Tesla's Cloud Servers Hacked to mine Cryptocurrency

2/21/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s1600/Tesla-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Kubernetes Consoles Breached" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s640/Tesla-Servers-Hacked.png" title="Kubernetes Consoles Breached" width="640" /></a></div>
<br />
Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency</a>. The incident took place last year when hackers gained access to Tesla's Kubernetes server, an open-source application used by large companies to manage API and server infrastructure deployed on cloud hosting providers.<br />
<br />
Cloud security firm RedLock —whose experts discovered the hacked server— said hackers found a "pod" inside the <a href="http://www.hackerschronicle.com/search/label/Kubernetes" target="_blank">Kubernetes </a>console that stored login credentials for one of Tesla's AWS cloud infrastructure.<br />
<br />
RedLock says the <a href="http://www.hackerschronicle.com/search/label/AWS" target="_blank">AWS </a>buckets appeared to have been storing sensitive data such as telemetry, but a Tesla Motors spokesperson told  in an email the data was from "internally-used engineering test cars only." While there's no evidence intruders stole any data, they did install a mining application that utilized the vast computational resources of Tesla's AWS servers to mine the <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero cryptocurrency</a>.<br />
<br />
A Tesla spokesperson told that the company received a notification about the incident and secured the server immediately. RedLock said today the incident took place because Tesla engineers forgot to secure the Kubernetes console with an access password.<br />
<br />
"We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it," Tesla said. "The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way.”<br />
<br />
It is very clear that these hackers knew what they were doing, as they set up a private mining pool to use for their illegal mining operations only, hid the mining pool behind CloudFlare, configured the mining software to listen for commands on a non-standard port, and throttled the mining software to use only a small portion of <a href="http://www.hackerschronicle.com/search/label/Tesla" target="_blank">Tesla's</a> AWS CPU resources. All of these configuration changes were made to avoid detection. Because they used a custom mining pool, it is unclear how much money this hacker group made.</div>

Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the cryptocurrency ....

Hackers stole $1.8 mn from City Union Bank

2/19/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCkwDGToesin2s_-u3JKcwu7EYNjhNHZPArCZ3aLVPSbJnMEp8dlwlUaTKh-E5s3eFmmbyoUgKG2d_xPJXaXyjUkIO6aB25A9eCqXfl7fNS7GwkHt7wuP4Eh_qqmrCLa18nSolezTPTyRs/s1600/city-union-bank-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="city-union-bank-hacked" border="0" data-original-height="541" data-original-width="800" height="432" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCkwDGToesin2s_-u3JKcwu7EYNjhNHZPArCZ3aLVPSbJnMEp8dlwlUaTKh-E5s3eFmmbyoUgKG2d_xPJXaXyjUkIO6aB25A9eCqXfl7fNS7GwkHt7wuP4Eh_qqmrCLa18nSolezTPTyRs/s640/city-union-bank-hacked.jpg" title="city-union-bank-hacked" width="640" /></a></div><br />
A year after the SWIFT international bank transfer system enhanced its security, another breach has emerged: an Indian bank has confirmed that criminals gained access to its systems and made <span class="highlight">transfers totaling US$1.8 million.</span><br />
<br />
The Kumbakonam-based City Union Bank <a href="https://www.cityunionbank.com/downloads/Press_Release_swift.pdf" target="_blank">issued a statement</a> on Sunday February 18, in response to local media speculation that three unauthorized transactions were initiated by staff. In it, the bank says it suffered an attack by <span class="highlight">“international cyber-criminals and there is no evidence of internal staff involvement”.</span> The statement says the transactions took place on or before February 7, when its reconciliation processes identified the three fraudulent transactions.<br />
<br />
A transfer of $500,000 through Standard Chartered to a Dubai bank was blocked at the source. That's good news, of a sort, because SWIFT launched a scanning service designed to spot fraudulent transactions in April 2017, as part of its response to the 2016 incident that saw second-hand security kit used at Bangladesh Bank let attackers into the international funds transfer system. <span class="highlight">On that occasion, $81 million was transferred.</span> The attackers tried to steal over $1bn, but were thwarted by a typo in one of their attempted transfers.<br />
<br />
SWIFT later warned banks to tighten their security.It remained a plum target, however, and in October 2017, a Taiwanese bank had $60 million pinched. Those funds were recovered, and the attackers arrested. It appears that SWIFT's dodgy-deal-detectors worked for the transfer to Dubai. But a second made it to a Turkish bank and $1m is still missing after being transferred through a Bank of America account to a Chinese destination and withdrawn by an unknown beneficiary.<br />
<br />
The Indian consulate in Istanbul is assisting with efforts to recover funds from the Turkish transfer. City Union Bank added that its SWIFT system is back in operation with “adequate enhanced security”. Just how the alleged criminals exploited the Bank's previous security regime has not been revealed, so it is unknown if SWIFT or Union Bank is the source of the problem.</div>

City Union Bank Cyber Attack Hacking News News SWIFT Hackers stole $1.8 mn from City Union Bank

A year after the SWIFT international bank transfer system enhanced its security, another breach has emerged: an Indian bank has confirmed t...

