Russian military involved in NotPetya attacks: UK

2/16/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghzYNI6Anca1BCGPLXTKDzKA8JIHruZe9_LhR5xzxe8ZwQXo9WmTcdPFX5m1gDRJ_HRv73E1fkym1SmN75JvW1fkuPTqLa0w4zl0DvFRx01JjU-MYf3BvK9XYJvqNf-aHMNXN5ZMDQwySm/s1600/Russian+military+involved+in+NotPetya+attacks.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Russian military involved in NotPetya attacks: UK" border="0" data-original-height="450" data-original-width="800" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghzYNI6Anca1BCGPLXTKDzKA8JIHruZe9_LhR5xzxe8ZwQXo9WmTcdPFX5m1gDRJ_HRv73E1fkym1SmN75JvW1fkuPTqLa0w4zl0DvFRx01JjU-MYf3BvK9XYJvqNf-aHMNXN5ZMDQwySm/s640/Russian+military+involved+in+NotPetya+attacks.jpg" title="Russian military involved in NotPetya attacks: UK" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Russian military involved in NotPetya attacks: UK</td></tr>
</tbody></table>
<br />
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK government has officially accused the Russian government of June's disruptive and hugely costly NotPetya malware attack.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The UK Government judges that the Russian government, specifically the <a href="http://www.hackerschronicle.com/search/label/Russian%20Millitary">Russian military</a>, was responsible for the destructive NotPetya cyber-attack of June 2017," Foreign Office minister for Cyber Security, Tariq Ahmad, said in a statement.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The attack showed a continued disregard for Ukrainian sovereignty. Its reckless release disrupted organizations across Europe, costing hundreds of millions of pounds."</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Initially, NotPetya was thought to be <a href="http://www.hackerschronicle.com/search/label/Ransomeware">ransomware</a>, but security researchers quickly concluded it was more likely to be destructive <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a> designed to wipe systems.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK's National Cyber Security Centre (NCSC) today revealed it came to the same conclusion, noting that the malware was only masquerading as ransomware and its main purpose was to disrupt.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The NCSC said the Russian military was "almost certainly responsible" for the NotPetya attack.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Shipping container firm Maersk, FedEx's Dutch delivery subsidiary TNT Express, and UK firm Reckitt Benckiser were among global firms that suffered severe disruptions and several hundred million dollars in lost revenue. However, the <b>firms</b>, however, <b>were collateral damage in the ongoing conflict between Ukraine and Russia</b>.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Below is the flow of Petya Attack Flow : </div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfrK5YZfsqC6QuFhNHu1m9yN_VZ7bbK1oGuZ3gdTmJCRxM5MnqajYsWTSdyjs9ViXPqGXr_u29ZWWuvHag9u8MigR588GTZBzHjPW2xZEIGrzqxScUBcTeKBZNaJNzFkswON6w0bYBQ0vx/s1600/petya-attack-flow.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Russian military involved in NotPetya attacks: UK" border="0" data-original-height="424" data-original-width="800" height="338" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfrK5YZfsqC6QuFhNHu1m9yN_VZ7bbK1oGuZ3gdTmJCRxM5MnqajYsWTSdyjs9ViXPqGXr_u29ZWWuvHag9u8MigR588GTZBzHjPW2xZEIGrzqxScUBcTeKBZNaJNzFkswON6w0bYBQ0vx/s640/petya-attack-flow.png" title="Russian military involved in NotPetya attacks: UK" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Russian military involved in NotPetya attacks: UK</td></tr>
</tbody></table>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<br /></div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<b>NotPetya employed the NSA <a href="http://www.hackerschronicle.com/search/label/Exploits">exploits </a>for Windows known as EternalBlue and EternalRomance</b> as well as credential-dumping tools to spread internally across networks once one machine was infected. The exploits were leaked in April by The Shadow Brokers.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The malware<b> initially infected organizations via a compromised update from Ukraine</b> accounting software provider MEDoc. Its MEDoc software is one of two accounting packages required for companies doing business in Ukraine and is widely used by Ukraine agencies.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Maersk, which used MEDoc at its Ukraine offices, recently revealed it was forced to reinstall 45,000 PCs, 4,000 servers and 2,000 applications hit by NotPetya. The company reported losses of $300m due to the incident.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
NCSC notes that Ukraine's financial, energy and government institutions bore the brunt of NotPetya. However, the "indiscriminate design" of the malware caused it to spread to other European and Russian businesses.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Though it is unusual to officially blame another nation for a cyber attack, the US and Five-Eye partners blamed the WannaCry ransomware attack on North Korea. The idea, in part at least, is to name and shame nation-state attackers for their actions.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<b>Russia and North Korea have consistently denied responsibility for the NotPetya, WannaCry, and other cyber attacks.</b></div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK's Ahmad said the Kremlin has positioned Russia in direct opposition to the West.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"It doesn't have to be that way. We call upon Russia to be the responsible member of the international community it claims to be rather than secretly trying to undermine it," he said.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The United Kingdom is identifying, pursuing and responding to malicious cyber activity regardless of where it originates, imposing costs on those who would seek to do us harm."</div>
</div>

Russian military involved in NotPetya attacks: UK The UK government has officially accused the Russian government of June's di...

Millions of android devices Hacked

2/15/2018 The Hackers Chronicle 0

Android Cryptocurrency Hacking News Malwares News Millions of android devices Hacked

Millions of android devices Hacked The Android operating system and its apps are usually more exposed to security problems and the pr...

