Tinder Can be Hacked With Just A Phone Number

2/24/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
</div>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgehEVfwVifii9PVyN4jljzRWNf7Aq9CRzeVV3M8avQnbv1-oc6BWor6hyphenhypheniWs7qwFHIp5mfvgrHB6CdYIoqPANLqrhba0FOfYD1SF0UQ9B7vbJxYuBh_Da3TuSD6fqrMkqpMADMqm-976Er/s1600/Tinder-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Tinder vulnerability let hackers take over accounts with just a phone number" border="0" data-original-height="640" data-original-width="960" height="425" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgehEVfwVifii9PVyN4jljzRWNf7Aq9CRzeVV3M8avQnbv1-oc6BWor6hyphenhypheniWs7qwFHIp5mfvgrHB6CdYIoqPANLqrhba0FOfYD1SF0UQ9B7vbJxYuBh_Da3TuSD6fqrMkqpMADMqm-976Er/s640/Tinder-Hacked.png" title="Tinder vulnerability let hackers take over accounts with just a phone number" width="640" /></a></div>
<br />
An easy-to-exploit bug has left Tinder accounts and private chats exposed to hackers, revealed a researcher this week.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Indian%20Hackers" target="_blank">Indian engineer</a> Anand Prakash, a serial bug hunter, said on Wednesday, 20 February, that a flaw in a <a href="http://www.hackerschronicle.com/search/label/Facebook" target="_blank">Facebook</a>-linked program called Account Kit let attackers access profiles armed with just a phone number. Account Kit has been implemented on Tinder and it has been used by developers to let users log on to a range of apps using mobile details or email addresses without a password.<br />
<br />
That should not have been enough for an account takeover by itself, but <a href="http://www.hackerschronicle.com/search/label/Tinder" target="_blank">Tinder</a>’s implementation of Account Kit had its own vulnerability. Tinder’s login system wasn’t verifying access tokens against their associated client ID, which meant anyone with a valid access token could take over an entire account. Chained together, the two <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerabilities </a>let researchers completely take over a Tinder account — with full access to the user’s profile and chats — starting from only a phone number.<br />
<br />
According to Prakash, an ethical hacker known for finding bugs in popular websites, until recently, there was a crack in this process that could let hackers compromise "access tokens" from users' cookies. The attacker could then exploit a bug in Tinder to use the token, which stores security details, and log in to the dating account with little fuss.<br />
<br />
Earlier this year, on 23 January, a different set of “disturbing” vulnerabilities were found in Tinder's <a href="http://www.hackerschronicle.com/search/label/Android" target="_blank">Android </a>and iOS apps by Checkmarx Security Research Team.<br />
<br />
Experts said hackers could use them to take control of profile pictures and swap them for “inappropriate content, rogue advertising or other type of malicious content.” The firm claimed that nefarious attackers could “monitor the user's every move” on the application.<br />
<br />
A bug within Tinder is problematic as the app boasts an estimated 50 million users worldwide with roughly 40 percent of them based in North America, and a million dates facilitated a week according to the website, along with 1.6 billion swipes a day.<br />
<br />
Tinder declined to comment on the specifics of the report. “Security is a top priority at Tinder,” a representative said, “However, we do not discuss any specific security measures or strategies, so as not to tip off malicious hackers.”</div>

An easy-to-exploit bug has left Tinder accounts and private chats exposed to hackers, revealed a researcher this week. Indian engine...

