Multiple Zero-Day Vulnerabilities found in GitLab

2/22/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtGtTc2n2dMoS1A8Ytl8OAzmN-_VfghE3I8KAcA2WI7I4kHBGfjS-21GBkR2a4xxZ_92HdxKzQpaOLp83aSpwsnVYx9Z47I7XTh8Sxp379v_F-XXmtaeLcl-BAwLJ2OsSLCaYnFN4511BC/s1600/Zero-Day-in-GitLab.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Domain Hijacking Vulnerability found in GitLab" border="0" data-original-height="545" data-original-width="770" height="449" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtGtTc2n2dMoS1A8Ytl8OAzmN-_VfghE3I8KAcA2WI7I4kHBGfjS-21GBkR2a4xxZ_92HdxKzQpaOLp83aSpwsnVYx9Z47I7XTh8Sxp379v_F-XXmtaeLcl-BAwLJ2OsSLCaYnFN4511BC/s640/Zero-Day-in-GitLab.jpg" title="Domain Hijacking Vulnerability found in GitLab" width="640" /></a></div>
<br />
A security researcher hijacked hundreds of GitLab domains in just a few seconds by exploiting a weakness in how the company handles domain verification -- a security issue that the company has now fixed.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/GitLab" target="_blank">GitLab</a>, a web-based git repository manager that lets developers track and collaborate on source code and project development, also allows users to host their own content and projects with a custom domain name.<br />
<br />
But the company said in a security notification on February 5 that no validation was being performed when a user added a custom domain to their GitLab accounts. In the little time that a custom domain points to a recently deleted or unclaimed GitLab repo that will be added later, the domain can be hijacked.<br />
<br />
Edwin Foudil, known as EdOverflow, and founder of security consulting firm Penultimate, drew inspiration from a bug report submitted on February 1, which contained proof-of-concept code that listed vulnerable custom domains that were pointing to GitLab. GitLab marked the initial report as informative, which according to documentation means it contains "useful information but did not warrant an immediate action or a fix".<br />
<br />
Because GitLab allows pointing an unlimited number of domains for a single repository, Foudil was able to write a short script weaponizing that initial code, allowing him to mass hijack a limitless number of domains. "This resulted in <b>700 hijacked domains and subdomains in under one minute</b>," he told ina interview. Not only that, any hijacked domain is prevented from creating a GitLab repository with that domain.<br />
<br />
That was enough to catch GitLab's attention, with the company confirming that Foudil's "valuable report" was what "triggered our response" in releasing the security notification less than a day later. "I managed to escalate the issue to the point where the issue was in fact caused by GitLab," said Foudil. "GitLab allowed mass monitoring of domains prior to them even pointing to GitLab's IP address."<br />
<br />
<span class="highlight">Foudil's report was publicly released late Wednesday after the company fixed the bug. </span><br />
<br />
Foudil also said the attack isn't just limited to domains that his script could detect. Hijacking domains was as easy as scraping the domain names of thousands of high-ranking sites. Once a domain is taken over, the attacker can serve any content they want on that domain.<br />
<br />
"The <a href="http://www.hackerschronicle.com/search/label/Exploit" target="_blank">exploits </a>are endless," Foudil said. He gave several examples where an attacker can hijack a subdomain to read and set cookies on other basenames. "I can even mine <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency</a>," he said.<br />
<br />
Kathy Wang, director of security at GitLab, said in a phone call this week that the company took responsibility for the security issue. She added that the lack of domain verification is "a widespread problem across the industry". "Implementing domain verification is an exception not a rule -- so a lot of vendors have not yet done it," she said.<br />
<br />
GitLab switched off the feature to add custom domains until a fix was made available. The company said it estimates the fix rollout will complete by the end of the month.</div>

A security researcher hijacked hundreds of GitLab domains in just a few seconds by exploiting a weakness in how the company handles doma...

