4000 Government Websites Hacked in less than 4 Hours to Mine Cryptocurrency

3/03/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnJjqeIjcqU3MGFmsgNnL0NeymCNjU4wfbAPOJzO7r3dusjiHbjsAgXgK-3KytrKTYX_nru_Xf_Jd3jVU4bICc1ulejSq4tNjczTh46yG_aqNpuXbOMn6J4zp77oKxIdldi_BFDqmSTFwa/s1600/United-States-courts-portal-Hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Government Websites Hacked to mine Cryptocurrency" border="0" data-original-height="360" data-original-width="1000" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnJjqeIjcqU3MGFmsgNnL0NeymCNjU4wfbAPOJzO7r3dusjiHbjsAgXgK-3KytrKTYX_nru_Xf_Jd3jVU4bICc1ulejSq4tNjczTh46yG_aqNpuXbOMn6J4zp77oKxIdldi_BFDqmSTFwa/s640/United-States-courts-portal-Hacked.jpg" title="Government Websites Hacked to mine Cryptocurrency" width="640" /></a></div>
Over four thousand high profile government websites have been compromised by <a href="http://www.hackerschronicle.com/search/label/Dark%20Web" target="_blank">dark web</a> hackers across the globe, mining virtual currency secretly, and particularly Monero.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>has become one of the popular cryptocurrency recently especially on the ‘<a href="http://www.hackerschronicle.com/search/label/Dark%20Web" target="_blank">dark web</a>’– a section of the internet that can only be accessed using a special browser which is capable of anonymizing your browsing location as well as identity. Dark web criminals are taking advantage of this anonymity by trading illegal commodities, substances and services using virtual currencies.<br />
<br />
<b>4,275 websites including those in the U.K., the U.S., Ireland, Australian and Canada with government websites with hundreds of thousands of visitors were hacked in less than a period of four hours</b> and unwittingly mined for <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency </a>exploiting a security breach. Some of the compromised websites include the <b>United States courts online portal</b>, the <b>United States Information Commissioner Office</b>; the <b>National Health Service</b> in the <b>United Kingdom</b> and the <b>Victorian Parliament </b>website in <b>Australia</b>. The attack by a cryptojacking code hit common websites which had the text-to-speech accessibility script Browsealoud for the visually impaired from Texthelp company.<br />
<br />
Recently, Monero has grown in popularity with a market capitalization of $4 billion. Its privacy feature has contributed to its momentum on the dark web making it harder to track compared to bitcoin.<br />
<br />
The prices of virtual currency in the market skyrocketed recently and as a scheme that has drawn the attention of criminals. <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime" target="_blank">Cybercrimes </a>increased especially on cryptocurrency as criminals tried to cash in on the skyrocketing crypto prices. The cybercrime industry is recently believed to be overtaking the illegal drug trafficking industry in terms of revenue and hence attracting criminals.<br />
<br />
The hacking process involved insertion of a <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malicious </a>code that takes over a portion of a victim’s computer and central processing. Therefore the hacker has the ability of opening a website using a browser in order to mine virtual currency.<br />
<br />
The process of mining digital coins requiring less processing power such as Monero is much easier compared to mining bitcoin from websites as it requires powerful specialized computers and software, making Monero mining a better fit for saving on time and energy, making it a very attractive option to criminals.<br />
<br />
The dark web hackers had an easier time as they did not compromise each of the 4,275 websites at once, but rather hacked a globally-used plugin named ‘<b>Browsealoud</b>’ which is capable of reading out text from websites for the blind.<br />
<br />
After the Browsealoud code was hacked, <b>CoinHive’s Monero miner</b> was silently and secretly injected. Thereafter, any website using the Browsealoud plugin was automatically compromised.<br />
<br />
However the cyber-attack was deemed successful as there were basic regulatory measures and requirements over accessibility of some of these government websites that have not been met.</div>

Over four thousand high profile government websites have been compromised by dark web hackers across the globe, mining virtual currency...

GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

3/02/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCA2KmPcZ6tl-1mNqQitTXlcWy_r0PhcOLRKlZI_gPKiQYsjMR1YT2KeOMAYepOISIHRnna0HJngpaUGoeSU1WKZF3L3b66Hnhef6ZozmJpocjc-vTKPseqnsxfBJOz0YAM6iTytCL4FIf/s1600/github-under-biggest-ddos-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps" border="0" data-original-height="577" data-original-width="770" height="476" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCA2KmPcZ6tl-1mNqQitTXlcWy_r0PhcOLRKlZI_gPKiQYsjMR1YT2KeOMAYepOISIHRnna0HJngpaUGoeSU1WKZF3L3b66Hnhef6ZozmJpocjc-vTKPseqnsxfBJOz0YAM6iTytCL4FIf/s640/github-under-biggest-ddos-attack.png" title="GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps" width="640" /></a></div>
On Wednesday, developer repository site <a href="http://www.hackerschronicle.com/search/label/GitHub" target="_blank">GitHub </a>was hit with a critical DDoS attack that took the site offline multiple times for a few minutes each time. According to a GitHub incident report, the first portion of the <b>attack</b> against the developer platform <b>peaked at 1.35Tbps</b>, and there was a second 400Gbps spike later. This would make it the biggest <a href="http://www.hackerschronicle.com/search/label/DDoS" target="_blank">DDoS </a>attack recorded so far. Until now, the biggest clocked in at around 1.1Tbps.<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_6SU_nmV8Bv4GmW9X_53gPWM1IX0B3UkKuRnggsV_NUHpGSXvuppv8h_9tZs6xs0Adc4dC6C3Kn7ny_2BzJrOL-hyTuVn6UI80yv1Z08LzDI5DlpgY_YTiOgXuCBb7oGQCfOLrTC_OCST/s1600/GitHub-hit-by-memcached-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub Under Memcached Attack" border="0" data-original-height="515" data-original-width="1357" height="241" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_6SU_nmV8Bv4GmW9X_53gPWM1IX0B3UkKuRnggsV_NUHpGSXvuppv8h_9tZs6xs0Adc4dC6C3Kn7ny_2BzJrOL-hyTuVn6UI80yv1Z08LzDI5DlpgY_YTiOgXuCBb7oGQCfOLrTC_OCST/s640/GitHub-hit-by-memcached-attack.png" title="GitHub Under Memcached Attack" width="640" /></a></div>
<br />
According to the <a href="https://githubengineering.com/ddos-incident-report/" target="_blank">incident report</a>, <b>GitHub was offline</b> Wednesday from 17:21 to 17:26 UTC and intermittently unavailable from 17:26 to 17:30 UTC, thanks to the attack. The report noted that <b>user data wasn't at risk during the attack</b>.<br />
<br />
The GitHub attack is the latest in a string of incidents where hackers have exploited a vulnerability in the <a href="http://www.hackerschronicle.com/search/label/Memcache" target="_blank">memcached </a>protocol to amplify the impact of such an attack. Memcached is typically used to speed up websites, but an issue with its UDP protocol makes the attack amplification possible, as noted by <a href="http://www.hackerschronicle.com/search/label/CloudFlare" target="_blank">CloudFlare</a>. <br />
<br />
Memcached, as is likely inferred by the name, is a tool that uses data caching to help ease the burden on data stores, it's not necessarily meant to be used with systems that are connected to the internet. But, that hasn't stopped attackers from finding a way to use it to launch and accelerate cyberattacks. By mislabeling a victim's IP as a target address, attackers can overload their network with traffic (up to 51,200x more in acceleration) and trigger a denial of service attack.<br />
<br />
<div style="text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOkQ5ZxWG7Fi2puxFcePSQ1YyR7XFqjde3vyIWj4n7lKdSCXNiUxU-aG9KAT9JGFTMm1BRcBFg9IBvVmiemZPCSnduAH8jon0e1MAIZu2mkCAMgAzZRGRkZQ4xhs2IEB_w8OywmARvCBU9/s1600/memcache-ddos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="411" data-original-width="640" height="256" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOkQ5ZxWG7Fi2puxFcePSQ1YyR7XFqjde3vyIWj4n7lKdSCXNiUxU-aG9KAT9JGFTMm1BRcBFg9IBvVmiemZPCSnduAH8jon0e1MAIZu2mkCAMgAzZRGRkZQ4xhs2IEB_w8OywmARvCBU9/s400/memcache-ddos.png" width="400" /></a></div>
To fix its own problem, GitHub moved some of its traffic to Akamai for additional capacity at the edge. In its own post <a href="https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html" target="_blank">Akamai</a>, one of the companies who discovered the vulnerability early on, wrote that it predicts "many more, potentially larger attacks in the near future. Akamai has seen a marked increase in scanning for open memcached servers since the initial disclosure."<br />
<br />
Josh Shaul, vice president of web security at Akami told, “we modeled our capacity based on five times the biggest attack that the internet has ever seen. So I would have been certain that we could handle 1.3 Tbps, but at the same time we never had a terabit and a half come in all at once.”<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHPtaGUF_LQ_T0f-Iq0eo3WtjgLo9Jov2obzmFbqzDui0PFaAQB0TC-hzWy_JfmexZ8ix3Lvj_yZ5cEzAux-Bp8KNRUoDadmrPuBGV8uiwh1ue70RBQt4Zdx0G8T8GT0-nJHW_Kp81wNs0/s1600/GitHub-under-ddos-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub under DDOS attack" border="0" data-original-height="137" data-original-width="720" height="120" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHPtaGUF_LQ_T0f-Iq0eo3WtjgLo9Jov2obzmFbqzDui0PFaAQB0TC-hzWy_JfmexZ8ix3Lvj_yZ5cEzAux-Bp8KNRUoDadmrPuBGV8uiwh1ue70RBQt4Zdx0G8T8GT0-nJHW_Kp81wNs0/s640/GitHub-under-ddos-attack.png" title="GitHub under DDOS attack" width="640" /></a></div>
<br />
<br />
There are few parallels to the scale of the attack, with GitHub saying there were “over a thousand different autonomous systems across tens of thousands of unique endpoints.”  </div>