After Nirav Modi, Hackers are targeting Punjab National Bank

2/23/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxI3_ffIRgsUVDxeyzqvySZ4SQEZoCHHmw_amNPS6rUSwYlqnFOJ5clv8AQCC7fYqZX45iv7Vz18aLit1O3UdeoTiNO7kZBMiihfLDK3ETjhAQjgkyBI2x2KrPiJSOlcSYHIf-pQ-BodTw/s1600/PNB-Data-Breached.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="PNB Debit/Credit cards information Breached" border="0" data-original-height="433" data-original-width="770" height="356" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxI3_ffIRgsUVDxeyzqvySZ4SQEZoCHHmw_amNPS6rUSwYlqnFOJ5clv8AQCC7fYqZX45iv7Vz18aLit1O3UdeoTiNO7kZBMiihfLDK3ETjhAQjgkyBI2x2KrPiJSOlcSYHIf-pQ-BodTw/s640/PNB-Data-Breached.jpg" title="PNB Debit/Credit cards information Breached" width="640" /></a></div>
<br />
Punjab National Bank has reported a <b><a href="http://www.hackerschronicle.com/search/label/Data%20Leak" target="_blank">data breach</a> affecting as many as 10,000 credit and debit card customers</b>, and security experts believe that sensitive information has been available for  purchase through a website for at least three months.<br />
<br />
The disclosure will raise further questions about security levels at the bank, which is already under stress over a reported Rs 11,300 crore fraud involving fake letters of guarantee that were allegedly used by leading jeweller Nirav Modi to raise funds from banks. Two PNB employees allegedly colluded with Modi and his uncle in the scam.<br />
<br />
<u>PNB was not aware of the data breach  until it was tipped off on Wednesday night</u> by CloudSek Information Security, a company registered in Singapore but mainly operating in Bengaluru, India, that monitors data transactions.<br />
<br />
“We have a crawler that is deployed in the <a href="http://www.hackerschronicle.com/search/label/Darknet" target="_blank">dark/deep web</a>. These are sites on the internet which are not indexed by Google or other major search engines. They are used to buy and sell sensitive data illegally,” said chief technical officer Rahul Sasi. “Our crawler detects any such data and sends it to a Machine Learning software that we have created. If this detects anything that is suspicious, and of interest to our clients, we immediately take action.”<br />
<br />
He said CloudSek was unable to contact <a href="http://www.hackerschronicle.com/search/label/PNB" target="_blank">PNB </a>after detecting the breach as it is not a customer at the bank, but eventually passed the details through a government agency. PNB’s Chief Information Security Officer T D Virwani confirmed it was working with the government to contain fallout from the release of the data, which was offered through a blackhat website.<br />
<br />
Government officials who are aware of the breach said other relevant agencies had been alerted and they were trying to establish the extent of the problem. So far, they have discovered sensitive information from as many as 10,000 credit cards issued by the bank.<br />
<br />
<b>This includes names, expiry dates, Personal Identification Numbers and Card Verification Values.</b> Sasi said two sets of data were released: some with CVV numbers and some without. The last date stamp on the data is January 29, 2018, indicating that the details are still current for thousands of card customers.<br />
<br />
“We believe, on preliminary analysis, that the data has been available for at least three months. While this is yet to be firmly established, we are carrying out our forensic investigation,” said a government official familiar with the case. Virwani was asked to comment on the breach, but has not yet responded.<br />
<br />
Investigators in both the private and government sectors are still trying to determine how the breach occurred. It is thought the data could have come from a laptop or mobile phone carried by a bank customer that was infected with a malicious code, or from a third party. Payment gateways also had access to the data.<br />
<br />
But an investigator said it was more likely the bank’s security was compromised, as a large amount of data came from a single source.<br />
<br />
“Usually these sites on the deep/dark web build up reputations on the authenticity of the data they sell illegally. This particular site has a very good reputation. They offer a sample size to buyers to establish their credentials before the sale is made. In this case they were <span class="highlight">offering to sell the data at US$4.90 per card</span>,” he reported.<br />
<br />
Sasi said all options were possible, but there wasn’t enough information yet to be certain how the leak had taken place.<br />
<br />
It is the second big data leak in recent years in India. In October 2016 more than 3.2 million <a href="http://www.hackerschronicle.com/search/label/Credit%20Card" target="_blank">credit and debit cards</a> issued by numerous banks had to be recalled after customers reported they were used illegally in China and other countries. An investigation revealed that computer systems of a private payment services firm that manages ATM machines for a large Indian bank had been hacked.</div>

Credit Card Darknet Data Leak News PNB After Nirav Modi, Hackers are targeting Punjab National Bank

Punjab National Bank has reported a data breach affecting as many as 10,000 credit and debit card customers , and security experts beli...

