected by malware" border="0" data-original-height="330" data-original-width="680" height="308" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCISRo1hVEm5OFH1EX19PrnmdBIUzNSp6gAAdsBSrLx5s5IaAAgkIQAr0prPNAVrgGoobG6Ffa2swbhS559R1Ho20Z1KVrXHE_G4Ke8WQH-K_8pQ3Fg3bwrEVSvnKMoZtlvlZlp57xHcUT/s640/Wordpress-ionCube-Malware.jpg" title="Wordpress infected by malware" width="640" /></a></div>
<br />
Security researchers at SiteLock have discovered that hundreds of websites based on WordPress, Joomla and CodeIgniter have been infected with <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware </a>that masquerades as legitimate ionCube-encoded files.<br />
<br />
ionCube is an encoding technology used to protect PHP software from being viewed, changed, and run on unlicensed computers.<br />
<br />
The experts were analyzing an infected <a href="http://www.hackerschronicle.com/search/label/Wordpress" target="_blank">WordPress </a>website when discovered a number of suspicious obfuscated files –  such as “<b>diff98.php</b>” and “<b>wrgcduzk.php</b>” –  appearing almost identical to legitimate ionCube-encoded files. Further analysis conducted revealed that hundreds of websites were infected by the same ionCube Malware.<br />
<br />
“While reviewing an infected site, the SiteLock Research team found a number of suspiciously named, obfuscated files that appear almost identical to legitimate ionCube-encoded files. We determined the suspicious ionCube files were malicious, and found that hundreds of sites and thousands of files were affected.” reads the analysis published by SiteLock.<br />
<br />
“<b>Overall, our investigation found over 700 infected sites, totalling over 7,000 infected files.</b>”<br />
<br />
Further analysis revealed that attackers also compromised <a href="http://www.hackerschronicle.com/search/label/Joomla" target="_blank">Joomla </a>and <a href="http://www.hackerschronicle.com/search/label/CodeIgniter" target="_blank">CodeIgniter </a>websites. Threat actors packed their malware in a manner that appears ionCube-encoded files.<br />
<br />
The malicious code could theoretically infect any website based on a web server running PHP, once decoded, the fake ionCube files compose the ionCube malware.<br />
<br />
“While there’s still some degree of obfuscation, the presence of the <b>$_POST and $_COOKIE </b>superglobals and the eval request at the end of the file reveal its true purpose: to accept and execute remotely supplied code.” continues the analysis. “It looks like the remote code supplied to this file is further obfuscated and there may be some sort of access control implemented, judging by the GUID-formatted string present.” <br />
<br />
<br />
The researchers also provided recommendations to mitigate the ionCube Malware, they suggest administrators check the presence of ionCube-encoded files as an indicator of compromise.<br />
<br />
If an infection is detected, the scanning of the entire site is recommended, to completely eliminate the threat, the researchers also suggest the adoption of a web application <a href="http://www.hackerschronicle.com/search/label/Firewall" target="_blank">firewall </a>(WAF).<br />
<br />
“If you find indicators of this infection, we strongly recommend having your site scanned for malware as soon as possible, as this malware seldom appears on its own.” concluded the analysis.<br />
<br />
“This is especially important if you are using an ionCube-encoded application, as manually differentiating the malicious files from the legitimate ones is difficult, and <b>it is common to see up to 100 slightly different variants of this malware on a single site.</b> “<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjG2L3QHgleFLiGBwrwUF9mAtKK6KMFj1qG1bwIDIBEqOjGYAeNF0kz2JPqNiiS_RdFwXk7-WnV885oD1wfunLLE6tQ_692BaUArItvSegjDxj7phn5zy7BLYBBRSD4WaimFw9PlUpFhiG0/s1600/ionCube-Malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ionCube Malware" border="0" data-original-height="516" data-original-width="940" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjG2L3QHgleFLiGBwrwUF9mAtKK6KMFj1qG1bwIDIBEqOjGYAeNF0kz2JPqNiiS_RdFwXk7-WnV885oD1wfunLLE6tQ_692BaUArItvSegjDxj7phn5zy7BLYBBRSD4WaimFw9PlUpFhiG0/s640/ionCube-Malware.png" title="ionCube Malware" width="640" /></a></div>
</div>

CodeIgniter ionCube Joomla Malwares News Wordpress Hundreds of WordPress & Joomla websites infected by ionCube Malware

Security researchers at SiteLock have discovered that hundreds of websites based on WordPress, Joomla and CodeIgniter have been infected...

