Microsoft Outlook Breach Targeting Cryptocurrency Users

4/30/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHkvDoGBQpjT4W3SvbIPYYq3OcyhA4R4zK1748reunJHUTabTQPZrNb3Q1AnY8mD5qAX4HIbDwkHuqtXWX1cgbPJlfoVL7Tym4y3HotYKXBllGvEWyQTZRx4w1ztbekvKG5Wkl_vikSIe5/s1600/bitcoin_outlook_breach.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="963" data-original-width="1448" height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhHkvDoGBQpjT4W3SvbIPYYq3OcyhA4R4zK1748reunJHUTabTQPZrNb3Q1AnY8mD5qAX4HIbDwkHuqtXWX1cgbPJlfoVL7Tym4y3HotYKXBllGvEWyQTZRx4w1ztbekvKG5Wkl_vikSIe5/s640/bitcoin_outlook_breach.jpeg" width="640" /></a></div>
<br />
Earlier this month, news broke out that hackers were not only able to access Outlook users’ email metadata as previously reported, but also email content. The breach centered around a hacker getting hold of a Microsoft customer support worker’s login credentials; from there, the hacker could dive into the content of any non-corporate Outlook, Hotmail, or MSN account, Motherboard found.<br /><br />Now, multiple victims have come forward to flag what they believe may be one of the motivating reasons behind the breach: emptying peoples’ cryptocurrency accounts.<br /><br />“The hackers also had access to my inbox allowing them to password reset my Kraken.com account and withdrawal [sic] my Bitcoin,” Jevon Ritmeester, a Microsoft user that the company alerted to the data breach, told in an email, referring to popular cryptocurrency exchange Kraken.<br /><br />For verification purposes, Ritmeester provided Motherboard with the breach notification emails he received from Microsoft, as well as a screenshot showing what he said was an email forwarding rule the hackers set up: anytime an email mentioned the term “Kraken,” his account would automatically forward it to a Gmail address presumably controlled by the hackers.<br /><br />
<blockquote class="tr_bq">
Do you know anything else about this breach? You can contact Joseph Cox securely on Signal on +44 20 8133 5190, Wickr on josephcox, OTR chat on jfcox@jabber.ccc.de, or email joseph.cox@vice.com</blockquote>
<br />That would include emails such as password reset and Bitcoin withdrawal requests. Indeed, Ritmeester only found someone had requested both of those after checking the trash of his email account, he wrote in a recent post on the tech forum Tweakers. In the post, he added that he lost just over 1 bitcoin, or around $5,000 at the current exchange rate.<br /><br />It appears Ritmeester isn’t the only person who hackers stole cryptocurrency from due to the Microsoft breach.<br /><br />“My account was hacked as a direct result of this,” Reddit user shinratechlabs wrote earlier this month, adding that they lost “25,000 in crypto,” although it’s not clear what currency they may be referring to, fiat or otherwise.<br /><br />“Same exact for me only a lot less funds stolen, sucks,” another Reddit user, mickey_ficke, chimed in. Neither Reddit user responded to a request for comment.<br /><br />
<blockquote class="tr_bq">
“I feel Microsoft is trying to cover up and is not taking this seriously.”</blockquote>
<br />In his post on Tweakers, Ritmeester said he didn’t have two-factor authentication enabled on Kraken, which may have kept the hackers out of this cryptocurrency account. If he had it enabled, the hackers may have had to take control of this phone number as well in order to intercept the two-factor authentication tokens, for instance.<br /><br />A Microsoft spokesperson told on Monday that, “Customers who believe they have been impacted beyond what was outlined in the company’s notification should contact the Microsoft support team for assistance.”<br /><br />Originally, when TechCrunch and other outlets reported the Outlook data breach, Microsoft said it only impacted email metadata and customer information, such as subject lines and the names of other email addresses users communicated with. After Motherboard presented Microsoft with evidence that email content had also been impacted, Microsoft revised its statement, despite already being fully aware that content was exposed; the company had issued breach notification emails to victims saying as much. <a href="https://motherboard.vice.com/en_us/article/xwndwn/microsoft-outlook-msn-hotmail-breach-cryptocurrency-bitcoin"><span style="font-size: xx-small;">Source</span></a></div>

Earlier this month, news broke out that hackers were not only able to access Outlook users’ email metadata as previously reported, but also email content. The breach centered around a hacker getting hold of a Microsoft …