Western Union Money Transfer, Hacked

2/14/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpuAeT0_k1iZ9oL_nMOItMpEKtDe1t1oZ5fH2p9Yc7WrANYtc_enEGiSKIQ55TfJ-NmhT3Q6_FJk9DwIerAFLmaPCZHzPjbYpark9xpyPfIreyirI3DIc2LAUQQTW_tMbWA9yNviuWh30/s1600/WU_hacked.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="512" data-original-width="800" height="408" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpuAeT0_k1iZ9oL_nMOItMpEKtDe1t1oZ5fH2p9Yc7WrANYtc_enEGiSKIQ55TfJ-NmhT3Q6_FJk9DwIerAFLmaPCZHzPjbYpark9xpyPfIreyirI3DIc2LAUQQTW_tMbWA9yNviuWh30/s640/WU_hacked.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Western Union Money Transfer, Hacked</td></tr>
</tbody></table>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br />
Western Union has confirmed one of its IT suppliers was hacked, and that customer information was exposed to miscreants.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
Someone, who wished to remain anonymous, showed us a copy of a letter dated January 31 that he received from the money-transfer outfit. The missive admitted that a supposedly secure data storage company used by Western Union was compromised: a database full of the wire-transfer giant's customer records was vulnerable to plundering, and hackers were quick to oblige.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"We have discovered that <b>some of your information may have been accessed without authorization as a result of a computer intrusion against an external vendor system formerly used by Western Union for secure data storage</b>," the letter read.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<span style="font-size: 16.0000400543213px; line-height: 24.0000610351563px;">"We promptly moved our external secure storage to a different vendor's system. We immediately notified law enforcement, and are actively cooperating with its investigation. Expert assistance was also immediately engaged to determine what personal information may have been compromised."</span></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
In other words, it sounds as though a <a href="http://www.hackerschronicle.com/search/label/Cloud%20Storage">cloud-based</a> or off-site backup storage provider was hacked. Now that system has been shut down, the cops alerted, and digital forensics teams are probing the network intrusion.</div>
<h3 class="crosshead" style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 1.0625em; margin: 0px 0px 5px;">
<span style="box-shadow: rgb(230, 231, 231) 0em -0.56em 0px inset;">Suspicious</span></h3>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"Upon detecting suspicious activity, Western Union permanently discontinued all use of the vendor's system and the system was taken offline," a spokesperson for Western Union told.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"<a href="http://www.hackerschronicle.com/search/label/Western%20Union">Western Union</a> took immediate action upon learning of this intrusion to notify law enforcement authorities. The company has notified affected individuals and regulators as appropriate. Affected individuals received a customized notification that explains the specific types of his or her personal data that may have been affected."</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
According to the letter, the storage archive contained customers' contact details, bank names, Western Union internal customer ID numbers, as well as transaction amounts, times and identification numbers. Credit card data was definitely not taken, it stressed.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<i>El Reg</i> tweeted a redacted copy of the letter earlier this week:</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrNxpVuL9cK13AgvKiH_UJiZswdFY6KOAXN2MDQ2fo2E7YUK7fj9eAWdPvJDPmO0dWVGME_LGJ-_pxm4JQPHvx2S8nPKhb1nZwWbQ2gR5XJzfRdS_xRF343Kw4dHMGph60yyMdOBnirsU/s1600/DV3ExpCVwAAp3Mg.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Western Union Money Transfer, Hacked" border="0" data-original-height="899" data-original-width="1199" height="478" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrNxpVuL9cK13AgvKiH_UJiZswdFY6KOAXN2MDQ2fo2E7YUK7fj9eAWdPvJDPmO0dWVGME_LGJ-_pxm4JQPHvx2S8nPKhb1nZwWbQ2gR5XJzfRdS_xRF343Kw4dHMGph60yyMdOBnirsU/s640/DV3ExpCVwAAp3Mg.jpg" title="Western Union Money Transfer, Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;"><br /></td></tr>
</tbody></table>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<span style="font-size: 16px;">The </span><b style="font-size: 16px;">red-faced biz was quick to point out that none of its internal payment or financial systems were affected in the attack</b><span style="font-size: 16px;">. It also isn’t saying who the third-party storage supplier was, giving other customers of the slovenly provider time to check whether or not they have been hacked too.</span></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
Western Union says that, so far, it isn't aware of any fraudulent activity stemming from the data security cockup, but just to be on the safe side it is enrolling affected customers in a year of free <a href="http://www.hackerschronicle.com/search/label/Identity%20Theft">identity-fraud</a> protection. </div>
</div>

Cloud Storage Cyber Attack Data Leak Hacking News News Western Union Western Union Money Transfer, Hacked

Western Union Money Transfer, Hacked Western Union has confirmed one of its IT suppliers was hacked, and that customer information ...

Zero-day vulnerability found in Telegram

2/13/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA-cNL6Fal2i1LFz43EYL7drbl57ZLgqrdAbHhdmybDGTagsG4C6Qvx_TTS5FgwQx7SMTlAIX-brWQ4pHGnAotzHZDZF_fKnWxDOBkGxr8sFLhQOXyGuoQVR0h06wHrsIZ_FwwcA0hfPX1/s1600/telegram-zeroday-vulnerability.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="466" data-original-width="732" height="404" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjA-cNL6Fal2i1LFz43EYL7drbl57ZLgqrdAbHhdmybDGTagsG4C6Qvx_TTS5FgwQx7SMTlAIX-brWQ4pHGnAotzHZDZF_fKnWxDOBkGxr8sFLhQOXyGuoQVR0h06wHrsIZ_FwwcA0hfPX1/s640/telegram-zeroday-vulnerability.png" width="640" /></a></div>
<br />
Research conducted by Kaspersky showed that the zero-day flaw was based on the <a href="https://www.fileformat.info/info/unicode/char/202e/index.htm" target="_blank">RLO </a>(right-to-left override) Unicode method, which is generally used for coding languages written from right to left, such as Arabic and Hebrew. However, it can also be used by hackers to dupe unknowing recipients into downloading malware, for example disguised as images.<br />
<br />
Kaspersky analysts identified “several scenarios of <a href="http://www.hackerschronicle.com/search/label/Zero-Day" target="_blank">zero-day</a> exploitation in the wild by threat actors.” The threats identified were two-fold. First, the exploit was used to deliver mining software, allowing hackers to use the victim’s machine to mine <a href="http://www.hackerschronicle.com/search/label/CryptoCurrency" target="_blank">cryptocurrency </a>including “Monero, Zcash, Fantomcoin and others.”<br />
<br />
Second, a backdoor was installed allowing <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime" target="_blank">cybercriminals </a>to gain remote access to the victim’s computer after which it started to “operate in a silent mode,” allowing “the threat actor to remain unnoticed in the network and execute different commands, including the further installation of spyware tools.”<br />
<br />
Kaspersky says its analysis suggests the cybercriminals are of <a href="http://www.hackerschronicle.com/search/label/Russian%20Hackers" target="_blank">Russian </a>origin, and the company has offered some tips to protect your PC against attack.  These include not downloading and opening unknown files from untrusted sources, avoiding sharing sensitive personal information in messenger apps and making sure to have reliable antivirus software installed on your machine.<br />
<br />
It appears that only Russian cybercriminals were aware of this <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerability</a>, with all the exploitation cases that we detected occurring in Russia. Also, while conducting a detailed research of these attacks we discovered a lot of artifacts that pointed to involvement by Russian cybercriminals.</div>

Hacking News Malwares News Russian Hackers Telegram Vulnerability Zero-Day Zero-day vulnerability found in Telegram

Research conducted by Kaspersky showed that the zero-day flaw was based on the RLO (right-to-left override) Unicode method, which is gen...