Thousands of Jenkins Servers Hacked to mine Monero

2/18/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s1600/JenkinsMinerMalware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Hacked-to-Mine-Monero" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s640/JenkinsMinerMalware.png" title="Jenkins-Hacked-to-Mine-Monero" width="640" /></a></div>
A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency.<br />
<br />
Hackers are targeting <a href="http://www.hackerschronicle.com/search/label/Jenkins" target="_blank">Jenkins</a>, a continuous integration/deployment web application built in Java that allows dev teams to run automated tests and execute various operations based on test results, including deploying new code to production servers. Because of this, Jenkins servers are extremely popular with both freelance web developers, but also with large enterprises.<br />
<br />
A cyber security research firm announced it uncovered the footprint of a large hacking operation targeting Jenkins servers left connected to the Internet.<br />
<br />
<b>Hackers using Jenkins RCE flaw</b><br />
Attackers were leveraging <a href="https://jenkins.io/security/advisory/2017-04-26/" target="_blank">CVE-2017-1000353</a>, a vulnerability in the Jenkins Java deserialization implementation that allows attackers to run malicious code remotely without needing to authenticate first. Hackers used this vulnerability to make Jenkins servers download and install a <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>miner (minerxmr.exe).<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s1600/Jenkins-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Servers-Hacked" border="0" data-original-height="438" data-original-width="894" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s640/Jenkins-Servers-Hacked.png" title="Jenkins-Servers-Hacked" width="640" /></a></div>
The miner was being downloaded from an IP address located in <a href="http://www.hackerschronicle.com/search/label/Chinese%20Hackers" target="_blank">China </a>and assigned to the Huaian government network. It is unclear if this is the attacker's server, or a compromised server used to host the miner on behalf of the hackers.<br />
<br />
The attackers have been active for months. This has allowed them to mine and already <b>cash out over 10,800 Monero, which is over $3.4 million</b>, at the time of writing.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s1600/Monero-Mining-Malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Monero-Mining-Malware" border="0" data-original-height="475" data-original-width="1175" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s640/Monero-Mining-Malware.png" title="Monero-Mining-Malware" width="640" /></a></div>
Researchers say the group appears to have compromised mostly Jenkins instances running on Windows operating systems.<br />
<br />
<b>Over 25,000 Jenkins servers left exposed online</b><br />
Attackers aren't the only ones who've noticed the large number of Jenkins servers available online. In mid-January, security researcher Mikail Tunç published <a href="https://emtunc.org/blog/01/2018/research-misconfigured-jenkins-servers/" target="_blank">research</a> highlighting that there were over 25,000 Jenkins servers left exposed to Internet connections at the time of his research.<br />
<br />
Also on Friday, Researchers released new research on other hackers leveraging the <b>CVE-2017-10271</b> flaw to infect Oracle WebLogic servers with malware. This vulnerability has been under active exploitation <b>since early December 2017</b>, and one group has already made <b>more than $226,000</b>.<br />
<br />
Besides Jenkins and <b>Oracle WebLogic</b> servers, hackers are also targeting <b>Ruby on Rails, PHP, and IIS </b>servers, also deploying Monero-mining malware.<br />
<br />
Monero-mining malware is already this year's biggest <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware trend/problem</a>, with numerous malware distribution campaigns spreading such payloads on any unsecured computer/server crooks can get their hands on.</div>

Cryptocurrency Hacking News Jenkins Malwares Miner Monero News Thousands of Jenkins Servers Hacked to mine Monero

A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency. H...

New search engine launched to find Hackable Servers

2/17/2018 cyb3r.gladiat0r 0

AWS BuckHacker Hacking Tools News S3 New search engine launched to find Hackable Servers

New search engine launched to find Hackable Servers We all know very well that more and more users are simply choosing to save their d...