Multi-Stage Malware Loader Hits Europeans via Signed Malspam

4/29/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmrjDKffNtOT802AuAJrLLSSXnZH_IrCmH7XuGuZ0b_7-y-K2e_sXeb79AqIntkQGOkpST-kcH6oB_fg1Q_Mj8FrWJdeFg1kzjQCWU6SbQ2uhVCpqCxxEMKo6T7CrTVbQz77f81UHJ1upH/s1600/Malspam.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="480" data-original-width="1200" height="256" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhmrjDKffNtOT802AuAJrLLSSXnZH_IrCmH7XuGuZ0b_7-y-K2e_sXeb79AqIntkQGOkpST-kcH6oB_fg1Q_Mj8FrWJdeFg1kzjQCWU6SbQ2uhVCpqCxxEMKo6T7CrTVbQz77f81UHJ1upH/s640/Malspam.jpg" width="640" /></a></div>
Multiple malicious spam campaigns using signed emails have been observed while distributing the GootKit (aka talalpek or Xswkit) banking Trojan with the help of a multi-stage malware loader dubbed JasperLoader over the past few months.<br />
<br />
This loader is the third one detected by Cisco Talos' research team since July 2018, with Smoke Loader (aka Dofoil) being employed by threat actors to drop ransomware or cryptocurrency miner payloads last year, while <a href="https://blog.talosintelligence.com/2019/02/combing-through-brushaloader.html">Brushaloader</a> was identified during early 2019 and seen while making use of Living-of-the-Land (LotL) tools such as PowerShell scripts to remain undetected on compromised systems.<br />
<br />
<blockquote class="tr_bq">
“Specifically, we’re tracking a loader known as “JasperLoader,” which has been increasingly active over the past few months and is currently being distributed via malicious spam campaigns primarily targeting central European countries with a particular focus on Germany and Italy.” reads the<a href="https://blogs.cisco.com/security/talos/jasperloader-emerges-targets-italy-with-gootkit-banking-trojan"> analysis published </a>by Cisco Talos. “JasperLoader employs a multi-stage infection process that features several obfuscation techniques that make analysis more difficult.”</blockquote>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGi30kQTjzXBpfzjPEzBjIpTv1N_a_3WzP2ac00W2nE3spRf0dm-_BQ8VhecIHCS0wkIj_7xbcx3Er7sBlzunjeswyasogyL7g2yRzdqOxDMhUdrqeXGb7ZZaQemgWs911JebbGSu8R5EJ/s1600/Malspam+email+samples.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Malspam email samples" border="0" data-original-height="428" data-original-width="1288" height="212" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhGi30kQTjzXBpfzjPEzBjIpTv1N_a_3WzP2ac00W2nE3spRf0dm-_BQ8VhecIHCS0wkIj_7xbcx3Er7sBlzunjeswyasogyL7g2yRzdqOxDMhUdrqeXGb7ZZaQemgWs911JebbGSu8R5EJ/s640/Malspam+email+samples.png" title="Malspam email samples" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Malspam email samples</td></tr>
</tbody></table>
The various malicious campaigns <a href="https://blogs.cisco.com/security/talos/jasperloader-emerges-targets-italy-with-gootkit-banking-trojan">detected by Cisco Talos</a> are localized to match the European country they are targeting, while the attachments employed to start the JasperLoader infection contain either a Visual Basic for Applications (VBS) script or a DOCM documents with VBA macros, both of them used to initiate the payload download process.<br />
<br />
What makes some of these malspam campaigns very dangerous is the fact that the attackers use legitimate certified email services such as Posta Elettronica Certificata (PEC) used in Italy, Switzerland and Hong Kong to send signed emails "to maximize the likelihood that they can convince potential victims to open their malicious emails."<br />
<br />
After the JasperLoader malware loader successfully infects its targets, it will check its geolocation and terminate itself if the compromised machine is from Russia, Ukraine, Belarus, or People's Republic of China.<br />
<br />
Next, it gains persistence by adding an LNK shortcut to itself to the infected system's Startup folder to get launched each time the machine is rebooted.<br />
<br />
It will also generate a bot identifier which gets sent to the command-and-control (C2) server allowing it to register the machine to the operators' botnet and it goes in standby, waiting for commands from the C2 server.<br />
<br />
JasperLoader allows the attackers to update the loader, to run Powershell-based arbitrary system commands, and, more importantly, to download the final Gootkit malware payload. (pic)<br />
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiO-_ZxE6-9_K5w2U8z9KkzK9kFF1B9Ld9EDeEj9lGCR6gG26uiY2ZIXUFl3NLz_N6hCwMWyFhhuEHjZfBJoxEqT2huvjfOYHmxOD75j8Q2qhwq6KvyiAuATz7kEDIYqjuS8bk8fXkcS6po/s1600/Downloading+the+final+malware+payload.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="188" data-original-width="640" height="188" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiO-_ZxE6-9_K5w2U8z9KkzK9kFF1B9Ld9EDeEj9lGCR6gG26uiY2ZIXUFl3NLz_N6hCwMWyFhhuEHjZfBJoxEqT2huvjfOYHmxOD75j8Q2qhwq6KvyiAuATz7kEDIYqjuS8bk8fXkcS6po/s640/Downloading+the+final+malware+payload.png" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Downloading the final malware payload</td></tr>
</tbody></table>
<br />
Signing the malspam messages before sending them to their victims using valid certificates made it possible for the attackers behind JasperLoader malicious email campaigns to confirm their authenticity "as only those with access to the private keys should be able to sign the message."<br />
<br />
<blockquote class="tr_bq">
In addition, "abusing a legitimate email service allowed them to deliver their malicious emails in a way that would maximize the likelihood that a potential victim would open the attachments and infect themselves with JasperLoader," concluded Cisco Talos.</blockquote>
<br />
Indicators of compromise (IOCs) are also provided by the Cisco Talos' research team in the form of <a href="https://alln-extcloud-storage.cisco.com/ciscoblogs/5cc1be63b4832.txt">SHA256</a> attachment hashes, list of used domains and IP addresses. <a href="https://www.bleepingcomputer.com/news/security/europeans-hit-with-multi-stage-malware-loader-via-signed-malspam/"><span style="font-size: xx-small;">Source</span></a></div>