New AndroRAT found, exploiting Rooting Vulnerability

2/13/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQaGho1rE0MYQqEGOAPLEjLxhg3aSXXE0WWpln3Vjy1GTlEcjUDJ9AR4Hwe1Gy-XrSiCg-avCQOt8RYwD6MABqpfekK-k-HBHikdwSv3Kdk1s8kVsu9TgZX4r-m90syf-YyYRwJ_o14zI/s1600/AndroRAT_malware.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="468" data-original-width="888" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQaGho1rE0MYQqEGOAPLEjLxhg3aSXXE0WWpln3Vjy1GTlEcjUDJ9AR4Hwe1Gy-XrSiCg-avCQOt8RYwD6MABqpfekK-k-HBHikdwSv3Kdk1s8kVsu9TgZX4r-m90syf-YyYRwJ_o14zI/s640/AndroRAT_malware.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">New AndroRAT found, exploiting Rooting Vulnerability</td></tr>
</tbody></table>
<br />
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
Trend Micro detected a new variant of Android Remote Access Tool (AndroRAT) (identified as ANDROIDOS_ANDRORAT.HRXC) that has the ability to inject root exploits to perform malicious tasks such as silent installation, shell command execution, WiFi password collection, and screen capture. This AndroRAT targets <a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1805">CVE-2015-1805</a>, a publicly disclosed vulnerability in 2016 that allows attackers to penetrate a number of older Android devices to perform its privilege escalation.</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
RATs have long been a common Windows threat, so <b>it shouldn't be a surprise that it has come to Android</b>. A RAT has to gain root access — usually by exploiting a <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerability </a>— in order to have control over a system.<b> Discovered in 2012, </b>the original authors intended AndroRAT — <a href="https://forum.xda-developers.com/android/apps-games/androrat-remote-administration-tool-t2734932">initially a university project </a>— as an open-source client/server application that can provide remote control of an <a href="http://www.hackerschronicle.com/search/label/Android">Android </a>system, which naturally attracted cybercriminals.</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
This new variant of AndroRAT disguises itself as a malicious utility app called TrashCleaner, which is presumably downloaded from a malicious URL. The first time TrashCleaner runs, it prompts the Android device to install a Chinese-labeled calculator app that resembles a pre-installed system calculator. Simultaneously, the TrashCleaner icon will disappear from the device’s UI and the RAT is activated in the background.</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhG_dFWhyphenhyphenokqpobyjnG8ynbQ2gJGlFK11zcZUGVZRcQluN7XUjJKE6QJpM4_oZDL2slP-VbLmcPWQauu9k4m40AcPBCGEsahR95UiL8Ah3vKqdsfZryffr1jZCtX67C1F_fL7P398YFAi0/s1600/TrachCleaner.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="139" data-original-width="129" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhG_dFWhyphenhyphenokqpobyjnG8ynbQ2gJGlFK11zcZUGVZRcQluN7XUjJKE6QJpM4_oZDL2slP-VbLmcPWQauu9k4m40AcPBCGEsahR95UiL8Ah3vKqdsfZryffr1jZCtX67C1F_fL7P398YFAi0/s1600/TrachCleaner.jpg" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Icon of the malicious TrashCleaner</td></tr>
</tbody></table>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4YyKssi2ASFC2VtKhwr6OrsRdetN-0OFhEBujZLtuPEGGny5IfUh71z7WEPt08JFrb8zUcBwui-oAZNQRq3XMwXyJXF0DvV4EYLS3duKHxSMFHvtq_lPCEk55mbE13HhuZvkWrdQoE3Q/s1600/AndroRAT_Calculator.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="147" data-original-width="111" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4YyKssi2ASFC2VtKhwr6OrsRdetN-0OFhEBujZLtuPEGGny5IfUh71z7WEPt08JFrb8zUcBwui-oAZNQRq3XMwXyJXF0DvV4EYLS3duKHxSMFHvtq_lPCEk55mbE13HhuZvkWrdQoE3Q/s1600/AndroRAT_Calculator.jpg" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Icon of the Chinese-labeled calculator app</td></tr>
</tbody></table>
</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
The configurable RAT service is controlled by a remote server, which could mean that commands may be issued to trigger different actions. The variant activates the embedded root exploit when executing privileged actions. It performs the following malicious actions found in the original AndroRAT:</div>
<ul style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin: 0px 0px 0px 30px; outline: 0px; padding: 0px; vertical-align: baseline;">
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Record audio</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Take photos using the device camera</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of system information such as phone model, number, IMEI, etc.</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of WiFi names connected to the device</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of call logs including incoming and outgoing calls</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of mobile network cell location</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of GPS location</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of contacts list</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of files on the device</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of list of running apps</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of SMS from device inbox</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Monitor incoming and outgoing SMS</li>
</ul>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
Apart from the original features of the <a href="http://www.hackerschronicle.com/search/label/AndroRAT">AndroRAT</a>, it also performs new privileged actions:</div>
<ul style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin: 0px 0px 0px 30px; outline: 0px; padding: 0px; vertical-align: baseline;">
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of mobile network information, storage capacity, rooted or not</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of list of installed applications</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of web browsing history from pre-installed browsers</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of calendar events</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Record calls</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Upload files to victim device</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Use front camera to capture high resolution photos</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Delete and send forged SMS</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Screen capture</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Shell command execution</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Theft of WiFi passwords</li>
<li style="background: transparent; border: 0px; list-style: disc; margin: 0px; outline: 0px; padding: 0px 0px 5px; vertical-align: baseline;">Enabling accessibility services for a key logger silently</li>
</ul>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><i style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Targeting CVE-2015-1805</i></b></div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
Google already <a href="https://source.android.com/security/advisory/2016-03-18">patched </a>CVE-2015-1805 in March 2016,<b> but devices that no longer receive patches or those with a long rollout period are at risk of being compromised by this new AndroRAT variant. </b> Older versions of Android, which are still being used by a significant number of mobile users, may still be vulnerable.</div>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
<b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><i style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Indicators of Compromise (IoCs)</i></b></div>
<table style="background: rgb(255, 255, 255); border-collapse: collapse; border-spacing: 0px; border: 1px solid rgb(228, 228, 228); color: #777777; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline; width: 619px;"><tbody style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">
<tr style="background: rgb(241, 241, 241); border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295"><b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">SHA256</b></td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108"><b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">App Label</b></td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187"><b style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;">Package Name</b></td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295">2733377c14eba0ed6c3313d5aaa51171f6aef5f1d559fc255db9a03a046f0e8f</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108">TrashCleaner</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187">com.cleaner.trashcleaner</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295">fde9f84def8925eb2796a7870e9c66aa29ffd1d5bda908b2dd1ddb176302eced</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108">TrashCleaner</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187">com.cleaner.trashcleaner</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295">2441b5948a316ac76baeb12240ba954e200415cef808b8b0760d11bf70dd3bf7</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108">TrashCleaner</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187">com.cleaner.trashcleaner</td></tr>
<tr style="background: transparent; border: 0px; margin: 0px; outline: 0px; padding: 0px; vertical-align: baseline;"><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="295">909f5ab547432382f34feaa5cd7d5113dc02cda1ef9162e914219c3de4f98b6e</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="108">TrashCleaner</td><td style="background: transparent; border: 1px dotted rgb(228, 228, 228); margin: 0px; outline: 0px; padding: 8px; text-align: center; vertical-align: baseline; word-break: break-word !important;" width="187">com.cleaner.trashcleaner</td></tr>
</tbody></table>
<div style="background: rgb(255, 255, 255); border: 0px; color: #666666; font-family: Arial, sans-serif; font-size: 14px; line-height: 21px; margin-bottom: 10px !important; outline: 0px; padding: 0px; vertical-align: baseline;">
<br /></div>
</div>

Android AndroRAT Hacking News Malwares News rat Rooting Trojan Vulnerability New AndroRAT found, exploiting Rooting Vulnerability

New AndroRAT found, exploiting Rooting Vulnerability Trend Micro detected a new variant of Android Remote Access Tool (AndroRAT) (ide...

Winter Olympics website Hacked

2/12/2018 The Hackers Chronicle 0

Hacking News News Olympics Winter Olympics website Hacked

Winter Olympics website hacked The Pyeongchang 2018 Winter Olympics' website went down just before the event's Friday openi...