Cyber Attack DDoS GitHub Memcache News GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

On Wednesday, developer repository site GitHub was hit with a critical DDoS attack that took the site offline multiple times for a few ...

Hundreds of WordPress & Joomla websites infected by ionCube Malware

3/01/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCISRo1hVEm5OFH1EX19PrnmdBIUzNSp6gAAdsBSrLx5s5IaAAgkIQAr0prPNAVrgGoobG6Ffa2swbhS559R1Ho20Z1KVrXHE_G4Ke8WQH-K_8pQ3Fg3bwrEVSvnKMoZtlvlZlp57xHcUT/s1600/Wordpress-ionCube-Malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Joomla infected by malware" border="0" data-original-height="330" data-original-width="680" height="308" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCISRo1hVEm5OFH1EX19PrnmdBIUzNSp6gAAdsBSrLx5s5IaAAgkIQAr0prPNAVrgGoobG6Ffa2swbhS559R1Ho20Z1KVrXHE_G4Ke8WQH-K_8pQ3Fg3bwrEVSvnKMoZtlvlZlp57xHcUT/s640/Wordpress-ionCube-Malware.jpg" title="Wordpress infected by malware" width="640" /></a></div>
<br />
Security researchers at SiteLock have discovered that hundreds of websites based on WordPress, Joomla and CodeIgniter have been infected with <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware </a>that masquerades as legitimate ionCube-encoded files.<br />
<br />
ionCube is an encoding technology used to protect PHP software from being viewed, changed, and run on unlicensed computers.<br />
<br />
The experts were analyzing an infected <a href="http://www.hackerschronicle.com/search/label/Wordpress" target="_blank">WordPress </a>website when discovered a number of suspicious obfuscated files –  such as “<b>diff98.php</b>” and “<b>wrgcduzk.php</b>” –  appearing almost identical to legitimate ionCube-encoded files. Further analysis conducted revealed that hundreds of websites were infected by the same ionCube Malware.<br />
<br />
“While reviewing an infected site, the SiteLock Research team found a number of suspiciously named, obfuscated files that appear almost identical to legitimate ionCube-encoded files. We determined the suspicious ionCube files were malicious, and found that hundreds of sites and thousands of files were affected.” reads the analysis published by SiteLock.<br />
<br />
“<b>Overall, our investigation found over 700 infected sites, totalling over 7,000 infected files.</b>”<br />
<br />
Further analysis revealed that attackers also compromised <a href="http://www.hackerschronicle.com/search/label/Joomla" target="_blank">Joomla </a>and <a href="http://www.hackerschronicle.com/search/label/CodeIgniter" target="_blank">CodeIgniter </a>websites. Threat actors packed their malware in a manner that appears ionCube-encoded files.<br />
<br />
The malicious code could theoretically infect any website based on a web server running PHP, once decoded, the fake ionCube files compose the ionCube malware.<br />
<br />
“While there’s still some degree of obfuscation, the presence of the <b>$_POST and $_COOKIE </b>superglobals and the eval request at the end of the file reveal its true purpose: to accept and execute remotely supplied code.” continues the analysis. “It looks like the remote code supplied to this file is further obfuscated and there may be some sort of access control implemented, judging by the GUID-formatted string present.” <br />