Europe GootKit Hacking News JasperLoader Malspam Malwares Spam Multi-Stage Malware Loader Hits Europeans via Signed Malspam

Multiple malicious spam campaigns using signed emails have been observed while distributing the GootKit (aka talalpek or Xswkit) banking Trojan with the help of a multi-stage malware loader dubbed JasperLoader over the …

Stop What You’re Doing and Google ‘Thanos’

4/27/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3E0nDEJTu9tAg2jpEUWpKIe4oP_fLv-AbRkRr1Fo_8_KqM6MqeCPmxhqiyjgeownfgF4uh-qxMXRghyibKT13SeTWbsopr5ssjOFAEWpLAMtr2MpIG-NhTrbhpkXnO65bTCxCqJajVRa9/s1600/avengers-endgame.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="419" data-original-width="796" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi3E0nDEJTu9tAg2jpEUWpKIe4oP_fLv-AbRkRr1Fo_8_KqM6MqeCPmxhqiyjgeownfgF4uh-qxMXRghyibKT13SeTWbsopr5ssjOFAEWpLAMtr2MpIG-NhTrbhpkXnO65bTCxCqJajVRa9/s640/avengers-endgame.png" width="640" /></a></div>
<br />
Avengers: Endgame is smashing box office records, collecting more than $60 million yesterday alone.<br />
<br />
And while the internet is going over Endgame, we’re just over here trying to finish out the work week so we can slide into a theater for a peek at the film. We are the kind of people who believes in first day first say but sadly we don not get any ticket as early as Sunday night. Needless to say, we’re a bit wary of spoilers. This led us to pass up a pretty cool Easter egg by the folks at Google.<br />
<br />
Okay, here goes. At the end of Infinity War, Thanos — snaps his fingers and wipes out something like half of the world’s population. It’s the ultimate cliffhanger moment, and one that led us to a year of waiting for some sense of closure.<br />
<br />
Google, in all its nerd glory, replicated this with Thanos-related search results. Some are reporting it as a means to block spoilers, but it seems more random than that, mostly blocking out the articles explaining the Easter egg, and a few of the cards included in most searches. But it’s still cool, and should lead to a spoiler-free experience if you want to check it out.<br />
<br />
Google Search is home to a new Easter egg celebrating yesterday's theatrical release of Avengers: Endgame. Just Google “Thanos” on desktop or mobile, and then nn the right, you’ll see a jewel-adorned glove, called the Infinity Gauntlet. Click it and watch what happens.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizLxPCFW3QYbOq-YFfVZQ9399ku68HJqh6LkoBv3rnDMHEK6NLCW5AGc2D5cHl_08BTY9kIsRFgp76J7q4zLdM6kG1Z95kg0oBsQyFGIG6dNTao7I30DBYWEcn1Iy2sGFcloX6MNubX90o/s1600/google-thanos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="664" data-original-width="536" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEizLxPCFW3QYbOq-YFfVZQ9399ku68HJqh6LkoBv3rnDMHEK6NLCW5AGc2D5cHl_08BTY9kIsRFgp76J7q4zLdM6kG1Z95kg0oBsQyFGIG6dNTao7I30DBYWEcn1Iy2sGFcloX6MNubX90o/s640/google-thanos.png" width="515" /></a></div>
<br />
Previously it was also reported that avengers endgame got leaked online in china. Click <a href="https://www.hackerschronicle.com/2019/04/avengers-endgame-leaked.html">here</a> to read more.<br />
</div>