Multiple Zero-Day Vulnerabilities found in GitLab

2/22/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtGtTc2n2dMoS1A8Ytl8OAzmN-_VfghE3I8KAcA2WI7I4kHBGfjS-21GBkR2a4xxZ_92HdxKzQpaOLp83aSpwsnVYx9Z47I7XTh8Sxp379v_F-XXmtaeLcl-BAwLJ2OsSLCaYnFN4511BC/s1600/Zero-Day-in-GitLab.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Domain Hijacking Vulnerability found in GitLab" border="0" data-original-height="545" data-original-width="770" height="449" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjtGtTc2n2dMoS1A8Ytl8OAzmN-_VfghE3I8KAcA2WI7I4kHBGfjS-21GBkR2a4xxZ_92HdxKzQpaOLp83aSpwsnVYx9Z47I7XTh8Sxp379v_F-XXmtaeLcl-BAwLJ2OsSLCaYnFN4511BC/s640/Zero-Day-in-GitLab.jpg" title="Domain Hijacking Vulnerability found in GitLab" width="640" /></a></div>
<br />
A security researcher hijacked hundreds of GitLab domains in just a few seconds by exploiting a weakness in how the company handles domain verification -- a security issue that the company has now fixed.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/GitLab" target="_blank">GitLab</a>, a web-based git repository manager that lets developers track and collaborate on source code and project development, also allows users to host their own content and projects with a custom domain name.<br />
<br />
But the company said in a security notification on February 5 that no validation was being performed when a user added a custom domain to their GitLab accounts. In the little time that a custom domain points to a recently deleted or unclaimed GitLab repo that will be added later, the domain can be hijacked.<br />
<br />
Edwin Foudil, known as EdOverflow, and founder of security consulting firm Penultimate, drew inspiration from a bug report submitted on February 1, which contained proof-of-concept code that listed vulnerable custom domains that were pointing to GitLab. GitLab marked the initial report as informative, which according to documentation means it contains "useful information but did not warrant an immediate action or a fix".<br />
<br />
Because GitLab allows pointing an unlimited number of domains for a single repository, Foudil was able to write a short script weaponizing that initial code, allowing him to mass hijack a limitless number of domains. "This resulted in <b>700 hijacked domains and subdomains in under one minute</b>," he told ina interview. Not only that, any hijacked domain is prevented from creating a GitLab repository with that domain.<br />
<br />
That was enough to catch GitLab's attention, with the company confirming that Foudil's "valuable report" was what "triggered our response" in releasing the security notification less than a day later. "I managed to escalate the issue to the point where the issue was in fact caused by GitLab," said Foudil. "GitLab allowed mass monitoring of domains prior to them even pointing to GitLab's IP address."<br />
<br />
<span class="highlight">Foudil's report was publicly released late Wednesday after the company fixed the bug. </span><br />
<br />
Foudil also said the attack isn't just limited to domains that his script could detect. Hijacking domains was as easy as scraping the domain names of thousands of high-ranking sites. Once a domain is taken over, the attacker can serve any content they want on that domain.<br />
<br />
"The <a href="http://www.hackerschronicle.com/search/label/Exploit" target="_blank">exploits </a>are endless," Foudil said. He gave several examples where an attacker can hijack a subdomain to read and set cookies on other basenames. "I can even mine <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency</a>," he said.<br />
<br />
Kathy Wang, director of security at GitLab, said in a phone call this week that the company took responsibility for the security issue. She added that the lack of domain verification is "a widespread problem across the industry". "Implementing domain verification is an exception not a rule -- so a lot of vendors have not yet done it," she said.<br />
<br />
GitLab switched off the feature to add custom domains until a fix was made available. The company said it estimates the fix rollout will complete by the end of the month.</div>

DevOps GitLab Hacking News News Vulnerability Zero-Day Multiple Zero-Day Vulnerabilities found in GitLab

A security researcher hijacked hundreds of GitLab domains in just a few seconds by exploiting a weakness in how the company handles doma...