Millions of Netgear Routers Vulnerable

2/11/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="float: right; margin-left: 1em; text-align: right;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9Z1CuHPFx2gWwQnNmtt8u5RYO91uU3Cmb3Q5n9oefAJZR5kN-2QD85zJtbCtcL5WUEIeoeLjNvbBF0S_5111uomZufNqA48_3KEQ8RdbTAU3Y5fGt5P15xplZwYI0On9237wkjEkdGn1k/s1600/router_back_label.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="" border="0" data-original-height="192" data-original-width="750" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi9Z1CuHPFx2gWwQnNmtt8u5RYO91uU3Cmb3Q5n9oefAJZR5kN-2QD85zJtbCtcL5WUEIeoeLjNvbBF0S_5111uomZufNqA48_3KEQ8RdbTAU3Y5fGt5P15xplZwYI0On9237wkjEkdGn1k/s1600/router_back_label.png" title="Netgear Routers wonderable to be Hacked" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Netgear Routers wonderable to be Hacked</td></tr>
</tbody></table>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEincWcxLWVnPBm6fA4JIuoYKibbxMKRm2oSGclVczATNSqHZGWsAHd-6J6LYOIejPQh99u2fEsB0E8bl3mPGUCNYEx341q3-rSCJJ9U_2QFSU3eD8t0dE4m3sjdsgXMZD9Pg3B8IbMlRfSS/s1600/netgear_password_bypass.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="400" data-original-width="680" height="188" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEincWcxLWVnPBm6fA4JIuoYKibbxMKRm2oSGclVczATNSqHZGWsAHd-6J6LYOIejPQh99u2fEsB0E8bl3mPGUCNYEx341q3-rSCJJ9U_2QFSU3eD8t0dE4m3sjdsgXMZD9Pg3B8IbMlRfSS/s320/netgear_password_bypass.png" width="320" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Netgear Routers</td></tr>
</tbody></table>
<br />
<strong><span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Security firm Trustwave has disclosed the details of several vulnerabilities affecting Netgear routers, including devices that are top-selling products on Amazon and Best Buy.</span></span></strong><br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The flaws were discovered by researchers in March 2017 and they were patched by Netgear in August, September and October.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">One of the high severity vulnerabilities has been described as a password recovery and file access issue affecting 17 Netgear routers and modem routers, including best-sellers such as R6400, R7000 (Nighthawk), R8000 (Nighthawk X6), and R7300DST (Nighthawk DST).</span></span></div>
<br />
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">According to Trustwave, the web server shipped with these and other Netgear routers has a resource that can be abused to access files in the device’s root directory and other locations if the path is known. The exposed files can store administrator usernames and passwords, which can be leveraged to gain complete control of the device.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">An unauthenticated attacker can exploit the flaw remotely if the remote management feature is enabled on the targeted device. Improperly implemented cross-site request forgery (CSRF) protections may also allow remote attacks.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";"><b>Another high severity flaw affecting 17 Netgear routers, including the aforementioned best-sellers, can be exploited by an attacker to bypass authentication using a specially crafted reques</b>t. Trustwave said the vulnerability can be easily exploited.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">A flaw that can be exploited to execute arbitrary OS commands with root privileges without authentication has also been classified as high severity. Trustwave said command injection is possible through a chained attack that involves a CSRF token recovery vulnerability and other weaknesses.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Two other command injection vulnerabilities have been found by Trustwave researchers, but they have been rated medium severity and they only affect six Netgear router models.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">One of the flaws requires authentication, but experts pointed out that an attacker can execute arbitrary commands after bypassing authentication using the aforementioned authentication bypass vulnerability.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">The other medium severity command injection is related to the Wi-Fi Protected Setup (WPS). When a user presses the WPS button on a Netgear router, a bug causes WPS clients to be allowed to execute arbitrary code on the device with root privileges during the setup process.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">“In other words, <b>if an attacker can press the WPS button on the router, the router is completely compromised</b>,” Trustwave said in an advisory.</span></span></div>
<div style="background-color: white; color: #333333; font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12px;">
<span style="font-size: small;"><span style="font-family: "trebuchet ms" , "geneva";">Netgear has put a lot of effort into securing its products, especially since the launch of its bug bounty program one year ago. In 2017, the company published more than 180 security advisories describing vulnerabilities in its routers, gateways, extenders, access points, managed switches, and network-attached storage (NAS) products.</span></span></div>
</div>

Hacking News Netgear Routers News Vulnerability Millions of Netgear Routers Vulnerable

Netgear Routers wonderable to be Hacked Netgear Routers Security firm Trustwave has disclosed the details of several vulnerabilit...

'Biggest Leak in History' : iPhone source code LEAKED

2/08/2018 The Hackers Chronicle 0

Data Leak iOS News Source Code 'Biggest Leak in History' : iPhone source code LEAKED

'Biggest Leak in History' : iPhone source code leaked Someone just posted what experts say is the source code for a core comp...

Fake tech support scam : Google Chrome users be Alert

2/07/2018 The Hackers Chronicle 0

Google Chrome Hacking News News Scam Fake tech support scam : Google Chrome users be Alert

Fake tech support scam : Google Chrome users be Alert Tech support scams are increasingly hitting Windows users on the Google Chrome br...

Millions of health records, LEAKED

6/28/2016 cyb3r.gladiat0r 0

Darknet Data Leak Hacking News Identity Theft News Millions of health records, LEAKED

The dark web seller has four batches of data, going for close to $1 million in bitcoin. A hacker is advertising hundreds of thousands...

RCE, Information Disclosure and XSS Flaws Found in PayPal

4/15/2014 cyb3r.gladiat0r 4

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuIwDgMNaan2uhQRa6VZRiUWTr7JTxgzIBKLz-HDBPC4RznLPMoODa6G5BeZfIo1MifcSy-nP72XWL_DHOY8DwNS8DiHOsRrkhGL1_ilr16MwDXTioCptQS659nbw7bwNvhKfBPK8iKaA/s1600/RCE-Information-Disclosure-and-XSS-Flaws-Found-in-PayPal-Partner-Program-Video.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="RCE, Information Disclosure and XSS Flaws Found in PayPal " border="0" height="218" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiuIwDgMNaan2uhQRa6VZRiUWTr7JTxgzIBKLz-HDBPC4RznLPMoODa6G5BeZfIo1MifcSy-nP72XWL_DHOY8DwNS8DiHOsRrkhGL1_ilr16MwDXTioCptQS659nbw7bwNvhKfBPK8iKaA/s1600/RCE-Information-Disclosure-and-XSS-Flaws-Found-in-PayPal-Partner-Program-Video.jpg" title="RCE, Information Disclosure and XSS Flaws Found in PayPal " width="400" /></a></div>
<br />
A security expert has managed to identify three <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerabilities</a> on <a href="http://paypal-marketing.com/">paypal-marketing.com</a>, the website used by the payment processor for the <a href="http://www.hackerschronicle.com/search/label/PayPal">PayPal</a> Partner Program.<br />
<br />
Behrouz Sadeghipour has found and reported a <a href="http://www.hackerschronicle.com/search/label/XSS">cross-site scripting (XSS)</a> issue, a <a href="http://www.hackerschronicle.com/search/label/Remote%20Code%20Execution">remote code execution</a> flaw and an <a href="http://www.hackerschronicle.com/search/label/Information%20Disclosure">information disclosure vulnerability</a>.<br />
<br />
Initially, the researcher found the XSS flaw, which he reported to PayPal’s security team on March 19. The XSS was addressed on April 9.<br />
<br />
One day after the XSS was fixed, Sadeghipour identified an information disclosure issue, which he later leveraged for remote code execution. The expert said he was looking for an SQL Injection bug, but he found an RCE instead.<br />
<br />
To demonstrate the existence of the RCE to PayPal, he sent the company’s security team three links showing that he could retrieve the Process ID (PID), the script owner’s Group ID (GID) and the script owner’s User ID (UID) by replacing a parameter in the request with <a href="http://www.hackerschronicle.com/search/label/PHP">PHP</a> commands.<br />
<br />
By April 11, PayPal had addressed the vulnerability. The company has promised to reward the researcher in the next payment cycle.<br />
<br />
Sadeghipour highlights that the RCE he has found is a remote code execution, not a remote command execution bug. This vulnerability allows an attacker to run PHP functions. The flaw produces the same sort of results, but by leveraging PHP.<br />
<br />
Check out the proof-of-concept video for the PayPal Partner Program vulnerabilities. Additional technical details are available on <a href="http://nahamsec.com/2014/04/paypal-marketing-remote-code-execution/">Behrouz Sadeghipour's blog</a>.<br />
<iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/BB3rSd_muBc" width="560"></iframe><br />
Source: <a href="http://softpedia.com/">Softpedia</a></div>

RCE, Information Disclosure and XSS Flaws Found in PayPal

Hacking News Information Disclosure News PayPal Remote Code Execution Vulnerability XSS RCE, Information Disclosure and XSS Flaws Found in PayPal

A security expert has managed to identify three vulnerabilities on paypal-marketing.com , the website used by the payment processor for...