Avengers Endgame Google Marvel Technology Thanos Stop What You’re Doing and Google ‘Thanos’

Avengers: Endgame is smashing box office records, collecting more than $60 million yesterday alone. And while the internet is going over Endgame, we’re just over here trying to finish out the work week so we can slide i…

Avengers: Endgame Leaked Online in China

4/26/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDolKTrpqGHDs64QYKSgieSRuSKbRzKuqomzLQmi0DK6pbUP_SiLGPfSSy-FqLCnF4fS8_yLwrsL0HcOjQAGc1R3G6dV1kstZKK2KfaXYYOSlwNjpZXvo_xKei_oNtfT46lxKCPMHhs6Kh/s1600/avengers-endgame-full-movie-download.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers-endgame-full-movie-download" border="0" data-original-height="468" data-original-width="1600" height="186" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDolKTrpqGHDs64QYKSgieSRuSKbRzKuqomzLQmi0DK6pbUP_SiLGPfSSy-FqLCnF4fS8_yLwrsL0HcOjQAGc1R3G6dV1kstZKK2KfaXYYOSlwNjpZXvo_xKei_oNtfT46lxKCPMHhs6Kh/s640/avengers-endgame-full-movie-download.jpeg" title="avengers-endgame-full-movie-download" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
</div>
Marvel’s latest and perhaps the most anticipated movie ever to be released Avengers: End Game has become an object of controversy lately as hackers and <a href="https://www.hackerschronicle.com/search/label/Cyber%20Crime">cybercriminals</a> are trying their best to benefit from the movie’s widespread, intense hype.<br />
<br />
Last week, Marvel fans were requested to not use social media after a video made via mobile phone containing movie spoilers was posted online. Now that the movie has been released in China and just a day is left in its US release, reports are rife that a camera version of the movie has been uploaded on various torrent platforms and piracy sites.<br />
<br />
TorrentFreak reveals that copy of Avengers: End Game has been recorded from a cinema in China and initially it exclusively appeared on Chinese torrent sites. It is interesting because the movie’s sponsors and producers chose to release it in China first and it is yet to be released in the US.<br />
<br />
Reportedly, this decision was taken to address the issue of piracy in the region. The movie has so far raked in $90 million in sales, that’s an impressive start for sure but the inevitable has happened as someone was able to record the movie in the cinema and upload it online.<br />
<br />
According to the analysis from <a href="https://torrentfreak.com/avengers-endgame-leaks-online-in-china-begins-to-spread-190424/">TorrentFreak</a>, their system notified about the appearance of a 1.2 GB cammed version of Avengers: End Game between 4:00 pm and 5:00 pm China local time, that’s merely a few hours after the movie was released in China.<br />
<blockquote class="tr_bq">
Don’t spoil the Endgame.</blockquote>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1cZRLTltdArqER839hE8T7pSHG7STItqVm00OFhibryop8C-3lbufICNeMdf5Fv6w8G2vvWqN6GhtoDCDLZDlO-6vi_tpUXZMuscpcZm90ViGJ4m58GJUVIVJ-cNAxtpEHT3KrXOWDYoN/s1600/avengers-end-game-leaked-online.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers end game leaked online" border="0" data-original-height="340" data-original-width="600" height="362" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1cZRLTltdArqER839hE8T7pSHG7STItqVm00OFhibryop8C-3lbufICNeMdf5Fv6w8G2vvWqN6GhtoDCDLZDlO-6vi_tpUXZMuscpcZm90ViGJ4m58GJUVIVJ-cNAxtpEHT3KrXOWDYoN/s640/avengers-end-game-leaked-online.jpg" title="avengers end game leaked online" width="640" /></a></div>
As soon as the movie was released online, dozens of users located in <a href="https://www.hackerschronicle.com/search/label/Chinese%20Hackers">China</a> started sharing it on torrent sites. Then came the 2 GB version of the movie and new copies are also emerging at regular intervals. The initial versions were basically different variants of the first torrent shared on Thunder torrent site; it became evident because all the new variants had the same client code starting from 7.10.35.XXX.<br />
<br />
The good news is that the pirated version circulating on torrent sites is of pretty bad quality as the movie continuously flickers, is semi-rotated and there are watermarks of a gambling site visible throughout. TorrentFreak also noted that the pirated version has made it to piracy sites in the UK as well.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRbOR3N9msJP1t9eGyimwPvEx4Q42RoBPPYG2thkDZVbCSwWXtPbEW347Wh9Tdbvqg6OQB5Ptz_PlAyu8Ffz-h-yiA5gxk9ptRfQXWym44wzK0KwIkJO4fCM2j8e5oGvbwtKNkKtXSVAIn/s1600/avengers4torrentdata-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers end game available on torrent" border="0" data-original-height="354" data-original-width="600" height="376" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRbOR3N9msJP1t9eGyimwPvEx4Q42RoBPPYG2thkDZVbCSwWXtPbEW347Wh9Tdbvqg6OQB5Ptz_PlAyu8Ffz-h-yiA5gxk9ptRfQXWym44wzK0KwIkJO4fCM2j8e5oGvbwtKNkKtXSVAIn/s640/avengers4torrentdata-1.png" title="avengers end game available on torrent" width="640" /></a></div>
<br />
<br />
It is worth mentioning that the initial version of the movie’s copy was dubbed in Chinese but later another version with English audio and Chinese subtitles was released online. Moreover, an improved version of the movie has also been released that has been sponsored by a <a href="https://www.hackerschronicle.com/search/label/Russian%20Hackers">russian</a> betting company 1XBet.<br />
<br />
Avengers: End Game is touted as the final and conclusive chapter of the franchise. So far 22 films have been released since 2008 under the Marvel Cinematic Universe banner. The makers have tried their best to keep the movie’s storyline a secret, so much so that even the journalists weren’t allowed to watch the movie prior to interviewing its star cast. </div>