Tesla's Cloud Servers Hacked to mine Cryptocurrency

2/21/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s1600/Tesla-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Kubernetes Consoles Breached" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s640/Tesla-Servers-Hacked.png" title="Kubernetes Consoles Breached" width="640" /></a></div>
<br />
Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency</a>. The incident took place last year when hackers gained access to Tesla's Kubernetes server, an open-source application used by large companies to manage API and server infrastructure deployed on cloud hosting providers.<br />
<br />
Cloud security firm RedLock —whose experts discovered the hacked server— said hackers found a "pod" inside the <a href="http://www.hackerschronicle.com/search/label/Kubernetes" target="_blank">Kubernetes </a>console that stored login credentials for one of Tesla's AWS cloud infrastructure.<br />
<br />
RedLock says the <a href="http://www.hackerschronicle.com/search/label/AWS" target="_blank">AWS </a>buckets appeared to have been storing sensitive data such as telemetry, but a Tesla Motors spokesperson told  in an email the data was from "internally-used engineering test cars only." While there's no evidence intruders stole any data, they did install a mining application that utilized the vast computational resources of Tesla's AWS servers to mine the <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero cryptocurrency</a>.<br />
<br />
A Tesla spokesperson told that the company received a notification about the incident and secured the server immediately. RedLock said today the incident took place because Tesla engineers forgot to secure the Kubernetes console with an access password.<br />
<br />
"We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it," Tesla said. "The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way.”<br />
<br />
It is very clear that these hackers knew what they were doing, as they set up a private mining pool to use for their illegal mining operations only, hid the mining pool behind CloudFlare, configured the mining software to listen for commands on a non-standard port, and throttled the mining software to use only a small portion of <a href="http://www.hackerschronicle.com/search/label/Tesla" target="_blank">Tesla's</a> AWS CPU resources. All of these configuration changes were made to avoid detection. Because they used a custom mining pool, it is unclear how much money this hacker group made.</div>

AWS Cryptocurrency Hacking News Kubernetes Monero News Tesla Tesla's Cloud Servers Hacked to mine Cryptocurrency

Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the cryptocurrency ....

Hackers stole $1.8 mn from City Union Bank

2/19/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCkwDGToesin2s_-u3JKcwu7EYNjhNHZPArCZ3aLVPSbJnMEp8dlwlUaTKh-E5s3eFmmbyoUgKG2d_xPJXaXyjUkIO6aB25A9eCqXfl7fNS7GwkHt7wuP4Eh_qqmrCLa18nSolezTPTyRs/s1600/city-union-bank-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="city-union-bank-hacked" border="0" data-original-height="541" data-original-width="800" height="432" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCkwDGToesin2s_-u3JKcwu7EYNjhNHZPArCZ3aLVPSbJnMEp8dlwlUaTKh-E5s3eFmmbyoUgKG2d_xPJXaXyjUkIO6aB25A9eCqXfl7fNS7GwkHt7wuP4Eh_qqmrCLa18nSolezTPTyRs/s640/city-union-bank-hacked.jpg" title="city-union-bank-hacked" width="640" /></a></div><br />
A year after the SWIFT international bank transfer system enhanced its security, another breach has emerged: an Indian bank has confirmed that criminals gained access to its systems and made <span class="highlight">transfers totaling US$1.8 million.</span><br />
<br />
The Kumbakonam-based City Union Bank <a href="https://www.cityunionbank.com/downloads/Press_Release_swift.pdf" target="_blank">issued a statement</a> on Sunday February 18, in response to local media speculation that three unauthorized transactions were initiated by staff. In it, the bank says it suffered an attack by <span class="highlight">“international cyber-criminals and there is no evidence of internal staff involvement”.</span> The statement says the transactions took place on or before February 7, when its reconciliation processes identified the three fraudulent transactions.<br />
<br />
A transfer of $500,000 through Standard Chartered to a Dubai bank was blocked at the source. That's good news, of a sort, because SWIFT launched a scanning service designed to spot fraudulent transactions in April 2017, as part of its response to the 2016 incident that saw second-hand security kit used at Bangladesh Bank let attackers into the international funds transfer system. <span class="highlight">On that occasion, $81 million was transferred.</span> The attackers tried to steal over $1bn, but were thwarted by a typo in one of their attempted transfers.<br />
<br />
SWIFT later warned banks to tighten their security.It remained a plum target, however, and in October 2017, a Taiwanese bank had $60 million pinched. Those funds were recovered, and the attackers arrested. It appears that SWIFT's dodgy-deal-detectors worked for the transfer to Dubai. But a second made it to a Turkish bank and $1m is still missing after being transferred through a Bank of America account to a Chinese destination and withdrawn by an unknown beneficiary.<br />
<br />
The Indian consulate in Istanbul is assisting with efforts to recover funds from the Turkish transfer. City Union Bank added that its SWIFT system is back in operation with “adequate enhanced security”. Just how the alleged criminals exploited the Bank's previous security regime has not been revealed, so it is unknown if SWIFT or Union Bank is the source of the problem.</div>

City Union Bank Cyber Attack Hacking News News SWIFT Hackers stole $1.8 mn from City Union Bank

A year after the SWIFT international bank transfer system enhanced its security, another breach has emerged: an Indian bank has confirmed t...