Hotspot Shield VPN is NO more Secure, Leaking Users Location

2/28/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1MQ1IHxLKVBVkwVdLs7a8UFYWzfculesftL6aqsnEVjTJtTZxijQIUMUGr86UALuIPPpYO__4yh8g2KxlWnf79XsLMsPnxFivQwgoKPXxsksF3HBBEVqkveb7mUg3OktFr7QTVYgiVYuN/s1600/Hotspot-Shield-Information-Disclosure.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hotspot Shield can expose VPN users locations" border="0" data-original-height="400" data-original-width="1200" height="211" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1MQ1IHxLKVBVkwVdLs7a8UFYWzfculesftL6aqsnEVjTJtTZxijQIUMUGr86UALuIPPpYO__4yh8g2KxlWnf79XsLMsPnxFivQwgoKPXxsksF3HBBEVqkveb7mUg3OktFr7QTVYgiVYuN/s640/Hotspot-Shield-Information-Disclosure.jpg" title="Hotspot Shield can expose VPN users locations" width="640" /></a></div>
<br />
A security researcher has found that one of the world’s largest <a href="http://www.hackerschronicle.com/search/label/VPN" target="_blank">Virtual Private Network (VPN)</a> providers is leaking users private information. Hotspot Shield, which has been downloaded over half a billion times and has been in operation for over a decade, has a bug which can reveal what country a user is located in, as well as leak the name of the WiFi network they are using. The <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerability </a>in Hotspot Shield’s VPN service was discovered by Paulos Yibelo. Yibelo reported his findings to Beyond Security’s SecuriTeam Secure Disclosure program.<br />
<br />
“By <a href="http://www.hackerschronicle.com/search/label/Information%20Disclosure" target="_blank">disclosing information</a> such as WiFi name, an attacker can easily narrow down or pinpoint where the victim is located,” Paulos Yibelo told. When an attacker knows what country a Hotspot Shield VPN user is from, they “can narrow down a list of places” their victim is from, Yibelo said. The vulnerability in Hotspot Shield’s VPN service was tested using a proof-of-concept code that Yibelo wrote. Using Yibelo’s code they were able to identify users WiFi networks, and the vulnerability kept working when tried from different computers and different network.<br />
<br />
Yibelo was able to write his proof-of-concept code very quickly, and it is only a few lines long. The code exploits a vulnerability in the local web server installed by Hotspot Shield. Private information and configuration data are returned when the exploit calls a JavaScript file being hosted on the web server. The private information of Hotspot Shield VPN users could be captured and stored from an infected website. According to Yibelo, he was able to successfully obtain Hotspot Shield VPN users IP addresses, though he was only having mixed results and was not always able to successfully capture real IP addresses. <br />
<br />
The developer of <b>Hotspot Shield VPN</b>, AnchorFree, Inc., is strongly denying that any user’s real IP addresses are being leaked through the vulnerability discovered by Paulos Yibelo. “We have reviewed and tested the researcher’s report. We have found that this vulnerability does not leak the user’s real IP address or any personal information, but may expose some generic information such as the user’s country. We are committed to the safety and security of our users, and will provide an update this week that will completely remove the component capable of leaking even generic information,” AnchorFree’s Tim Tsoriev said in a statement.<br />
<br />
After Yibelo discovered the vulnerability in Hotspot Shield VPN, he reported it to AnchorFree in December of last year but never received a response from the company. Yibelo then submitted the vulnerability to Beyond Security through their bug bounty program. Beyond Security also did not receive a response from AnchorFree. However, in February, AnchorFree finally addressed the issue with a new version of Hotspot Shield VPN which was recently released. The new version of Hotspot Shield VPN patches the vulnerability discovered by Yibelo.<br />
<br />
Last year Hotspot Shield VPN was accused by the Center for Democracy & Technology of selling their customers private information. A formal complaint was filed with the United States Federal Trade Commission (FTC) in which they allege that Hotspot Shield was guilty of employing unfair and deceptive trade practices. AnchorFree claimed that they did not collect any personal information about Hotspot Shield VPN users. Hotspot Shield VPN comes in both a free version, as well as a paid “Elite Version” subscription. The Center for Democracy & Technology discovered that Hotspot Shield VPN was sharing information after analyzing the VPN using Carnegie Mellon University’s Mobile App Privacy Compliance automated system on the free version of the Hotspot Shield VPN service.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIgJlWniS5CWuu5l9nx6AY0a6DcztXt31kP9dyM4R3vRFDyQBxwaypgNo5iSnJk6fKCcFbcR-mgk2WQqCbk5INRXlbfQUhDUHaijpiU0hsGWgcokJG_lto__jOucT4bLw1PnSYO0iMF5WL/s1600/HotSpot-Vulnerability-POC.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hotspot Shield Information Disclosure POC" border="0" data-original-height="253" data-original-width="645" height="249" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIgJlWniS5CWuu5l9nx6AY0a6DcztXt31kP9dyM4R3vRFDyQBxwaypgNo5iSnJk6fKCcFbcR-mgk2WQqCbk5INRXlbfQUhDUHaijpiU0hsGWgcokJG_lto__jOucT4bLw1PnSYO0iMF5WL/s640/HotSpot-Vulnerability-POC.PNG" title="Hotspot Shield Information Disclosure POC" width="640" /></a></div>
<br /></div>