Avengers Endgame Chinese Hackers Cyber Crime Full Movie Marvel Movie Russian Hackers Torrent Avengers: Endgame Leaked Online in China

Marvel’s latest and perhaps the most anticipated movie ever to be released Avengers: End Game has become an object of controversy lately as hackers and cybercriminals are trying their best to benefit from the movie’s wi…

Password Expiry rules are useless: Microsoft

4/25/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqUF_WuEse2kZ0JaRkL9KfdsgNTITKFOlBjF3k_mgQ9Sx5gPpxQr007nzlJWs4CJE9aybr4FNChxuvk8JDa-vFbo7xU0ux-sQgS_mTuiDb-hLTKDmcAklCDvRsRY2yy1sJciX5C6j71tJ4/s1600/microsoft-password-expiry.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="microsoft password expiry" border="0" data-original-height="749" data-original-width="1092" height="438" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqUF_WuEse2kZ0JaRkL9KfdsgNTITKFOlBjF3k_mgQ9Sx5gPpxQr007nzlJWs4CJE9aybr4FNChxuvk8JDa-vFbo7xU0ux-sQgS_mTuiDb-hLTKDmcAklCDvRsRY2yy1sJciX5C6j71tJ4/s640/microsoft-password-expiry.png" title="microsoft password expiry" width="640" /></a></div>
<br />
 <span class="caption">Ever had to change your password for no reason? </span><span class="caption">Before, it was annoying. Now, it's useless.</span><br />
<br />
Microsoft has admitted that one of the great curses of our time, the password reset rule, is nonsense.<br />
<br />
"When humans are assigned or forced to create passwords that are hard to remember, too often they'll write them down where others can see them," Microsoft's <a href="https://twitter.com/AaronMargosis">Aaron Margosis</a> wrote in a <a href="https://blogs.technet.microsoft.com/secguide/2019/04/24/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903/">blog post</a> Wednesday. Worse, Margosis wrote, when people are forced to change their passwords, too often they make a "small and predictable alteration to their existing password," or they'll just forget it.<br />
<br />
The blog post introduces a broader set of "<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-baselines">baseline</a>" security settings Microsoft is considering recommending to companies that use its computer management software. Think of them as defaults of a sort.<br />
<br />
Unfortunately, Microsoft isn't simply yanking the password reset feature, which would be the humane thing to do. In the end, it'll still be up to your company's tech team whether to listen to reason or continue living in the security Stone Age.<br />
<br />
It's worth noting that Microsoft isn't changing recommendations around the way we create passwords. In fact, the company recommends companies increasingly ban typical bad passwords, and force employees to use multifactor authentication. <br />
<br />
<blockquote>
"Periodic password expiration is an ancient and obsolete mitigation of very low value," Margosis wrote.</blockquote>
<br />
But make no mistake, <a href="https://www.hackerschronicle.com/search/label/Microsoft">Microsoft</a>, whose Windows software powers nearly 80% of the world's computers, has finally seen the light. <span style="font-size: xx-small;"><a href="http://cnet.com/">Source</a></span></div>