Russian military involved in NotPetya attacks: UK

2/16/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghzYNI6Anca1BCGPLXTKDzKA8JIHruZe9_LhR5xzxe8ZwQXo9WmTcdPFX5m1gDRJ_HRv73E1fkym1SmN75JvW1fkuPTqLa0w4zl0DvFRx01JjU-MYf3BvK9XYJvqNf-aHMNXN5ZMDQwySm/s1600/Russian+military+involved+in+NotPetya+attacks.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Russian military involved in NotPetya attacks: UK" border="0" data-original-height="450" data-original-width="800" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghzYNI6Anca1BCGPLXTKDzKA8JIHruZe9_LhR5xzxe8ZwQXo9WmTcdPFX5m1gDRJ_HRv73E1fkym1SmN75JvW1fkuPTqLa0w4zl0DvFRx01JjU-MYf3BvK9XYJvqNf-aHMNXN5ZMDQwySm/s640/Russian+military+involved+in+NotPetya+attacks.jpg" title="Russian military involved in NotPetya attacks: UK" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Russian military involved in NotPetya attacks: UK</td></tr>
</tbody></table>
<br />
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK government has officially accused the Russian government of June's disruptive and hugely costly NotPetya malware attack.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The UK Government judges that the Russian government, specifically the <a href="http://www.hackerschronicle.com/search/label/Russian%20Millitary">Russian military</a>, was responsible for the destructive NotPetya cyber-attack of June 2017," Foreign Office minister for Cyber Security, Tariq Ahmad, said in a statement.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The attack showed a continued disregard for Ukrainian sovereignty. Its reckless release disrupted organizations across Europe, costing hundreds of millions of pounds."</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Initially, NotPetya was thought to be <a href="http://www.hackerschronicle.com/search/label/Ransomeware">ransomware</a>, but security researchers quickly concluded it was more likely to be destructive <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a> designed to wipe systems.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK's National Cyber Security Centre (NCSC) today revealed it came to the same conclusion, noting that the malware was only masquerading as ransomware and its main purpose was to disrupt.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The NCSC said the Russian military was "almost certainly responsible" for the NotPetya attack.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Shipping container firm Maersk, FedEx's Dutch delivery subsidiary TNT Express, and UK firm Reckitt Benckiser were among global firms that suffered severe disruptions and several hundred million dollars in lost revenue. However, the <b>firms</b>, however, <b>were collateral damage in the ongoing conflict between Ukraine and Russia</b>.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Below is the flow of Petya Attack Flow : </div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfrK5YZfsqC6QuFhNHu1m9yN_VZ7bbK1oGuZ3gdTmJCRxM5MnqajYsWTSdyjs9ViXPqGXr_u29ZWWuvHag9u8MigR588GTZBzHjPW2xZEIGrzqxScUBcTeKBZNaJNzFkswON6w0bYBQ0vx/s1600/petya-attack-flow.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Russian military involved in NotPetya attacks: UK" border="0" data-original-height="424" data-original-width="800" height="338" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfrK5YZfsqC6QuFhNHu1m9yN_VZ7bbK1oGuZ3gdTmJCRxM5MnqajYsWTSdyjs9ViXPqGXr_u29ZWWuvHag9u8MigR588GTZBzHjPW2xZEIGrzqxScUBcTeKBZNaJNzFkswON6w0bYBQ0vx/s640/petya-attack-flow.png" title="Russian military involved in NotPetya attacks: UK" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Russian military involved in NotPetya attacks: UK</td></tr>
</tbody></table>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<br /></div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<b>NotPetya employed the NSA <a href="http://www.hackerschronicle.com/search/label/Exploits">exploits </a>for Windows known as EternalBlue and EternalRomance</b> as well as credential-dumping tools to spread internally across networks once one machine was infected. The exploits were leaked in April by The Shadow Brokers.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The malware<b> initially infected organizations via a compromised update from Ukraine</b> accounting software provider MEDoc. Its MEDoc software is one of two accounting packages required for companies doing business in Ukraine and is widely used by Ukraine agencies.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Maersk, which used MEDoc at its Ukraine offices, recently revealed it was forced to reinstall 45,000 PCs, 4,000 servers and 2,000 applications hit by NotPetya. The company reported losses of $300m due to the incident.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
NCSC notes that Ukraine's financial, energy and government institutions bore the brunt of NotPetya. However, the "indiscriminate design" of the malware caused it to spread to other European and Russian businesses.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Though it is unusual to officially blame another nation for a cyber attack, the US and Five-Eye partners blamed the WannaCry ransomware attack on North Korea. The idea, in part at least, is to name and shame nation-state attackers for their actions.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<b>Russia and North Korea have consistently denied responsibility for the NotPetya, WannaCry, and other cyber attacks.</b></div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK's Ahmad said the Kremlin has positioned Russia in direct opposition to the West.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"It doesn't have to be that way. We call upon Russia to be the responsible member of the international community it claims to be rather than secretly trying to undermine it," he said.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The United Kingdom is identifying, pursuing and responding to malicious cyber activity regardless of where it originates, imposing costs on those who would seek to do us harm."</div>
</div>

Hacking News Malwares News notPetya Ransomware Russian Hackers Russian Military Russian military involved in NotPetya attacks: UK

Russian military involved in NotPetya attacks: UK The UK government has officially accused the Russian government of June's di...