SQL Injection vulnerability in Yahoo

4/08/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTL6tV9kV7M1jnMiGsqJkN05t-AAte545WWB5lT0nMMl0ySjeeSv-ygAOYGGJvzdimuyEVq_HIt9dcbu4rZcVtV_Z2PbTp21u8eEUudbExSQnpDf5ZFe1jmLYBwiCnMTZz5yrKpNpBlAZ5/s1600/Expert-Finds-8-Files-Vulnerable-to-SQL-Injection-in-Yahoo.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Expert Finds 8 Files Vulnerable to SQL Injection in Yahoo HK Promotions Pages" border="0" height="351" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhTL6tV9kV7M1jnMiGsqJkN05t-AAte545WWB5lT0nMMl0ySjeeSv-ygAOYGGJvzdimuyEVq_HIt9dcbu4rZcVtV_Z2PbTp21u8eEUudbExSQnpDf5ZFe1jmLYBwiCnMTZz5yrKpNpBlAZ5/s1600/Expert-Finds-8-Files-Vulnerable-to-SQL-Injection-in-Yahoo.png" title="Expert Finds 8 Files Vulnerable to SQL Injection in Yahoo HK Promotions Pages" width="640" /></a></div>
<br />
Security researcher <strong>Behrouz Sadeghipour</strong> has identified several <a href="http://www.hackerschronicle.com/search/label/SQL%20Injection">SQL Injection</a> <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerabilities</a> in a Hong Kong subdomain of <a href="http://www.hackerschronicle.com/search/label/Yahoo">Yahoo</a>. He reported his findings to the company and all the security holes have been fixed.<br />
<br />
According to the expert, the flaws have been found in various files on the Hong Kong promotions subdomain (<a href="http://hk.promotions.yahoo.com/">hk.promotions.yahoo.com</a>). <br />
<br />
He decided to analyze this subdomain because it contains a lot of Flash files and PHP scripts that could be vulnerable, and it doesn’t appear that the pages have been created by Yahoo’s core developers. <br />
<br />
Furthermore, since the pages are in Chinese, it’s likely that they’re ignored by many auditors.<br />
<br />
The expert has managed to identify a total of eight vulnerable files. Following his analysis of the Yahoo HK promotions subdomain, Sadeghipour sent 5 reports to the company. <br />
<br />
The list of pages on which he found SQL Injection vulnerabilities includes the Emotive2012 page, the <a href="http://www.hackerschronicle.com/search/label/Nikon">Nikon</a> Photo Itinerary page, and the Education page. By leveraging these bugs, the researcher managed to gain access to names, email addresses and other information.<br />
<br />
Yahoo addressed the issues within a month after being reported. The expert has told me that the company has removed the vulnerable files. <br />
<br />
As some of our readers might know, this isn’t the first time <strong>Sadeghipour</strong> finds serious vulnerabilities in Yahoo’s Hong Kong subdomains. Last month, he identified a <a href="http://www.hackerschronicle.com/2014/03/remote-code-execution-in-yahoo.html">remote code execution flaw</a>.<br />
<br />
At the time, he found an administrator panel for the hk.yahoo.net subdomain that could be accessed with <span class="highlight pop">admin/admin</span> credentials. <br />
<br />
For additional details on the SQL Injection vulnerabilities found in Yahoo, check out <a href="http://nahamsec.com/2014/04/yahoo-sql-injection/">Behrouz Sadeghipour‘s blog</a>. You can also check out the proof-of-concept videos he made for a couple of the flaws:<br />
<iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/8MuWtVqj4iU" width="560"></iframe><br />
<br />
<iframe allowfullscreen="" frameborder="0" height="315" src="//www.youtube.com/embed/8HN-91UxUh8" width="560"></iframe><br /></div>

Hacking News News SQL Injection Vulnerability Yahoo SQL Injection vulnerability in Yahoo

Security researcher Behrouz Sadeghipour has identified several SQL Injection vulnerabilities in a Hong Kong subdomain of Yahoo . He...

Syrian cyber space attacked, 60,000 accounts leaked

4/07/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_suIU5kyLsjT9DcN83rBXHHzojnYXZs8Hc1NrXyTDIkP2dT0afL1Izbq25PNpPokaCF2_JsuqVnXwtVwywleTEn8Lkwe7_q_v3WwnNslS352nDklaCv2fS53zdDhew6nglXlA_-accm1m/s1600/Syrian+cyber+space+attacked.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="60,000 Personal Credentials Leaked From Syrian Sites" border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj_suIU5kyLsjT9DcN83rBXHHzojnYXZs8Hc1NrXyTDIkP2dT0afL1Izbq25PNpPokaCF2_JsuqVnXwtVwywleTEn8Lkwe7_q_v3WwnNslS352nDklaCv2fS53zdDhew6nglXlA_-accm1m/s1600/Syrian+cyber+space+attacked.jpeg" title="60,000 Personal Credentials Leaked From Syrian Sites" width="320" /></a></div>
<br />
<div dir="ltr" style="text-align: left;" trbidi="on">
Today a hacker from the European Cyber Army going by the handle <a href="https://twitter.com/Zer0Pwn" target="_blank">@Zer0Pwn</a> has announced a leak of data from two syrian based websites job.sy, realestate.sy.<br />
<br />
<a href="http://pastebin.com/7Y13ULux">The leak</a> which is titled “ECA vs. Assad | Part 1″ was posted to <a href="http://pastebin.com/7Y13ULux">pastebin</a> with a preview of some of the users data and a link to <a href="http://www.sendspace.com/file/tqa737">sendspace</a>. The attack is apart of a bigger operation that is going on towards what the hackers are claim are pro-assad targets.<br />
<br />
The data leak has resulted in over 60,000 Accounts being dumped online and between the two databases are users credentials which have encrypted passwords for job.sy but plaintext for realestate.sy. Both databases have full user details such as full names, contact phone numbers and home addresses. On the march 30th career-sy.com appears to of been breached and <a href="http://pastebin.com/wLJhHNd8">posted to pastebin</a> as well with 3 administrator credentials as well as the vuln entry point and link for the control panel login which is located on the job.sy server which career-sy.com redirects to now.<br />
<br />
Some attacks by other ECA members have been carried out and posted to twitter by <a href="https://twitter.com/ECA_Legion">@ECA_Legion</a> with data being leaked from syrianmonster.com, a syrian hosting website, ddos attacks on sites like syria-courts.com, sana.sy and moj.gov.sy. banquecentrale.gov.sy. The leak of data from the realestate.sy database appears to have plaintext passwords to accounts linked to www.scs-net.org which is one of the job.sy official partners to making all three sites linked together or even owned and operated by the same people possibly.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdO8G4iadsahZXY49VR9drtCxc6EuyXWRF1fJR5lWpcqEanBamppxMQn6vBvMylr1-B5Rna-JKFPASq5VwhkJs0dsJL0War1afHEyJOQILblFg99dZA2bq9dZn4LDEYcIM9V8z-XLWllwr/s1600/eca-leak-example-file.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="60,000 Personal Credentials Leaked From Syrian Sites" border="0" height="65" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdO8G4iadsahZXY49VR9drtCxc6EuyXWRF1fJR5lWpcqEanBamppxMQn6vBvMylr1-B5Rna-JKFPASq5VwhkJs0dsJL0War1afHEyJOQILblFg99dZA2bq9dZn4LDEYcIM9V8z-XLWllwr/s1600/eca-leak-example-file.png" title="60,000 Personal Credentials Leaked From Syrian Sites" width="400" /></a></div>
<br />
Full dump info<br />
<br />
<a href="http://realestate.sy/">http://realestate.sy/</a><br />
<br />
File realestate.sy_users.sql<br />
File Contents:  3,257 Emails that are unique out of 3,517 Total emails Found.<br />
Information: Contains user names,email addresses, clear text passwords, full names, phone numbers, locations and site related information.<br />
<br />
File realestate.sy.sql<br />
File Contents: 4,912 Emails that are unique out of 13,223 Total emails Found.<br />
Information: Complete internal messaging system, site logs and administrator login logs with ips and cookie information.<br />
<br />
<a href="http://job.sy/">http://job.sy/</a><br />
<br />
File job.sy_users.sql<br />
File Contents: 50,017 Emails that are unique out of 52,483 Total emails Found. Included in the job.sy.sql file as well.<br />
Information: Contains user names, encrypted MD5 passwords, email addresses, home addresses and contact numbers and full names as well as other site related information.<br />
<br />
File job.sy.sql<br />
File Contents: 59,575 Emails that are unique out of 84,343 Total emails Found.<br />
Information: Contains logs with ip addresses and browser information, messages between job seekers and employees between, min resumes, job comments<br />
<br />
<a href="http://syrianmonster.com/">http://syrianmonster.com</a><br />
Only contains 1 administrator account with username and password.<br />
<br />
<a href="http://career-sy.com/">http://career-sy.com/</a><br />
3 administrator credentials with user names and encrypted passwords.</div>
</div>