CVE-2018-6460 Information Disclosure News VPN Vulnerability Hotspot Shield VPN is NO more Secure, Leaking Users Location

A security researcher has found that one of the world’s largest Virtual Private Network (VPN) providers is leaking users private inform...

2,000 Computers of Department of Telecom, Infected with Ransomware

2/25/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl3ZfURe3ZAbtIzrkTlb4jfgZvVseEQxB7hlblYzUvyTxsUmoc1MriDmqSdKEn3_0j7f6AlAB7fw4dnWwuyaZCL68_JhnblYxRZwJpiVe9lI6_g9qXaCdQ-ViguE4i4L4e_LNI7KbHbLmH/s1600/samsam-ransomware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Computers of Department of Telecom Hacked" border="0" data-original-height="471" data-original-width="624" height="481" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl3ZfURe3ZAbtIzrkTlb4jfgZvVseEQxB7hlblYzUvyTxsUmoc1MriDmqSdKEn3_0j7f6AlAB7fw4dnWwuyaZCL68_JhnblYxRZwJpiVe9lI6_g9qXaCdQ-ViguE4i4L4e_LNI7KbHbLmH/s640/samsam-ransomware.png" title="Computers of Department of Telecom Infected" width="640" /></a></div>
<br />
<a href="http://www.hackerschronicle.com/search/label/SamSam" target="_blank">SamSam</a> ransomware made the headlines again, this time it infected over 2,000 computers at the Colorado Department of Transportation (DOT). The DOT has shut down the infected workstations and is currently working with security firm McAfee to restore the ordinary operations. Officials confirmed the <a href="http://www.hackerschronicle.com/search/label/Ransomeware" target="_blank">ransomware </a>requested a bitcoin payment.<br />
<br />
“The Colorado Department of Transportation has ordered an estimated 2,000 employees to shut down their computers following a ransomware attack Wednesday morning.” wrote the CBS Denver.<br />
<br />
The CDOT spokesperson Amy Ford said employees were instructed to turn off their computers at the start of business Wednesday after ransomware infiltrated the CDOT network. “We’re working on it right now,” added Ford.<br />
<br />
The good news is that crucial systems at the Colorado DOT such as surveillance cameras, traffic alerts were not affected by the ransomware. David McCurdy, OIT’s Chief Technology Officer, issued the following statement:<br />
<br />
“Early this morning state security tools detected that a ransomware virus had infected systems at the Colorado Department of Transportation. The state moved quickly to quarantine the systems to prevent further spread of the virus. OIT, FBI and other security agencies are working together to determine a root cause analysis. This ransomware virus was a variant and the state worked with its antivirus software provider to implement a fix today. The state has robust backup and security tools and has no intention of paying ransomware. Teams will continue to monitor the situation closely and will be working into the night.”<br />
<br />
The Colorado DOT officials confirmed that the agency will not pay the ransom and it will restore data from backups.<br />
<br />
The SamSam ransomware is an old threat, attacks were observed in 2015 and the list of victims is long, many of them belong to the healthcare industry. The attackers spread the malware by gaining access to a company’s internal networks by brute-forcing RDP connections.<br />
<br />
Among the victims of the Samsam Ransomware there is the MedStar non-profit group that manages 10 hospitals in the Baltimore and Washington area. Crooks behind the attack on MedStar requested 45 <a href="http://www.hackerschronicle.com/search/label/Bitcoin" target="_blank">Bitcoins </a>(about US$18,500) for restoring the encrypted files, but the organization refused to pay the Ransom because it had a backup of the encrypted information.<br />
<br />
In April 2016, the FBI issued a confidential urgent “Flash” message to the businesses and organizations about the Samsam Ransomware.<br />
<br />
Back to the present, the Samsam Ransomware made the headlines in the first days of 2018, the malicious code infected systems of some high-profile targets, including hospitals, an ICS firm, and a city council.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZWzpSAFohcXWmdcyvYDk6JJEOhV0p7j8OOblhEqfN23RlYTlGpT64cmezbc2NBgDTzhBaBdfXTyKokK1CiIzMWyeygCdUMDWA3e7cSVOw78MDJxW8LDI-n0kq75usuKjM0w12iSJsnDnu/s1600/SamSam-note.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="309" data-original-width="511" height="193" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZWzpSAFohcXWmdcyvYDk6JJEOhV0p7j8OOblhEqfN23RlYTlGpT64cmezbc2NBgDTzhBaBdfXTyKokK1CiIzMWyeygCdUMDWA3e7cSVOw78MDJxW8LDI-n0kq75usuKjM0w12iSJsnDnu/s320/SamSam-note.png" width="320" /></a></div>
</div>