Millions of android devices Hacked

2/15/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY6e9DfRhBXaB1PX0ZsVaCJn8DW8B-yU7mVYfgw8Tv9t9h0VSn6V5VGc_GzTBD3yEi-Ofhg-8lEj_RnthL73FSM7KnDBpNlpP7yKnmK5-6VxFkOcBn13vLXDEd-c9O6YnpRtUJVzoEM8C8/s1600/Millions-Of-Android-Users-Hacked-By-This-Cryptomining-Attack.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Millions of android devices Hacked" border="0" data-original-height="420" data-original-width="800" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY6e9DfRhBXaB1PX0ZsVaCJn8DW8B-yU7mVYfgw8Tv9t9h0VSn6V5VGc_GzTBD3yEi-Ofhg-8lEj_RnthL73FSM7KnDBpNlpP7yKnmK5-6VxFkOcBn13vLXDEd-c9O6YnpRtUJVzoEM8C8/s640/Millions-Of-Android-Users-Hacked-By-This-Cryptomining-Attack.png" title="Millions of android devices Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Millions of android devices Hacked</td></tr>
</tbody></table>
<br />
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
The Android operating system and its apps are usually more exposed to security problems and the presence of malware of all kinds. With the arrival of the cryptocurrencies, this was the new focus to explore the users.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
A new campaign was recently detected and was obliging the mining of these crypto-coins.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
This new campaign is equal to many others that have been known in the past and have affected Android smartphones.<b> By routing users to dedicated sites, they are making a profit for attackers, </b>either through the display of advertising or, as in this case, by offering a processor to mine crypto-coins.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
In this case, Android users were even alerted to a supposed high processing problem and should put a captcha code in order for the situation to be resolved.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
While this process was going on, in incognito, they were mining virtual currency for the attackers. It was only a few minutes, but it surrendered to those who set up this scheme.<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrX4VrCL_lj9LcuMw3XsAWRJS_WnQPskBKOD3euTVO5kR3GLw9iWe_A50_WL4q0aYw0BrqqpQWMYkhdz8MSD1UFFbFhAKMwUa5iHcv967DmHhN39cOAraM8IMQSzqHz_i6wG_qJNSdof4/s1600/IMG-6.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Millions of android devices Hacked" border="0" data-original-height="664" data-original-width="800" height="530" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrX4VrCL_lj9LcuMw3XsAWRJS_WnQPskBKOD3euTVO5kR3GLw9iWe_A50_WL4q0aYw0BrqqpQWMYkhdz8MSD1UFFbFhAKMwUa5iHcv967DmHhN39cOAraM8IMQSzqHz_i6wG_qJNSdof4/s640/IMG-6.jpg" title="Millions of android devices Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Millions of android devices Hacked</td></tr>
</tbody></table>
<br />
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
This form of attack was included and disguised in several apps, which directed users to these sites dedicated to mining, discreetly and without them realizing that they were being used.</div>
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
The number of victims is not known but is high. We have identified at least 5 domains using the same captcha and the same keys as the Coinhive site. <b>At least 2 of these sites had more than 30 million hits per month and the 5 combined domains had about 800,000 visits per day,</b> with an average of 4 minutes per visit.</div>
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
As with the browser version of this type of attack, the sum of many users makes it profitable for attackers. It is only a few minutes that, accumulated, can revert significantly to who is managing the attack.<br />
<br /></div>
</div>
</div>

Android Cryptocurrency Hacking News Malwares News Millions of android devices Hacked

Millions of android devices Hacked The Android operating system and its apps are usually more exposed to security problems and the pr...