Microsoft Password Password Expiry Technology Password Expiry rules are useless: Microsoft

Ever had to change your password for no reason? Before, it was annoying. Now, it's useless. Microsoft has admitted that one of the great curses of our time, the password reset rule, is nonsense. "When humans are assign…

Bodybuilding.com confirms Data Breach

4/24/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjav4fT_vy7AeU-yBoFGrd1P0avUFMV_V3pVWbMrJnnzVZTdh9WNajlxHgh7WH3clxT3ByH0VgxReB0_Cod9GEQWwfNLirHPGCoUEYnFJ0nEtY2-tDMBaa4TzgiV8_i9EjE8FaEjB2RlnSm/s1600/bodybuilding-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bodybuilding.com hacked" border="0" data-original-height="425" data-original-width="1000" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjav4fT_vy7AeU-yBoFGrd1P0avUFMV_V3pVWbMrJnnzVZTdh9WNajlxHgh7WH3clxT3ByH0VgxReB0_Cod9GEQWwfNLirHPGCoUEYnFJ0nEtY2-tDMBaa4TzgiV8_i9EjE8FaEjB2RlnSm/s640/bodybuilding-hacked.jpg" title="Bodybuilding.com hacked" width="640" /></a></div>
<br />
Bodybuilding.com, the internet's biggest online store and online forum for fitness and bodybuilding enthusiasts, has disclosed last week a security breach that impacted its IT systems.<br />
<br />
Customer data might have been exposed, the company said in a <a href="https://www.bodybuilding.com/help?notifications&data-incident">short message</a> posted on its website. Its staff isn't sure if the attacker accessed customer data, though.<br />
<br />
A third-party security firm was hired to help with the investigation, but forensics experts couldn't confirm that customer data was stolen from Bodybuilding.com's servers, either.<br />
<br />
Bodybuilding.com said investigators traced the unauthorized activity to a phishing email its staff received in July 2018. At least one employee appears to have fallen for this email.<br />
<br />
Hackers used the data they obtained from this phishing email to access the company's network in February 2019. Bodybuilding.com didn't say when it detected the intrusion, but it said it finished its investigation on April 12. It went public with the security breach a week later, on April 19.<br />
<br />
<blockquote class="tr_bq">
We became aware of a data security incident involving unauthorized access to our systems in February 2019. We engaged one of the leading data security firms to conduct a thorough investigation, which traced the unauthorized activity to a phishing email received in July 2018. On April 12, 2019, we concluded our investigation and could not rule out that personal information may have been accessed.</blockquote>
<br />
Despite not knowing if hackers accessed customer data, Bodybuilding.com decided to do the right thing and notify all of its customers of the security incident, as a precaution.<br />
<br />
It also reset all users' passwords as well, to prevent any abuse in case attackers did manage to steal any data.<br />
<br />
According to the company, if hackers did manage to access and steal customer data, possibly exposed details will include name, email address, billing/shipping addresses, phone number, order history, any communications with Bodybuilding.com, birthdate, and any information included in BodySpace profiles.<br />
<br />
Social Security numbers and payment card details were not exposed, the company said, as the site never collected this information in the first place.<br />
<br />
Besides notifying users of the breach, Bodybuilding.com is also alerting users that scammers might also try to imitate its data breach disclosure notifications for online fraud or phishing attacks.<br />
<br />
<blockquote class="tr_bq">
Please note that the email from Bodybuilding.com does not ask you to click on any links or contain attachments and does not request your personal data. If the email you received about this issue prompts you to click on a link, suggests you download an attachment, or asks you for information, the email was not sent by Bodybuilding.com and may be an attempt to steal your personal data. Avoid clicking on links or downloading attachments from such suspicious emails. Any link included in our email to users directs users to insert the Bodybuilding.com FAQs URL into your browser and does not request your personal data.</blockquote>
<a href="https://www.zdnet.com/google-amp/article/bodybuilding-com-discloses-security-breach/"><span style="font-size: xx-small;">Source</span></a></div>