Hacking News News Ransomware SamSam 2,000 Computers of Department of Telecom, Infected with Ransomware

SamSam ransomware made the headlines again, this time it infected over 2,000 computers at the Colorado Department of Transportation (DO...

Tinder Can be Hacked With Just A Phone Number

2/24/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgehEVfwVifii9PVyN4jljzRWNf7Aq9CRzeVV3M8avQnbv1-oc6BWor6hyphenhypheniWs7qwFHIp5mfvgrHB6CdYIoqPANLqrhba0FOfYD1SF0UQ9B7vbJxYuBh_Da3TuSD6fqrMkqpMADMqm-976Er/s1600/Tinder-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Tinder vulnerability let hackers take over accounts with just a phone number" border="0" data-original-height="640" data-original-width="960" height="425" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgehEVfwVifii9PVyN4jljzRWNf7Aq9CRzeVV3M8avQnbv1-oc6BWor6hyphenhypheniWs7qwFHIp5mfvgrHB6CdYIoqPANLqrhba0FOfYD1SF0UQ9B7vbJxYuBh_Da3TuSD6fqrMkqpMADMqm-976Er/s640/Tinder-Hacked.png" title="Tinder vulnerability let hackers take over accounts with just a phone number" width="640" /></a></div>
<br />
An easy-to-exploit bug has left Tinder accounts and private chats exposed to hackers, revealed a researcher this week.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Indian%20Hackers" target="_blank">Indian engineer</a> Anand Prakash, a serial bug hunter, said on Wednesday, 20 February, that a flaw in a <a href="http://www.hackerschronicle.com/search/label/Facebook" target="_blank">Facebook</a>-linked program called Account Kit let attackers access profiles armed with just a phone number. Account Kit has been implemented on Tinder and it has been used by developers to let users log on to a range of apps using mobile details or email addresses without a password.<br />
<br />
That should not have been enough for an account takeover by itself, but <a href="http://www.hackerschronicle.com/search/label/Tinder" target="_blank">Tinder</a>’s implementation of Account Kit had its own vulnerability. Tinder’s login system wasn’t verifying access tokens against their associated client ID, which meant anyone with a valid access token could take over an entire account. Chained together, the two <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerabilities </a>let researchers completely take over a Tinder account — with full access to the user’s profile and chats — starting from only a phone number.<br />
<br />
According to Prakash, an ethical hacker known for finding bugs in popular websites, until recently, there was a crack in this process that could let hackers compromise "access tokens" from users' cookies. The attacker could then exploit a bug in Tinder to use the token, which stores security details, and log in to the dating account with little fuss.<br />
<br />
Earlier this year, on 23 January, a different set of “disturbing” vulnerabilities were found in Tinder's <a href="http://www.hackerschronicle.com/search/label/Android" target="_blank">Android </a>and iOS apps by Checkmarx Security Research Team.<br />
<br />
Experts said hackers could use them to take control of profile pictures and swap them for “inappropriate content, rogue advertising or other type of malicious content.” The firm claimed that nefarious attackers could “monitor the user's every move” on the application.<br />
<br />
A bug within Tinder is problematic as the app boasts an estimated 50 million users worldwide with roughly 40 percent of them based in North America, and a million dates facilitated a week according to the website, along with 1.6 billion swipes a day.<br />
<br />
Tinder declined to comment on the specifics of the report. “Security is a top priority at Tinder,” a representative said, “However, we do not discuss any specific security measures or strategies, so as not to tip off malicious hackers.”</div>

Hacking News Indian Hackers News Tinder Vulnerability Tinder Can be Hacked With Just A Phone Number

An easy-to-exploit bug has left Tinder accounts and private chats exposed to hackers, revealed a researcher this week. Indian engine...