Thousands of Jenkins Servers Hacked to mine Monero

2/18/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s1600/JenkinsMinerMalware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Hacked-to-Mine-Monero" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s640/JenkinsMinerMalware.png" title="Jenkins-Hacked-to-Mine-Monero" width="640" /></a></div>
A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency.<br />
<br />
Hackers are targeting <a href="http://www.hackerschronicle.com/search/label/Jenkins" target="_blank">Jenkins</a>, a continuous integration/deployment web application built in Java that allows dev teams to run automated tests and execute various operations based on test results, including deploying new code to production servers. Because of this, Jenkins servers are extremely popular with both freelance web developers, but also with large enterprises.<br />
<br />
A cyber security research firm announced it uncovered the footprint of a large hacking operation targeting Jenkins servers left connected to the Internet.<br />
<br />
<b>Hackers using Jenkins RCE flaw</b><br />
Attackers were leveraging <a href="https://jenkins.io/security/advisory/2017-04-26/" target="_blank">CVE-2017-1000353</a>, a vulnerability in the Jenkins Java deserialization implementation that allows attackers to run malicious code remotely without needing to authenticate first. Hackers used this vulnerability to make Jenkins servers download and install a <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>miner (minerxmr.exe).<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s1600/Jenkins-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Servers-Hacked" border="0" data-original-height="438" data-original-width="894" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s640/Jenkins-Servers-Hacked.png" title="Jenkins-Servers-Hacked" width="640" /></a></div>
The miner was being downloaded from an IP address located in <a href="http://www.hackerschronicle.com/search/label/Chinese%20Hackers" target="_blank">China </a>and assigned to the Huaian government network. It is unclear if this is the attacker's server, or a compromised server used to host the miner on behalf of the hackers.<br />
<br />
The attackers have been active for months. This has allowed them to mine and already <b>cash out over 10,800 Monero, which is over $3.4 million</b>, at the time of writing.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s1600/Monero-Mining-Malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Monero-Mining-Malware" border="0" data-original-height="475" data-original-width="1175" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s640/Monero-Mining-Malware.png" title="Monero-Mining-Malware" width="640" /></a></div>
Researchers say the group appears to have compromised mostly Jenkins instances running on Windows operating systems.<br />
<br />
<b>Over 25,000 Jenkins servers left exposed online</b><br />
Attackers aren't the only ones who've noticed the large number of Jenkins servers available online. In mid-January, security researcher Mikail Tunç published <a href="https://emtunc.org/blog/01/2018/research-misconfigured-jenkins-servers/" target="_blank">research</a> highlighting that there were over 25,000 Jenkins servers left exposed to Internet connections at the time of his research.<br />
<br />
Also on Friday, Researchers released new research on other hackers leveraging the <b>CVE-2017-10271</b> flaw to infect Oracle WebLogic servers with malware. This vulnerability has been under active exploitation <b>since early December 2017</b>, and one group has already made <b>more than $226,000</b>.<br />
<br />
Besides Jenkins and <b>Oracle WebLogic</b> servers, hackers are also targeting <b>Ruby on Rails, PHP, and IIS </b>servers, also deploying Monero-mining malware.<br />
<br />
Monero-mining malware is already this year's biggest <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware trend/problem</a>, with numerous malware distribution campaigns spreading such payloads on any unsecured computer/server crooks can get their hands on.</div>

Cryptocurrency Hacking News Jenkins Malwares Miner Monero News Thousands of Jenkins Servers Hacked to mine Monero

A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency. H...

New search engine launched to find Hackable Servers

2/17/2018 cyb3r.gladiat0r 0

AWS BuckHacker Hacking Tools News S3 New search engine launched to find Hackable Servers

New search engine launched to find Hackable Servers We all know very well that more and more users are simply choosing to save their d...