Tesla's Cloud Servers Hacked to mine Cryptocurrency

2/21/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s1600/Tesla-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Kubernetes Consoles Breached" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjqqm-HpAKvp8ZK0vh2iwUn4veaWHvZ-jCZ9zwWH12tpXaCB3cCrUiPaS-QurepFgnip3g2A5Ak1shidzjHAecuYx2vp9mEf6KiGe9Qn9Oltl-F-KoacbQHe75_CTbsaiaFy0rcoBuIp707/s640/Tesla-Servers-Hacked.png" title="Kubernetes Consoles Breached" width="640" /></a></div>
<br />
Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency</a>. The incident took place last year when hackers gained access to Tesla's Kubernetes server, an open-source application used by large companies to manage API and server infrastructure deployed on cloud hosting providers.<br />
<br />
Cloud security firm RedLock —whose experts discovered the hacked server— said hackers found a "pod" inside the <a href="http://www.hackerschronicle.com/search/label/Kubernetes" target="_blank">Kubernetes </a>console that stored login credentials for one of Tesla's AWS cloud infrastructure.<br />
<br />
RedLock says the <a href="http://www.hackerschronicle.com/search/label/AWS" target="_blank">AWS </a>buckets appeared to have been storing sensitive data such as telemetry, but a Tesla Motors spokesperson told  in an email the data was from "internally-used engineering test cars only." While there's no evidence intruders stole any data, they did install a mining application that utilized the vast computational resources of Tesla's AWS servers to mine the <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero cryptocurrency</a>.<br />
<br />
A Tesla spokesperson told that the company received a notification about the incident and secured the server immediately. RedLock said today the incident took place because Tesla engineers forgot to secure the Kubernetes console with an access password.<br />
<br />
"We maintain a bug bounty program to encourage this type of research, and we addressed this vulnerability within hours of learning about it," Tesla said. "The impact seems to be limited to internally-used engineering test cars only, and our initial investigation found no indication that customer privacy or vehicle safety or security was compromised in any way.”<br />
<br />
It is very clear that these hackers knew what they were doing, as they set up a private mining pool to use for their illegal mining operations only, hid the mining pool behind CloudFlare, configured the mining software to listen for commands on a non-standard port, and throttled the mining software to use only a small portion of <a href="http://www.hackerschronicle.com/search/label/Tesla" target="_blank">Tesla's</a> AWS CPU resources. All of these configuration changes were made to avoid detection. Because they used a custom mining pool, it is unclear how much money this hacker group made.</div>

AWS Cryptocurrency Hacking News Kubernetes Monero News Tesla Tesla's Cloud Servers Hacked to mine Cryptocurrency

Hackers have breached Tesla cloud servers used by the company's engineers and have installed malware that mines the cryptocurrency ....

Hackers stole $1.8 mn from City Union Bank

2/19/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCkwDGToesin2s_-u3JKcwu7EYNjhNHZPArCZ3aLVPSbJnMEp8dlwlUaTKh-E5s3eFmmbyoUgKG2d_xPJXaXyjUkIO6aB25A9eCqXfl7fNS7GwkHt7wuP4Eh_qqmrCLa18nSolezTPTyRs/s1600/city-union-bank-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="city-union-bank-hacked" border="0" data-original-height="541" data-original-width="800" height="432" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCkwDGToesin2s_-u3JKcwu7EYNjhNHZPArCZ3aLVPSbJnMEp8dlwlUaTKh-E5s3eFmmbyoUgKG2d_xPJXaXyjUkIO6aB25A9eCqXfl7fNS7GwkHt7wuP4Eh_qqmrCLa18nSolezTPTyRs/s640/city-union-bank-hacked.jpg" title="city-union-bank-hacked" width="640" /></a></div><br />
A year after the SWIFT international bank transfer system enhanced its security, another breach has emerged: an Indian bank has confirmed that criminals gained access to its systems and made <span class="highlight">transfers totaling US$1.8 million.</span><br />
<br />
The Kumbakonam-based City Union Bank <a href="https://www.cityunionbank.com/downloads/Press_Release_swift.pdf" target="_blank">issued a statement</a> on Sunday February 18, in response to local media speculation that three unauthorized transactions were initiated by staff. In it, the bank says it suffered an attack by <span class="highlight">“international cyber-criminals and there is no evidence of internal staff involvement”.</span> The statement says the transactions took place on or before February 7, when its reconciliation processes identified the three fraudulent transactions.<br />
<br />
A transfer of $500,000 through Standard Chartered to a Dubai bank was blocked at the source. That's good news, of a sort, because SWIFT launched a scanning service designed to spot fraudulent transactions in April 2017, as part of its response to the 2016 incident that saw second-hand security kit used at Bangladesh Bank let attackers into the international funds transfer system. <span class="highlight">On that occasion, $81 million was transferred.</span> The attackers tried to steal over $1bn, but were thwarted by a typo in one of their attempted transfers.<br />
<br />
SWIFT later warned banks to tighten their security.It remained a plum target, however, and in October 2017, a Taiwanese bank had $60 million pinched. Those funds were recovered, and the attackers arrested. It appears that SWIFT's dodgy-deal-detectors worked for the transfer to Dubai. But a second made it to a Turkish bank and $1m is still missing after being transferred through a Bank of America account to a Chinese destination and withdrawn by an unknown beneficiary.<br />
<br />
The Indian consulate in Istanbul is assisting with efforts to recover funds from the Turkish transfer. City Union Bank added that its SWIFT system is back in operation with “adequate enhanced security”. Just how the alleged criminals exploited the Bank's previous security regime has not been revealed, so it is unknown if SWIFT or Union Bank is the source of the problem.</div>