Data Leak European Cyber Army Hacking News News Syrian cyber space attacked, 60,000 accounts leaked

Today a hacker from the European Cyber Army going by the handle @Zer0Pwn has announced a leak of data from two syrian based websites j...

GitHub under DDoS Attack

3/21/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4SJuTIBKWzzZyeE5rY1q-3V4zHR4PZ_xFuFmlaaG_TXzX6WCRrV6TBaYCEUY5Z1XDfOrGJM3tbmUCjWPZ2gb6cs-0dm-fusgc1yl7LGRgHjB4SYFYKAGitVKgsSimsmx-bPffRg-udhFy/s1600/github+under+ddos+attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub under DDoS Attack" border="0" height="153" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi4SJuTIBKWzzZyeE5rY1q-3V4zHR4PZ_xFuFmlaaG_TXzX6WCRrV6TBaYCEUY5Z1XDfOrGJM3tbmUCjWPZ2gb6cs-0dm-fusgc1yl7LGRgHjB4SYFYKAGitVKgsSimsmx-bPffRg-udhFy/s1600/github+under+ddos+attack.png" title="GitHub under DDoS Attack" width="400" /></a></div>
It’s pretty clear that <a href="https://github.com/" target="_blank">GitHub</a> is one of the favorite targets for <a href="http://www.hackerschronicle.com/search/label/DDoS">distributed denial-of-service</a> (DDOS) attacks. The service is currently facing another attack wave. <br />
<br />
“We are currently working to mitigate an incoming DDoS attack. We’ll provide additional information as it becomes available,” GitHub <a href="https://status.github.com/messages" target="_blank">wrote</a> just a few minutes ago.<br />
<br />
The code repository hasn’t shared any additional details in the meantime and may not even do so if the attack isn’t much more serious than the regular DDOS attacks targeting it.<br />
<br />
GitHub handles such situations so often that it has gotten so accustomed to mitigating them that access to the service is usually restored within about 20 minutes.<br />
<br />
The service is armed with enough weapons to handle volumetric and complex attacks, so everything should be back to normal in no time.<br />
<br />
Last week, they faced one of the biggest attacks in recent months and, as a result, GitHub started working on ways to improve its DDOS mitigating capabilities to make sure that even uncommon operations could be blocked quickly, so that users could get their service back.<br />
<br />
On March 11, the attack was so wide that GitHub went down for 2 hours, a lot more than the regular 20 minutes that people are used to.<br />
<br />
<strong>[UPDATE 1:]</strong> The efforts to reduce the number of legitimate users who are flagged as attack traffic continues.<br />
<br />
<strong>[UPDATE 2:]</strong> GitHub is back to working order. </div>

Cyber Crime DDoS GitHub Hacking News News GitHub under DDoS Attack

It’s pretty clear that GitHub is one of the favorite targets for distributed denial-of-service (DDOS) attacks. The service is currently...

Toyota, Renault and Chevrolet Hacked by Pakistani Hackers

3/19/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLm9kPncC30uf-n5pYPDb6Ub7tND2BmIeLKF9N69iYIY1FpKrSdsx76uKYg-dPLG1lwaf1Nf3XbG4yWyS3FdmMyLnRHS9_CwOy524PJ7hSUi-5uUOj6bC_eZYwJkFu2-NXuug907s7Gxmr/s1600/Toyota+hacked.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="131" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhLm9kPncC30uf-n5pYPDb6Ub7tND2BmIeLKF9N69iYIY1FpKrSdsx76uKYg-dPLG1lwaf1Nf3XbG4yWyS3FdmMyLnRHS9_CwOy524PJ7hSUi-5uUOj6bC_eZYwJkFu2-NXuug907s7Gxmr/s1600/Toyota+hacked.PNG" width="320" /></a></div>
<em><a href="http://zone-h.com/archive/notifier=Algeriano" target="_blank">Algeriano</a></em> a hacker from Team Cyber Criminals a group of <a href="http://www.hackerschronicle.com/search/label/Pakistani%20Hackers" target="_blank">Pakistani hackers</a> hacked worlds leading automobile companies domains reserved for Guatemala including <a href="http://www.toyota.com.gt/" target="_blank">Toyota</a> , <a href="http://www.renault.com.gt/" target="_blank">Renault</a> and <a href="http://www.chevrolet.com.gt/" target="_blank">Chevrolet</a> , Attacker didn't mention any reason to deface websites. <br />
<br />
“Hacked by Algeriano. TOYOTA & RENAULT & CHEVROLET Guatemala hacked. Cyber Criminals Was Here,” the attacker wrote on the defaced websites.<br />
<br />
This message indicates that the hacker simply wanted to show off. The sites don’t appear to be storing any sensitive customer information. However, such an attack can still impact a company’s image.<br />
<br />
At the time of writing, all of the websites have been restored. They appear to have been restored within 24 hours after the breach took place. <a href="http://zone-h.com/mirror/id/22028173" target="_blank">Mirrors of the defacements</a> are available on Algeriano’s zone-h.org page. <br />
In this case, all of the three websites appear to have been developed by the same company for a car distributor. The most likely scenario is that the sites have been plagued by the same <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerability</a>, which the hacker easily exploited to deface them. <br />
<br />
Hopefully, the company that manages the sites has addressed the security holes, but it’s unlikely. The <a href="http://zone-h.com/archive/domain=www.toyota.com.gt" target="_blank">Toyota Guatemala website was previously defaced</a> back in 2009, 2011 and 2013 by various hackers.
</div>

Defacement Hacking News News Pakistani Hackers Toyota, Renault and Chevrolet Hacked by Pakistani Hackers

Algeriano a hacker from Team Cyber Criminals a group of Pakistani hackers hacked worlds leading automobile companies domains reserved f...

Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked

3/13/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSc38Udf3xr3eXGsPIfcHYsnwXkWGpSjIKk7zEtBgsPUMf0OYq9HBSke737pUoIo_O1FCoIvO6rrmjxw7uwvGyFmNvLnK6MYLt0noFVK_XHTvr3zzfARvFo7560r1kTZiNPcYqNUhBaaxi/s1600/russian+intel+&+spy+hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked" border="0" height="228" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhSc38Udf3xr3eXGsPIfcHYsnwXkWGpSjIKk7zEtBgsPUMf0OYq9HBSke737pUoIo_O1FCoIvO6rrmjxw7uwvGyFmNvLnK6MYLt0noFVK_XHTvr3zzfARvFo7560r1kTZiNPcYqNUhBaaxi/s1600/russian+intel+&+spy+hacked.png" title="Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked" width="320" /></a></div>
<br />
Today Russian hacktivist <a href="https://twitter.com/Rucyborg" target="_blank">@Rucyborg</a> has announced a leak of data from Searchinform and sent a message out to its director.<br />
The leak was <a href="https://twitter.com/Rucyborg/status/443468396068610050" target="_blank">announced</a> a couple of hours ago via twitter and posted to <a href="http://cyberguerrilla.org/" target="_blank">cyberguerrilla.org</a> with a message which states that the hackers have had access to <a href="http://searchinform.ru/" target="_blank">searchinform.ru</a> since as far back as 2012 and that they have infected  download links. The leak was uploaded to <a href="http://bayfiles.net/file/18L8Z/dICvHg/sinformru.rar" target="_blank">bayfiles</a> and is part 2 of an <a href="http://www.hackerschronicle.com/2014/03/cyber-attacks-on-ukraine.html" target="_blank">on going assault on Russia</a> in relation to the recent drama that putin has been creating.<br />
<a href="http://searchinform.com/about/full-text-search-company.html" target="_blank">Searchinform</a> is one of them sneaky company’s with an even more sneaky product which allows snooping on others, while in this day and age is not so surprising but the extent which they do go to is pretty extensive and really does pose a huge security risk to one if the wrong person was to be using it. They offer work time monitors, full-on network sniffers designed at modern day communications over social medias, microphone sniffers for recording employees and a <a href="http://searchinform.com/main/full-text-search-information-security-product.html" target="_blank">whole range of other products</a>.<br />
Data leaked is in a 382MB compressed file that contains well over 3000 files which include instructions and usage information, also it appears to have copies of searchinform for clients and basic new client setup information. In normal fashion there has been a <a href="http://searchinform.com/main/full-text-search-information-security-product.html" target="_blank">imgur gallery</a> created with a preview of the contents of this leak which can be found below, i have also added a couple of screen shots of the contents of the uncompressed leak data.<br />
The message on  <a href="http://cyberguerrilla.org/" target="_blank">cyberguerrilla.org</a> also has a direct message for the CEO of SearchInform.<br />
<div class="content shadow-radial">
Our message to SearchInform.ru – director Ozhegov – you are a bunch of FSB bastadz – leaking information to all the counterparts and outsiders – you provide so called CONTUR of Security to main russian corps – and keep control of all the clients for the SORM needs – nonight – the stars – revolt- and this is your downfall.<br />
<br /></div>
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEierGuWF0ZT_jlPTTeEtxfBHmbTDCQ30xJ1_shNlryML2vBgzJcTvAg11PWsRaNSim_o8sOvfMad2HYnMYDyUqfo-_9gVEtv5RD_7aZw4FS5N71u6N5x3aZmGt0fXSAEGrWYhsBE8oEWmy2/s1600/russian+intel+hacked.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="200" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEierGuWF0ZT_jlPTTeEtxfBHmbTDCQ30xJ1_shNlryML2vBgzJcTvAg11PWsRaNSim_o8sOvfMad2HYnMYDyUqfo-_9gVEtv5RD_7aZw4FS5N71u6N5x3aZmGt0fXSAEGrWYhsBE8oEWmy2/s320/russian+intel+hacked.jpg" width="131" /></a><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEpVyw59Ltm0ePqb65Zo4axd_qtlVrhoDMo58LX6pKo3Ba3qUuvggz4hxocgD42AuCPFSWgbB-5fztsvwXksPJp0nulc-1z4hrc9jq3KC1jaLd4SUWhqrL9SWgEVMmiZZNkc-tSCPuQIQb/s1600/russian+spy+hacked.jpg" imageanchor="1" style="clear: right; display: inline !important; margin-bottom: 1em; margin-left: 1em;"><img border="0" height="183" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgEpVyw59Ltm0ePqb65Zo4axd_qtlVrhoDMo58LX6pKo3Ba3qUuvggz4hxocgD42AuCPFSWgbB-5fztsvwXksPJp0nulc-1z4hrc9jq3KC1jaLd4SUWhqrL9SWgEVMmiZZNkc-tSCPuQIQb/s320/russian+spy+hacked.jpg" width="400" /></a></div>
</div>

Data Leak Hacking News News Rucyborg Russian Hackers Russian Intelligence and Spy Company SearchInform Hacked, Data Leaked

Today Russian hacktivist @Rucyborg has announced a leak of data from Searchinform and sent a message out to its director. The leak wa...

Russia attacks Ukraine with cyber weapon, Snake

3/09/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufqwMk63tMR0xjp5-I1wm07WieL4DbAf_bk96E2khr9KyudVRIG7ss6m8pp6AECyuICHtMbzZBnTJbC5evBnEdcvHbONe8w43iifpTms1XeWoqt4R9GKYc86CVdIlOg_6VrCfI6cXJ36/s1600/Ukraine-cyber-attack.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Ukraine's Computers attcked with a Virus, Snake similar to Stuxnet" border="0" height="212" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkufqwMk63tMR0xjp5-I1wm07WieL4DbAf_bk96E2khr9KyudVRIG7ss6m8pp6AECyuICHtMbzZBnTJbC5evBnEdcvHbONe8w43iifpTms1XeWoqt4R9GKYc86CVdIlOg_6VrCfI6cXJ36/s1600/Ukraine-cyber-attack.jpg" title="Ukraine's Computers attcked with a Virus, Snake similar to Stuxnet" width="320" /></a></div>
<br />
Dozens of computer networks in Ukraine have been infected by an aggressive new cyber weapon called <a href="http://www.hackerschronicle.com/search/label/Snake" target="_blank">Snake</a>, according to expert analysis.<br />
 The cyber weapon has been increasingly used since the start of this year, even before protests that led to the overthrow of president Viktor Yanukovych, British-based <a href="http://en.wikipedia.org/wiki/BAE_Systems" rel="nofollow" target="_blank">BAE Systems</a> said in a report published Friday.<br />
 The complex composition of <a href="http://www.hackerschronicle.com/search/label/Snake" target="_blank">Snake</a> bears similarities with <a href="http://www.hackerschronicle.com/search/label/Stuxnet" target="_blank">Stuxnet</a>, the <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware</a> that disrupted Iran's nuclear facilities in 2010.<br />
Snake—also known as Ouroboros after the serpent in Greek mythology—gives remote attackers "full remote access to the compromised system", BAE said.<br />
Because it can stay inactive for a number of days, it is extremely hard to detect.
Although its origins are unclear, its developers appear to operate it in the same timezone as Moscow—GMT plus four hours—and some <a href="http://www.hackerschronicle.com/search/label/Russian%20Hackers" target="_blank">Russian</a> text is embedded into the code, BAE says.
BAE has identified 14 cases of Snake in Ukraine since the start of 2014, compared to eight cases in the whole of 2013. In all there have been 32 reported cases in <a href="http://www.hackerschronicle.com/search/label/Ukraine" target="_blank">Ukraine</a> since 2010, out of 56 worldwide.<br />
 Nigel Inkster, who until 2006 was the head of operations and intelligence at Britain's MI6 foreign intelligence agency, said Russia was most likely behind the cyber-attacks on Ukraine.<br />
"If you look at it in probabilistic terms... then the list of suspects boils down to one, he told the Financial Times.
"Until recently the Russians have kept a low profile, but there's no doubt in my mind that they can do the full scope of cyber attacks, from denial of service to the very, very sophisticated."</div>

Hacking News Malwares News Russian Hackers Snake Stuxnet Ukraine Russia attacks Ukraine with cyber weapon, Snake

Dozens of computer networks in Ukraine have been infected by an aggressive new cyber weapon called Snake , according to expert analysis....