After Nirav Modi, Hackers are targeting Punjab National Bank

2/23/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxI3_ffIRgsUVDxeyzqvySZ4SQEZoCHHmw_amNPS6rUSwYlqnFOJ5clv8AQCC7fYqZX45iv7Vz18aLit1O3UdeoTiNO7kZBMiihfLDK3ETjhAQjgkyBI2x2KrPiJSOlcSYHIf-pQ-BodTw/s1600/PNB-Data-Breached.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="PNB Debit/Credit cards information Breached" border="0" data-original-height="433" data-original-width="770" height="356" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxI3_ffIRgsUVDxeyzqvySZ4SQEZoCHHmw_amNPS6rUSwYlqnFOJ5clv8AQCC7fYqZX45iv7Vz18aLit1O3UdeoTiNO7kZBMiihfLDK3ETjhAQjgkyBI2x2KrPiJSOlcSYHIf-pQ-BodTw/s640/PNB-Data-Breached.jpg" title="PNB Debit/Credit cards information Breached" width="640" /></a></div>
<br />
Punjab National Bank has reported a <b><a href="http://www.hackerschronicle.com/search/label/Data%20Leak" target="_blank">data breach</a> affecting as many as 10,000 credit and debit card customers</b>, and security experts believe that sensitive information has been available for  purchase through a website for at least three months.<br />
<br />
The disclosure will raise further questions about security levels at the bank, which is already under stress over a reported Rs 11,300 crore fraud involving fake letters of guarantee that were allegedly used by leading jeweller Nirav Modi to raise funds from banks. Two PNB employees allegedly colluded with Modi and his uncle in the scam.<br />
<br />
<u>PNB was not aware of the data breach  until it was tipped off on Wednesday night</u> by CloudSek Information Security, a company registered in Singapore but mainly operating in Bengaluru, India, that monitors data transactions.<br />
<br />
“We have a crawler that is deployed in the <a href="http://www.hackerschronicle.com/search/label/Darknet" target="_blank">dark/deep web</a>. These are sites on the internet which are not indexed by Google or other major search engines. They are used to buy and sell sensitive data illegally,” said chief technical officer Rahul Sasi. “Our crawler detects any such data and sends it to a Machine Learning software that we have created. If this detects anything that is suspicious, and of interest to our clients, we immediately take action.”<br />
<br />
He said CloudSek was unable to contact <a href="http://www.hackerschronicle.com/search/label/PNB" target="_blank">PNB </a>after detecting the breach as it is not a customer at the bank, but eventually passed the details through a government agency. PNB’s Chief Information Security Officer T D Virwani confirmed it was working with the government to contain fallout from the release of the data, which was offered through a blackhat website.<br />
<br />
Government officials who are aware of the breach said other relevant agencies had been alerted and they were trying to establish the extent of the problem. So far, they have discovered sensitive information from as many as 10,000 credit cards issued by the bank.<br />
<br />
<b>This includes names, expiry dates, Personal Identification Numbers and Card Verification Values.</b> Sasi said two sets of data were released: some with CVV numbers and some without. The last date stamp on the data is January 29, 2018, indicating that the details are still current for thousands of card customers.<br />
<br />
“We believe, on preliminary analysis, that the data has been available for at least three months. While this is yet to be firmly established, we are carrying out our forensic investigation,” said a government official familiar with the case. Virwani was asked to comment on the breach, but has not yet responded.<br />
<br />
Investigators in both the private and government sectors are still trying to determine how the breach occurred. It is thought the data could have come from a laptop or mobile phone carried by a bank customer that was infected with a malicious code, or from a third party. Payment gateways also had access to the data.<br />
<br />
But an investigator said it was more likely the bank’s security was compromised, as a large amount of data came from a single source.<br />
<br />
“Usually these sites on the deep/dark web build up reputations on the authenticity of the data they sell illegally. This particular site has a very good reputation. They offer a sample size to buyers to establish their credentials before the sale is made. In this case they were <span class="highlight">offering to sell the data at US$4.90 per card</span>,” he reported.<br />
<br />
Sasi said all options were possible, but there wasn’t enough information yet to be certain how the leak had taken place.<br />
<br />
It is the second big data leak in recent years in India. In October 2016 more than 3.2 million <a href="http://www.hackerschronicle.com/search/label/Credit%20Card" target="_blank">credit and debit cards</a> issued by numerous banks had to be recalled after customers reported they were used illegally in China and other countries. An investigation revealed that computer systems of a private payment services firm that manages ATM machines for a large Indian bank had been hacked.</div>

Credit Card Darknet Data Leak News PNB After Nirav Modi, Hackers are targeting Punjab National Bank

Punjab National Bank has reported a data breach affecting as many as 10,000 credit and debit card customers , and security experts beli...