bodybuilding.com databreach Hacking News News Phishing Security Bodybuilding.com confirms Data Breach

Bodybuilding.com, the internet's biggest online store and online forum for fitness and bodybuilding enthusiasts, has disclosed last week a security breach that impacted its IT systems. Customer data might have been expo…

2 Million Wi-Fi Passwords Leaked

4/23/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_JzcJ1AsuRYfsljM1cITPR7YLgu-D-N76enZhfj9tuMOE08vCJnkM1jG-LmooyQWWC4TBPZ4GvvJqj0LTXuC_bEQ33v_D4qofBTBGN9gVbsA5rWJ-FhRiggoxyFtpd47iomLFe0IwzTIt/s1600/wifi-finder.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Wi-Fi Hotspot Finder Spills 2 Million Passwords" border="0" data-original-height="933" data-original-width="1390" height="427" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_JzcJ1AsuRYfsljM1cITPR7YLgu-D-N76enZhfj9tuMOE08vCJnkM1jG-LmooyQWWC4TBPZ4GvvJqj0LTXuC_bEQ33v_D4qofBTBGN9gVbsA5rWJ-FhRiggoxyFtpd47iomLFe0IwzTIt/s640/wifi-finder.jpg" title="Wi-Fi Hotspot Finder Spills 2 Million Passwords" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Wi-Fi Hotspot Finder Spills 2 Million Passwords Online</td></tr>
</tbody></table>
A popular hotspot finder app for Android exposed the Wi-Fi network passwords for more than two million networks.<br /><br />The app, downloaded by thousands of users, allowed anyone to search for Wi-Fi networks in their nearby area. The app allows the user to upload Wi-Fi network passwords from their devices to its database for others to use.<br /><br />That database of more than two million network passwords, however, was left exposed and unprotected, allowing anyone to access and download the contents in bulk.<br /><br />Sanyam Jain, a security researcher and a member of the GDI Foundation, found the database and reported the findings to TechCrunch.<br /><br />We spent more than two weeks trying to contact the developer, believed to be based in China, to no avail. Eventually we contacted the host, DigitalOcean, which took down the database within a day of reaching out.<br /><br />“We notified the user and have taken the [server] hosting the exposed database offline,” a spokesperson told.<br /><br />Each record contained the Wi-Fi network name, its precise geolocation, its basic service set identifier (BSSID) and network password stored in plaintext.<br /><br />Although the app developer claims the app only provides passwords for public hotspots, a review of the data showed countless home Wi-Fi networks. The exposed data didn’t include contact information for any of the Wi-Fi network owners, but the geolocation of each Wi-Fi network correlated on a map often included networks in wholly residential areas or where no discernible businesses exist.<br /><br />The app doesn’t require users to obtain the permission from the network owner, exposing Wi-Fi networks to unauthorized access. With access to a network, an attacker may be able to modify router settings to point unsuspecting users to malicious websites by changing the DNS server, a vital system used to convert web addresses into the IP addresses used to locate web servers on the internet. When on a network, an attacker also can read the unencrypted traffic that goes across the wireless network, allowing them to steal passwords and secrets.<br /><br />Tens of thousands of the exposed Wi-Fi passwords are for networks based in the U.S.<br />
Source: <a href="https://techcrunch.com/2019/04/22/hotspot-password-leak/">TechChrunch</a></div>

Data Leak DigitalOcean Hacking News Wi-Fi WiFi Finder 2 Million Wi-Fi Passwords Leaked

Wi-Fi Hotspot Finder Spills 2 Million Passwords Online A popular hotspot finder app for Android exposed the Wi-Fi network passwords for more than two million networks.The app, downloaded by thousands of users, allowed a…