Personal info of 12 million KT customers Leaked

3/08/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEichfGTVKfClvK_w94PRErJUgAnXvPyNPCkHHyAC182eQnqMQBbjFPrSG3opGqeGaewCyarqeZyb5CcNeSJB_LLOnFjZ3Ir5clrR1sP_kCse6-WS2DFFg9oH3W85zl3ZUm7VRwdETl4y8Bp/s1600/KT-data-leak.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Personal info of 12 million KT customers Leaked" border="0" height="179" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEichfGTVKfClvK_w94PRErJUgAnXvPyNPCkHHyAC182eQnqMQBbjFPrSG3opGqeGaewCyarqeZyb5CcNeSJB_LLOnFjZ3Ir5clrR1sP_kCse6-WS2DFFg9oH3W85zl3ZUm7VRwdETl4y8Bp/s1600/KT-data-leak.png" title="Personal info of 12 million KT customers Leaked" width="320" /></a></div>
<br />
Two men have been arrested in connection with the massive KT Corp. data breach that resulted in the theft of personal and financial information of some 12 million customers of the South Korean telecom giant.<br />
According to the <a href="http://edition.cnn.com/2014/03/06/business/south-korea-telecoms-hackers" target="_blank">CNN</a>, one of the arrested men, a 29-year-old surnamed Kim, was a hacker who broke into the company's computer system with customized hacking software and extracted customer information such as names, resident registration numbers and bank account information.<br />
The initial breach apparently happened in February 2013, and he has been extracting the data ever since. He allegedly sold it to a 37-year-old man surnamed Park, a telemarketing business owner that used the information to credibly impersonate a KT Corp. employee in order to sell cell phones.<br />
Another man has been arrested but almost immediately released.<br />
Apparently, in the last year, they managed to earn themselves nearly $11 million through this scheme.<br />
KT is cooperating with the police as the investigation continues, and will be forced to set up a website its users can visit to check whether their information has been compromised, the Yonhap News Agency <a href="http://english.yonhapnews.co.kr/business/2014/03/07/17/0501000000AEN20140307000900320F.html" target="_blank">reported</a>.<br />
The South Korean Ministry of Science, ICT and Future Planning is warning potentially affected users to be on the lookout for phishing emails impersonating the company and taking advantage of the situation to make them share more personal details.
</div>

Cyber Crime Data Leak Hacking News Korean Hackers News Privacy Personal info of 12 million KT customers Leaked

Two men have been arrested in connection with the massive KT Corp. data breach that resulted in the theft of personal and financial info...

Russian Defence Hacked, 500+MB Data Leaked

3/06/2014 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOflRQn5hAdjYc6YeeCb31T1Apix8GJ46RKRFwXVksjDRg_09tVZB-_GeDWpeEf0Lm3MLZ2gKrDPRpx3lM8-WTX2ivOW3gkME_440Dap1bgzrgZku_aZ2qFAcgZ-Yg_Sl6fCqAUve5MMrA/s1600/russian-defence-hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Russian Defence Export Hacked" border="0" height="71" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjOflRQn5hAdjYc6YeeCb31T1Apix8GJ46RKRFwXVksjDRg_09tVZB-_GeDWpeEf0Lm3MLZ2gKrDPRpx3lM8-WTX2ivOW3gkME_440Dap1bgzrgZku_aZ2qFAcgZ-Yg_Sl6fCqAUve5MMrA/s1600/russian-defence-hacked.png" title="Russian Defence Hacked" width="400" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
Today Russian hacktivist <a href="https://twitter.com/Rucyborg" target="_blank">Rucyborg</a> has announced a big leak of files from Russian Defence Export ROSOBORONEXPORT (<a href="http://www.roe.ru/" target="_blank">http://www.roe.ru/</a>).<br />
The leak was announced just a short time ago from twitter and has been posted to <a href="https://www.cyberguerrilla.org/blog/?p=17581" target="_blank">cyberguerrilla</a>. The leaked files are just the first part of a few to come from the Russian government.<br />
The attacks have been carried out due to the recent drama Putin is causing and the Russian hackers have stated they do not want any war all they want to do is expose Putin and his government for what they are.<br />
they have also stated that leaks from <a href="https://en.wikipedia.org/wiki/Sukhoi" target="_blank">Sukhoi</a>, <a href="https://en.wikipedia.org/wiki/Oboronprom" target="_blank">Oboronprom</a>, <a href="http://eng.gazflot.ru/" target="_blank">Gazflot</a>, <a href="http://eng.gazflot.ru/" target="_blank">Rusal</a> and others.<br />
The leaked data has been uploaded to <a href="http://bayfiles.net/file/18nWT/NHiWky/rusarms.rar" target="_blank">bayfiles</a> as a 488MB rar file and a <a href="http://bayfiles.net/file/18nWT/NHiWky/rusarms.rar">preview</a> of the leaked documents has also been provided.<br />
<div>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3UbsoF_nnfmXkzISesJ79ayr6pS_VH2xdqCHbcjEOwc8lPmcfjpnlIgzH_U0elX5qMbLf-Tu79cfJNUo8t56Xzttmvj7R7A0neJuC0fC4O5hKOTMEPPKWpiGrDLGvJ4BAkjlS0MtZnn9n/s1600/roe-mil-leak-1.jpg" imageanchor="1" style="clear: left; float: left; margin-bottom: 1em; margin-right: 1em;"><img border="0" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh3UbsoF_nnfmXkzISesJ79ayr6pS_VH2xdqCHbcjEOwc8lPmcfjpnlIgzH_U0elX5qMbLf-Tu79cfJNUo8t56Xzttmvj7R7A0neJuC0fC4O5hKOTMEPPKWpiGrDLGvJ4BAkjlS0MtZnn9n/s1600/roe-mil-leak-1.jpg" width="229" /></a></div>
<div>
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlsxdtUDPj1N_YfEjD0-uc9AMnKJSbP6cTEdpL8JuH7wD6rhZ0ye0ZbivUIzFApi0EhGXUignB15GRWt1fbWVfA5wHQa-dmoN_qHhDEONx1wKjg5HYfCiFZOV3PBRgEnuiWJnkyErZQ_kl/s1600/roe-mil-leak-3.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" height="242" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlsxdtUDPj1N_YfEjD0-uc9AMnKJSbP6cTEdpL8JuH7wD6rhZ0ye0ZbivUIzFApi0EhGXUignB15GRWt1fbWVfA5wHQa-dmoN_qHhDEONx1wKjg5HYfCiFZOV3PBRgEnuiWJnkyErZQ_kl/s1600/roe-mil-leak-3.jpg" width="320" /></a></div>
<br /><br /><br /><br /></div>

Anonymous Data Leak Hacking News News Russian Hackers Russian Defence Hacked, 500+MB Data Leaked

Today Russian hacktivist Rucyborg has announced a big leak of files from Russian Defence Export ROSOBORONEXPORT ( http://www.roe.ru/ )...