Multiple Zero-Day Vulnerabilities found in GitLab

2/22/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtGtTc2n2dMoS1A8Ytl8OAzmN-_VfghE3I8KAcA2WI7I4kHBGfjS-21GBkR2a4xxZ_92HdxKzQpaOLp83aSpwsnVYx9Z47I7XTh8Sxp379v_F-XXmtaeLcl-BAwLJ2OsSLCaYnFN4511BC/s1600/Zero-Day-in-GitLab.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Domain Hijacking Vulnerability found in GitLab" border="0" data-original-height="545" data-original-width="770" height="449" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtGtTc2n2dMoS1A8Ytl8OAzmN-_VfghE3I8KAcA2WI7I4kHBGfjS-21GBkR2a4xxZ_92HdxKzQpaOLp83aSpwsnVYx9Z47I7XTh8Sxp379v_F-XXmtaeLcl-BAwLJ2OsSLCaYnFN4511BC/s640/Zero-Day-in-GitLab.jpg" title="Domain Hijacking Vulnerability found in GitLab" width="640" /></a></div>
<br />
A security researcher hijacked hundreds of GitLab domains in just a few seconds by exploiting a weakness in how the company handles domain verification -- a security issue that the company has now fixed.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/GitLab" target="_blank">GitLab</a>, a web-based git repository manager that lets developers track and collaborate on source code and project development, also allows users to host their own content and projects with a custom domain name.<br />
<br />
But the company said in a security notification on February 5 that no validation was being performed when a user added a custom domain to their GitLab accounts. In the little time that a custom domain points to a recently deleted or unclaimed GitLab repo that will be added later, the domain can be hijacked.<br />
<br />
Edwin Foudil, known as EdOverflow, and founder of security consulting firm Penultimate, drew inspiration from a bug report submitted on February 1, which contained proof-of-concept code that listed vulnerable custom domains that were pointing to GitLab. GitLab marked the initial report as informative, which according to documentation means it contains "useful information but did not warrant an immediate action or a fix".<br />
<br />
Because GitLab allows pointing an unlimited number of domains for a single repository, Foudil was able to write a short script weaponizing that initial code, allowing him to mass hijack a limitless number of domains. "This resulted in <b>700 hijacked domains and subdomains in under one minute</b>," he told ina interview. Not only that, any hijacked domain is prevented from creating a GitLab repository with that domain.<br />
<br />
That was enough to catch GitLab's attention, with the company confirming that Foudil's "valuable report" was what "triggered our response" in releasing the security notification less than a day later. "I managed to escalate the issue to the point where the issue was in fact caused by GitLab," said Foudil. "GitLab allowed mass monitoring of domains prior to them even pointing to GitLab's IP address."<br />
<br />
<span class="highlight">Foudil's report was publicly released late Wednesday after the company fixed the bug. </span><br />
<br />
Foudil also said the attack isn't just limited to domains that his script could detect. Hijacking domains was as easy as scraping the domain names of thousands of high-ranking sites. Once a domain is taken over, the attacker can serve any content they want on that domain.<br />
<br />
"The <a href="http://www.hackerschronicle.com/search/label/Exploit" target="_blank">exploits </a>are endless," Foudil said. He gave several examples where an attacker can hijack a subdomain to read and set cookies on other basenames. "I can even mine <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency</a>," he said.<br />
<br />
Kathy Wang, director of security at GitLab, said in a phone call this week that the company took responsibility for the security issue. She added that the lack of domain verification is "a widespread problem across the industry". "Implementing domain verification is an exception not a rule -- so a lot of vendors have not yet done it," she said.<br />
<br />
GitLab switched off the feature to add custom domains until a fix was made available. The company said it estimates the fix rollout will complete by the end of the month.</div>

DevOps GitLab Hacking News News Vulnerability Zero-Day Multiple Zero-Day Vulnerabilities found in GitLab

A security researcher hijacked hundreds of GitLab domains in just a few seconds by exploiting a weakness in how the company handles doma...