City Union Bank Cyber Attack Hacking News News SWIFT Hackers stole $1.8 mn from City Union Bank

A year after the SWIFT international bank transfer system enhanced its security, another breach has emerged: an Indian bank has confirmed t...

Thousands of Jenkins Servers Hacked to mine Monero

2/18/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s1600/JenkinsMinerMalware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Hacked-to-Mine-Monero" border="0" data-original-height="455" data-original-width="1250" height="232" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi30dKMYj2OqNHjon8iwHK-B2-NX3L8DMpuxaf4Uz35m9U95sYLWh6_RvDzVGhuVrhQBYPWzbBpLejYYk90VBl9AMWNMvPogHpX7d3VRjqIr5V0IUmp6dSy7nu3y_d2rB5N5Vmkbf9Pebv8/s640/JenkinsMinerMalware.png" title="Jenkins-Hacked-to-Mine-Monero" width="640" /></a></div>
A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency.<br />
<br />
Hackers are targeting <a href="http://www.hackerschronicle.com/search/label/Jenkins" target="_blank">Jenkins</a>, a continuous integration/deployment web application built in Java that allows dev teams to run automated tests and execute various operations based on test results, including deploying new code to production servers. Because of this, Jenkins servers are extremely popular with both freelance web developers, but also with large enterprises.<br />
<br />
A cyber security research firm announced it uncovered the footprint of a large hacking operation targeting Jenkins servers left connected to the Internet.<br />
<br />
<b>Hackers using Jenkins RCE flaw</b><br />
Attackers were leveraging <a href="https://jenkins.io/security/advisory/2017-04-26/" target="_blank">CVE-2017-1000353</a>, a vulnerability in the Jenkins Java deserialization implementation that allows attackers to run malicious code remotely without needing to authenticate first. Hackers used this vulnerability to make Jenkins servers download and install a <a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>miner (minerxmr.exe).<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s1600/Jenkins-Servers-Hacked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Jenkins-Servers-Hacked" border="0" data-original-height="438" data-original-width="894" height="312" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjGiJBIbSv3T6AcNnIggGFU6KI9Fa7h_RMAkL2X178JZtCNr18o3UaL6pDbIrFHphdQhExL1qczWJZima4L3odaVMSPBcfBENnzYP2UvBu0xMYyf3g12jVpeh5-tHTLbcfz8CFuWHiG5EZ3/s640/Jenkins-Servers-Hacked.png" title="Jenkins-Servers-Hacked" width="640" /></a></div>
The miner was being downloaded from an IP address located in <a href="http://www.hackerschronicle.com/search/label/Chinese%20Hackers" target="_blank">China </a>and assigned to the Huaian government network. It is unclear if this is the attacker's server, or a compromised server used to host the miner on behalf of the hackers.<br />
<br />
The attackers have been active for months. This has allowed them to mine and already <b>cash out over 10,800 Monero, which is over $3.4 million</b>, at the time of writing.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s1600/Monero-Mining-Malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Monero-Mining-Malware" border="0" data-original-height="475" data-original-width="1175" height="257" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiAqpuzY6xKEdjtbSmFtVncj31DDAvoeEG1EWeQhjXtUuETPrbwk2kSmDGOM-LnQyGWO_h9yvUBMqsK8YJ89JXXivyRoJryex7oY0lESJFLvrzSy6GjANkgpdJ_SN23HSFr9OMHvLoQy1vc/s640/Monero-Mining-Malware.png" title="Monero-Mining-Malware" width="640" /></a></div>
Researchers say the group appears to have compromised mostly Jenkins instances running on Windows operating systems.<br />
<br />
<b>Over 25,000 Jenkins servers left exposed online</b><br />
Attackers aren't the only ones who've noticed the large number of Jenkins servers available online. In mid-January, security researcher Mikail Tunç published <a href="https://emtunc.org/blog/01/2018/research-misconfigured-jenkins-servers/" target="_blank">research</a> highlighting that there were over 25,000 Jenkins servers left exposed to Internet connections at the time of his research.<br />
<br />
Also on Friday, Researchers released new research on other hackers leveraging the <b>CVE-2017-10271</b> flaw to infect Oracle WebLogic servers with malware. This vulnerability has been under active exploitation <b>since early December 2017</b>, and one group has already made <b>more than $226,000</b>.<br />
<br />
Besides Jenkins and <b>Oracle WebLogic</b> servers, hackers are also targeting <b>Ruby on Rails, PHP, and IIS </b>servers, also deploying Monero-mining malware.<br />
<br />
Monero-mining malware is already this year's biggest <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware trend/problem</a>, with numerous malware distribution campaigns spreading such payloads on any unsecured computer/server crooks can get their hands on.</div>