Western Union Money Transfer, Hacked

2/14/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpuAeT0_k1iZ9oL_nMOItMpEKtDe1t1oZ5fH2p9Yc7WrANYtc_enEGiSKIQ55TfJ-NmhT3Q6_FJk9DwIerAFLmaPCZHzPjbYpark9xpyPfIreyirI3DIc2LAUQQTW_tMbWA9yNviuWh30/s1600/WU_hacked.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="512" data-original-width="800" height="408" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhpuAeT0_k1iZ9oL_nMOItMpEKtDe1t1oZ5fH2p9Yc7WrANYtc_enEGiSKIQ55TfJ-NmhT3Q6_FJk9DwIerAFLmaPCZHzPjbYpark9xpyPfIreyirI3DIc2LAUQQTW_tMbWA9yNviuWh30/s640/WU_hacked.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Western Union Money Transfer, Hacked</td></tr>
</tbody></table>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br />
Western Union has confirmed one of its IT suppliers was hacked, and that customer information was exposed to miscreants.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
Someone, who wished to remain anonymous, showed us a copy of a letter dated January 31 that he received from the money-transfer outfit. The missive admitted that a supposedly secure data storage company used by Western Union was compromised: a database full of the wire-transfer giant's customer records was vulnerable to plundering, and hackers were quick to oblige.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"We have discovered that <b>some of your information may have been accessed without authorization as a result of a computer intrusion against an external vendor system formerly used by Western Union for secure data storage</b>," the letter read.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<span style="font-size: 16.0000400543213px; line-height: 24.0000610351563px;">"We promptly moved our external secure storage to a different vendor's system. We immediately notified law enforcement, and are actively cooperating with its investigation. Expert assistance was also immediately engaged to determine what personal information may have been compromised."</span></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
In other words, it sounds as though a <a href="http://www.hackerschronicle.com/search/label/Cloud%20Storage">cloud-based</a> or off-site backup storage provider was hacked. Now that system has been shut down, the cops alerted, and digital forensics teams are probing the network intrusion.</div>
<h3 class="crosshead" style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 1.0625em; margin: 0px 0px 5px;">
<span style="box-shadow: rgb(230, 231, 231) 0em -0.56em 0px inset;">Suspicious</span></h3>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"Upon detecting suspicious activity, Western Union permanently discontinued all use of the vendor's system and the system was taken offline," a spokesperson for Western Union told.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
"<a href="http://www.hackerschronicle.com/search/label/Western%20Union">Western Union</a> took immediate action upon learning of this intrusion to notify law enforcement authorities. The company has notified affected individuals and regulators as appropriate. Affected individuals received a customized notification that explains the specific types of his or her personal data that may have been affected."</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
According to the letter, the storage archive contained customers' contact details, bank names, Western Union internal customer ID numbers, as well as transaction amounts, times and identification numbers. Credit card data was definitely not taken, it stressed.</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<i>El Reg</i> tweeted a redacted copy of the letter earlier this week:</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<br /></div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrNxpVuL9cK13AgvKiH_UJiZswdFY6KOAXN2MDQ2fo2E7YUK7fj9eAWdPvJDPmO0dWVGME_LGJ-_pxm4JQPHvx2S8nPKhb1nZwWbQ2gR5XJzfRdS_xRF343Kw4dHMGph60yyMdOBnirsU/s1600/DV3ExpCVwAAp3Mg.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Western Union Money Transfer, Hacked" border="0" data-original-height="899" data-original-width="1199" height="478" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrNxpVuL9cK13AgvKiH_UJiZswdFY6KOAXN2MDQ2fo2E7YUK7fj9eAWdPvJDPmO0dWVGME_LGJ-_pxm4JQPHvx2S8nPKhb1nZwWbQ2gR5XJzfRdS_xRF343Kw4dHMGph60yyMdOBnirsU/s640/DV3ExpCVwAAp3Mg.jpg" title="Western Union Money Transfer, Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;"><br /></td></tr>
</tbody></table>
<div class="separator" style="clear: both; text-align: center;">
</div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
<span style="font-size: 16px;">The </span><b style="font-size: 16px;">red-faced biz was quick to point out that none of its internal payment or financial systems were affected in the attack</b><span style="font-size: 16px;">. It also isn’t saying who the third-party storage supplier was, giving other customers of the slovenly provider time to check whether or not they have been hacked too.</span></div>
<div style="background-color: white; font-family: Arimo, Arial, FreeSans, Helvetica, sans-serif; font-size: 16.0000400543213px; line-height: 24.0000610351563px;">
Western Union says that, so far, it isn't aware of any fraudulent activity stemming from the data security cockup, but just to be on the safe side it is enrolling affected customers in a year of free <a href="http://www.hackerschronicle.com/search/label/Identity%20Theft">identity-fraud</a> protection. </div>
</div>

Cloud Storage Cyber Attack Data Leak Hacking News News Western Union Western Union Money Transfer, Hacked

Western Union Money Transfer, Hacked Western Union has confirmed one of its IT suppliers was hacked, and that customer information ...