Tesla's Cloud Servers Hacked to mine Cryptocurrency

2/21/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s1600/Tesla-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Kubernetes Consoles Breached" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s640/Tesla-Servers-Hacked.png" title="Kubernetes Consoles Breached" width="640" /></a></div>
<br />
Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency</a>. The incident took place last year when hackers gained access to Tesla's Kubernetes server, an open-source application used by large companies to manage API and server infrastructure deployed on cloud hosting providers.<br />
<br />
Cloud security firm RedLock —whose experts discovered the hacked server— said hackers found a "pod" inside the <a href="http://www.hackerschronicle.com/search/label/Kubernetes" target="_blank">Kubernetes </a>console that stored login credentials for one of Tesla's AWS cloud infrastructure.<br />
<br />
RedLock says the <a href="http://www.hackerschronicle.com/search/label/AWS" target="_blank">AWS </a>buckets appeared to have been storing sensitive data such as telemetry, but a Tesla Motors spokesperson told  in an email the data was from "internally-used engineering test cars only." While there's no evidence intruders stole any data, they did install a mining application that utilized the vast computational resources of Tesla's AWS servers to mine the <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero cryptocurrency</a>.<br />
<br />
A Tesla spokesperson told that the company received a notification about the incident and secured the server immediately. RedLock said today the incident took place because Tesla engineers forgot to secure the Kubernetes console with an access password.<br />
<br />
"We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it," Tesla said. "The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way.”<br />
<br />
It is very clear that these hackers knew what they were doing, as they set up a private mining pool to use for their illegal mining operations only, hid the mining pool behind CloudFlare, configured the mining software to listen for commands on a non-standard port, and throttled the mining software to use only a small portion of <a href="http://www.hackerschronicle.com/search/label/Tesla" target="_blank">Tesla's</a> AWS CPU resources. All of these configuration changes were made to avoid detection. Because they used a custom mining pool, it is unclear how much money this hacker group made.</div>

AWS Cryptocurrency Hacking News Kubernetes Monero News Tesla Tesla's Cloud Servers Hacked to mine Cryptocurrency

Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the cryptocurrency ....

Hackers stole $1.8 mn from City Union Bank

2/19/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCkwDGToesin2s_-u3JKcwu7EYNjhNHZPArCZ3aLVPSbJnMEp8dlwlUaTKh-E5s3eFmmbyoUgKG2d_xPJXaXyjUkIO6aB25A9eCqXfl7fNS7GwkHt7wuP4Eh_qqmrCLa18nSolezTPTyRs/s1600/city-union-bank-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="city-union-bank-hacked" border="0" data-original-height="541" data-original-width="800" height="432" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCkwDGToesin2s_-u3JKcwu7EYNjhNHZPArCZ3aLVPSbJnMEp8dlwlUaTKh-E5s3eFmmbyoUgKG2d_xPJXaXyjUkIO6aB25A9eCqXfl7fNS7GwkHt7wuP4Eh_qqmrCLa18nSolezTPTyRs/s640/city-union-bank-hacked.jpg" title="city-union-bank-hacked" width="640" /></a></div><br />
A year after the SWIFT international bank transfer system enhanced its security, another breach has emerged: an Indian bank has confirmed that criminals gained access to its systems and made <span class="highlight">transfers totaling US$1.8 million.</span><br />
<br />
The Kumbakonam-based City Union Bank <a href="https://www.cityunionbank.com/downloads/Press_Release_swift.pdf" target="_blank">issued a statement</a> on Sunday February 18, in response to local media speculation that three unauthorized transactions were initiated by staff. In it, the bank says it suffered an attack by <span class="highlight">“international cyber-criminals and there is no evidence of internal staff involvement”.</span> The statement says the transactions took place on or before February 7, when its reconciliation processes identified the three fraudulent transactions.<br />
<br />
A transfer of $500,000 through Standard Chartered to a Dubai bank was blocked at the source. That's good news, of a sort, because SWIFT launched a scanning service designed to spot fraudulent transactions in April 2017, as part of its response to the 2016 incident that saw second-hand security kit used at Bangladesh Bank let attackers into the international funds transfer system. <span class="highlight">On that occasion, $81 million was transferred.</span> The attackers tried to steal over $1bn, but were thwarted by a typo in one of their attempted transfers.<br />
<br />
SWIFT later warned banks to tighten their security.It remained a plum target, however, and in October 2017, a Taiwanese bank had $60 million pinched. Those funds were recovered, and the attackers arrested. It appears that SWIFT's dodgy-deal-detectors worked for the transfer to Dubai. But a second made it to a Turkish bank and $1m is still missing after being transferred through a Bank of America account to a Chinese destination and withdrawn by an unknown beneficiary.<br />
<br />
The Indian consulate in Istanbul is assisting with efforts to recover funds from the Turkish transfer. City Union Bank added that its SWIFT system is back in operation with “adequate enhanced security”. Just how the alleged criminals exploited the Bank's previous security regime has not been revealed, so it is unknown if SWIFT or Union Bank is the source of the problem.</div>