Cryptocurrency Hacking News Jenkins Malwares Miner Monero News Thousands of Jenkins Servers Hacked to mine Monero

A hacker group has made over $3 million by breaking into Jenkins servers and installing malware that mines the Monero cryptocurrency. H...

New search engine launched to find Hackable Servers

2/17/2018 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdT94sVNAEM2dcmMsRFhi5Z0ZBFFSGz2HPe0ydVzq9gXH6pt8d4dJHPlrwkZ5MtOncq_Xe3OxsfadNBbOqI_lmYKUUkONFS9wA4qDt-6oJvWRBipfh84q-eAABHJdid8UAMFio6oHr3nI/s1600/Hackable-Servers.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="422" data-original-width="750" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdT94sVNAEM2dcmMsRFhi5Z0ZBFFSGz2HPe0ydVzq9gXH6pt8d4dJHPlrwkZ5MtOncq_Xe3OxsfadNBbOqI_lmYKUUkONFS9wA4qDt-6oJvWRBipfh84q-eAABHJdid8UAMFio6oHr3nI/s640/Hackable-Servers.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">New search engine launched to find Hackable Servers</td></tr>
</tbody></table>
<br />
We all know very well that more and more users are simply choosing to save their data on servers. The advantages are many, although there may also be disadvantages. As today in this article, I will tell you people about a search engine that lets you find hackable servers very easily.<br />
<br />
<b>This Search Engine Lets You Find Hackable Servers Easily</b><br />
Every time we use more servers to store our data. It is a very interesting option to have them always present. In addition, we avoid filling physical disks and our computer. However, not all are safe. Many have vulnerabilities and possible failures that put our data at risk. Today we will talk about <a href="http://www.hackerschronicle.com/search/label/BuckHacker" target="_blank">BuckHacker</a>, a search engine that helps us find if a server can be hacked easily.<br />
<b><br /></b>
<b>BuckHacker</b><br />
Leaving private data on exposed <a href="http://www.hackerschronicle.com/search/label/AWS" target="_blank">AWS </a>servers is not as weird as we might think. Security researchers and <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime" target="_blank">cybercriminals </a>can access this data easily using the right tools. To further facilitate this process, some developers have created this tool called <a href="https://www.buckhacker.com/" target="_blank">BuckHacker</a>, which allows to search for exposed servers.<br />
<br />
At the time we talked about another similar tool, called Shodan, which also allowed to know vulnerabilities in servers. It also included an option to find sensitive information on routers or IP cameras. BuckHacker is similar. Its function is to find Amazon servers that are exposed.<br />
<br />
The anonymous developers of this tool indicate that their goal is to increase the security associated with repositories and code projects. They claim that there are many companies that were hit by having wrong permits.<br />
<br />
This search engine allows you to search for pirated servers using the name of the file. In addition, it also returns the entries labeled “Access Denied” and “The specified deposit does not exist”.<br />
<br />
The results are stored in a database, which can then be searched by other users. According to the developers, the project is currently in the early stages of development and is quite unstable.<br />
<br />
In short, BuckHacker is a search engine that allows us to find possible Amazon servers exposed. However, at the moment, according to sources, there is no information about the launch of BuckHacker.</div>

AWS BuckHacker Hacking Tools News S3 New search engine launched to find Hackable Servers

New search engine launched to find Hackable Servers We all know very well that more and more users are simply choosing to save their d...