Russian military involved in NotPetya attacks: UK

2/16/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghzYNI6Anca1BCGPLXTKDzKA8JIHruZe9_LhR5xzxe8ZwQXo9WmTcdPFX5m1gDRJ_HRv73E1fkym1SmN75JvW1fkuPTqLa0w4zl0DvFRx01JjU-MYf3BvK9XYJvqNf-aHMNXN5ZMDQwySm/s1600/Russian+military+involved+in+NotPetya+attacks.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Russian military involved in NotPetya attacks: UK" border="0" data-original-height="450" data-original-width="800" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEghzYNI6Anca1BCGPLXTKDzKA8JIHruZe9_LhR5xzxe8ZwQXo9WmTcdPFX5m1gDRJ_HRv73E1fkym1SmN75JvW1fkuPTqLa0w4zl0DvFRx01JjU-MYf3BvK9XYJvqNf-aHMNXN5ZMDQwySm/s640/Russian+military+involved+in+NotPetya+attacks.jpg" title="Russian military involved in NotPetya attacks: UK" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Russian military involved in NotPetya attacks: UK</td></tr>
</tbody></table>
<br />
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK government has officially accused the Russian government of June's disruptive and hugely costly NotPetya malware attack.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The UK Government judges that the Russian government, specifically the <a href="http://www.hackerschronicle.com/search/label/Russian%20Millitary">Russian military</a>, was responsible for the destructive NotPetya cyber-attack of June 2017," Foreign Office minister for Cyber Security, Tariq Ahmad, said in a statement.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The attack showed a continued disregard for Ukrainian sovereignty. Its reckless release disrupted organizations across Europe, costing hundreds of millions of pounds."</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Initially, NotPetya was thought to be <a href="http://www.hackerschronicle.com/search/label/Ransomeware">ransomware</a>, but security researchers quickly concluded it was more likely to be destructive <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a> designed to wipe systems.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK's National Cyber Security Centre (NCSC) today revealed it came to the same conclusion, noting that the malware was only masquerading as ransomware and its main purpose was to disrupt.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The NCSC said the Russian military was "almost certainly responsible" for the NotPetya attack.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Shipping container firm Maersk, FedEx's Dutch delivery subsidiary TNT Express, and UK firm Reckitt Benckiser were among global firms that suffered severe disruptions and several hundred million dollars in lost revenue. However, the <b>firms</b>, however, <b>were collateral damage in the ongoing conflict between Ukraine and Russia</b>.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Below is the flow of Petya Attack Flow : </div>
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfrK5YZfsqC6QuFhNHu1m9yN_VZ7bbK1oGuZ3gdTmJCRxM5MnqajYsWTSdyjs9ViXPqGXr_u29ZWWuvHag9u8MigR588GTZBzHjPW2xZEIGrzqxScUBcTeKBZNaJNzFkswON6w0bYBQ0vx/s1600/petya-attack-flow.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Russian military involved in NotPetya attacks: UK" border="0" data-original-height="424" data-original-width="800" height="338" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjfrK5YZfsqC6QuFhNHu1m9yN_VZ7bbK1oGuZ3gdTmJCRxM5MnqajYsWTSdyjs9ViXPqGXr_u29ZWWuvHag9u8MigR588GTZBzHjPW2xZEIGrzqxScUBcTeKBZNaJNzFkswON6w0bYBQ0vx/s640/petya-attack-flow.png" title="Russian military involved in NotPetya attacks: UK" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Russian military involved in NotPetya attacks: UK</td></tr>
</tbody></table>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<br /></div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<b>NotPetya employed the NSA <a href="http://www.hackerschronicle.com/search/label/Exploits">exploits </a>for Windows known as EternalBlue and EternalRomance</b> as well as credential-dumping tools to spread internally across networks once one machine was infected. The exploits were leaked in April by The Shadow Brokers.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The malware<b> initially infected organizations via a compromised update from Ukraine</b> accounting software provider MEDoc. Its MEDoc software is one of two accounting packages required for companies doing business in Ukraine and is widely used by Ukraine agencies.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Maersk, which used MEDoc at its Ukraine offices, recently revealed it was forced to reinstall 45,000 PCs, 4,000 servers and 2,000 applications hit by NotPetya. The company reported losses of $300m due to the incident.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
NCSC notes that Ukraine's financial, energy and government institutions bore the brunt of NotPetya. However, the "indiscriminate design" of the malware caused it to spread to other European and Russian businesses.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
Though it is unusual to officially blame another nation for a cyber attack, the US and Five-Eye partners blamed the WannaCry ransomware attack on North Korea. The idea, in part at least, is to name and shame nation-state attackers for their actions.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
<b>Russia and North Korea have consistently denied responsibility for the NotPetya, WannaCry, and other cyber attacks.</b></div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
The UK's Ahmad said the Kremlin has positioned Russia in direct opposition to the West.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"It doesn't have to be that way. We call upon Russia to be the responsible member of the international community it claims to be rather than secretly trying to undermine it," he said.</div>
<div style="background-color: white; color: #080e14; font-family: Raleway, sans-serif; font-size: 18px; line-height: 30px; margin-bottom: 21px;">
"The United Kingdom is identifying, pursuing and responding to malicious cyber activity regardless of where it originates, imposing costs on those who would seek to do us harm."</div>
</div>

Hacking News Malwares News notPetya Ransomware Russian Hackers Russian Military Russian military involved in NotPetya attacks: UK

Russian military involved in NotPetya attacks: UK The UK government has officially accused the Russian government of June's di...