City Union Bank Cyber Attack Hacking News News SWIFT Hackers stole $1.8 mn from City Union Bank

A year after the SWIFT international bank transfer system enhanced its security, another breach has emerged: an Indian bank has confirmed t...

Thousands of Jenkins Servers Hacked to mine Monero

2/18/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s1600/JenkinsMinerMalware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Hacked-to-Mine-Monero" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s640/JenkinsMinerMalware.png" title="Jenkins-Hacked-to-Mine-Monero" width="640" /></a></div>
A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency.<br />
<br />
Hackers are targeting <a href="http://www.hackerschronicle.com/search/label/Jenkins" target="_blank">Jenkins</a>, a continuous integration/deployment web application built in Java that allows dev teams to run automated tests and execute various operations based on test results, including deploying new code to production servers. Because of this, Jenkins servers are extremely popular with both freelance web developers, but also with large enterprises.<br />
<br />
A cyber security research firm announced it uncovered the footprint of a large hacking operation targeting Jenkins servers left connected to the Internet.<br />
<br />
<b>Hackers using Jenkins RCE flaw</b><br />
Attackers were leveraging <a href="https://jenkins.io/security/advisory/2017-04-26/" target="_blank">CVE-2017-1000353</a>, a vulnerability in the Jenkins Java deserialization implementation that allows attackers to run malicious code remotely without needing to authenticate first. Hackers used this vulnerability to make Jenkins servers download and install a <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>miner (minerxmr.exe).<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s1600/Jenkins-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Servers-Hacked" border="0" data-original-height="438" data-original-width="894" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s640/Jenkins-Servers-Hacked.png" title="Jenkins-Servers-Hacked" width="640" /></a></div>
The miner was being downloaded from an IP address located in <a href="http://www.hackerschronicle.com/search/label/Chinese%20Hackers" target="_blank">China </a>and assigned to the Huaian government network. It is unclear if this is the attacker's server, or a compromised server used to host the miner on behalf of the hackers.<br />
<br />
The attackers have been active for months. This has allowed them to mine and already <b>cash out over 10,800 Monero, which is over $3.4 million</b>, at the time of writing.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s1600/Monero-Mining-Malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Monero-Mining-Malware" border="0" data-original-height="475" data-original-width="1175" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s640/Monero-Mining-Malware.png" title="Monero-Mining-Malware" width="640" /></a></div>
Researchers say the group appears to have compromised mostly Jenkins instances running on Windows operating systems.<br />
<br />
<b>Over 25,000 Jenkins servers left exposed online</b><br />
Attackers aren't the only ones who've noticed the large number of Jenkins servers available online. In mid-January, security researcher Mikail Tunç published <a href="https://emtunc.org/blog/01/2018/research-misconfigured-jenkins-servers/" target="_blank">research</a> highlighting that there were over 25,000 Jenkins servers left exposed to Internet connections at the time of his research.<br />
<br />
Also on Friday, Researchers released new research on other hackers leveraging the <b>CVE-2017-10271</b> flaw to infect Oracle WebLogic servers with malware. This vulnerability has been under active exploitation <b>since early December 2017</b>, and one group has already made <b>more than $226,000</b>.<br />
<br />
Besides Jenkins and <b>Oracle WebLogic</b> servers, hackers are also targeting <b>Ruby on Rails, PHP, and IIS </b>servers, also deploying Monero-mining malware.<br />
<br />
Monero-mining malware is already this year's biggest <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware trend/problem</a>, with numerous malware distribution campaigns spreading such payloads on any unsecured computer/server crooks can get their hands on.</div>

Cryptocurrency Hacking News Jenkins Malwares Miner Monero News Thousands of Jenkins Servers Hacked to mine Monero

A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency. H...

New search engine launched to find Hackable Servers

2/17/2018 cyb3r.gladiat0r 0

AWS BuckHacker Hacking Tools News S3 New search engine launched to find Hackable Servers

New search engine launched to find Hackable Servers We all know very well that more and more users are simply choosing to save their d...