Millions of android devices Hacked

2/15/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY6e9DfRhBXaB1PX0ZsVaCJn8DW8B-yU7mVYfgw8Tv9t9h0VSn6V5VGc_GzTBD3yEi-Ofhg-8lEj_RnthL73FSM7KnDBpNlpP7yKnmK5-6VxFkOcBn13vLXDEd-c9O6YnpRtUJVzoEM8C8/s1600/Millions-Of-Android-Users-Hacked-By-This-Cryptomining-Attack.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Millions of android devices Hacked" border="0" data-original-height="420" data-original-width="800" height="336" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiY6e9DfRhBXaB1PX0ZsVaCJn8DW8B-yU7mVYfgw8Tv9t9h0VSn6V5VGc_GzTBD3yEi-Ofhg-8lEj_RnthL73FSM7KnDBpNlpP7yKnmK5-6VxFkOcBn13vLXDEd-c9O6YnpRtUJVzoEM8C8/s640/Millions-Of-Android-Users-Hacked-By-This-Cryptomining-Attack.png" title="Millions of android devices Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Millions of android devices Hacked</td></tr>
</tbody></table>
<br />
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
The Android operating system and its apps are usually more exposed to security problems and the presence of malware of all kinds. With the arrival of the cryptocurrencies, this was the new focus to explore the users.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
A new campaign was recently detected and was obliging the mining of these crypto-coins.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
This new campaign is equal to many others that have been known in the past and have affected Android smartphones.<b> By routing users to dedicated sites, they are making a profit for attackers, </b>either through the display of advertising or, as in this case, by offering a processor to mine crypto-coins.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
In this case, Android users were even alerted to a supposed high processing problem and should put a captcha code in order for the situation to be resolved.</div>
<div style="background-color: white; border: 0px; color: #222222; font-family: helvetica, arial, sans-serif; font-size: 17px; font-stretch: inherit; line-height: 27px; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
While this process was going on, in incognito, they were mining virtual currency for the attackers. It was only a few minutes, but it surrendered to those who set up this scheme.<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrX4VrCL_lj9LcuMw3XsAWRJS_WnQPskBKOD3euTVO5kR3GLw9iWe_A50_WL4q0aYw0BrqqpQWMYkhdz8MSD1UFFbFhAKMwUa5iHcv967DmHhN39cOAraM8IMQSzqHz_i6wG_qJNSdof4/s1600/IMG-6.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Millions of android devices Hacked" border="0" data-original-height="664" data-original-width="800" height="530" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgVrX4VrCL_lj9LcuMw3XsAWRJS_WnQPskBKOD3euTVO5kR3GLw9iWe_A50_WL4q0aYw0BrqqpQWMYkhdz8MSD1UFFbFhAKMwUa5iHcv967DmHhN39cOAraM8IMQSzqHz_i6wG_qJNSdof4/s640/IMG-6.jpg" title="Millions of android devices Hacked" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Millions of android devices Hacked</td></tr>
</tbody></table>
<br />
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
This form of attack was included and disguised in several apps, which directed users to these sites dedicated to mining, discreetly and without them realizing that they were being used.</div>
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
The number of victims is not known but is high. We have identified at least 5 domains using the same captcha and the same keys as the Coinhive site. <b>At least 2 of these sites had more than 30 million hits per month and the 5 combined domains had about 800,000 visits per day,</b> with an average of 4 minutes per visit.</div>
<div style="border: 0px; font-stretch: inherit; margin-bottom: 20px; padding: 0px; vertical-align: baseline;">
As with the browser version of this type of attack, the sum of many users makes it profitable for attackers. It is only a few minutes that, accumulated, can revert significantly to who is managing the attack.<br />
<br /></div>
</div>
</div>

Android Cryptocurrency Hacking News Malwares News Millions of android devices Hacked

Millions of android devices Hacked The Android operating system and its apps are usually more exposed to security problems and the pr...