<br />
<br />
The researchers also provided recommendations to mitigate the ionCube Malware, they suggest administrators check the presence of ionCube-encoded files as an indicator of compromise.<br />
<br />
If an infection is detected, the scanning of the entire site is recommended, to completely eliminate the threat, the researchers also suggest the adoption of a web application <a href="http://www.hackerschronicle.com/search/label/Firewall" target="_blank">firewall </a>(WAF).<br />
<br />
“If you find indicators of this infection, we strongly recommend having your site scanned for malware as soon as possible, as this malware seldom appears on its own.” concluded the analysis.<br />
<br />
“This is especially important if you are using an ionCube-encoded application, as manually differentiating the malicious files from the legitimate ones is difficult, and <b>it is common to see up to 100 slightly different variants of this malware on a single site.</b> “<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjG2L3QHgleFLiGBwrwUF9mAtKK6KMFj1qG1bwIDIBEqOjGYAeNF0kz2JPqNiiS_RdFwXk7-WnV885oD1wfunLLE6tQ_692BaUArItvSegjDxj7phn5zy7BLYBBRSD4WaimFw9PlUpFhiG0/s1600/ionCube-Malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ionCube Malware" border="0" data-original-height="516" data-original-width="940" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjG2L3QHgleFLiGBwrwUF9mAtKK6KMFj1qG1bwIDIBEqOjGYAeNF0kz2JPqNiiS_RdFwXk7-WnV885oD1wfunLLE6tQ_692BaUArItvSegjDxj7phn5zy7BLYBBRSD4WaimFw9PlUpFhiG0/s640/ionCube-Malware.png" title="ionCube Malware" width="640" /></a></div>
</div>

CodeIgniter ionCube Joomla Malwares News Wordpress Hundreds of WordPress & Joomla websites infected by ionCube Malware

Security researchers at SiteLock have discovered that hundreds of websites based on WordPress, Joomla and CodeIgniter have been infected...

Hotspot Shield VPN is NO more Secure, Leaking Users Location

2/28/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1MQ1IHxLKVBVkwVdLs7a8UFYWzfculesftL6aqsnEVjTJtTZxijQIUMUGr86UALuIPPpYO__4yh8g2KxlWnf79XsLMsPnxFivQwgoKPXxsksF3HBBEVqkveb7mUg3OktFr7QTVYgiVYuN/s1600/Hotspot-Shield-Information-Disclosure.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hotspot Shield can expose VPN users locations" border="0" data-original-height="400" data-original-width="1200" height="211" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi1MQ1IHxLKVBVkwVdLs7a8UFYWzfculesftL6aqsnEVjTJtTZxijQIUMUGr86UALuIPPpYO__4yh8g2KxlWnf79XsLMsPnxFivQwgoKPXxsksF3HBBEVqkveb7mUg3OktFr7QTVYgiVYuN/s640/Hotspot-Shield-Information-Disclosure.jpg" title="Hotspot Shield can expose VPN users locations" width="640" /></a></div>
<br />
A security researcher has found that one of the world’s largest <a href="http://www.hackerschronicle.com/search/label/VPN" target="_blank">Virtual Private Network (VPN)</a> providers is leaking users private information. Hotspot Shield, which has been downloaded over half a billion times and has been in operation for over a decade, has a bug which can reveal what country a user is located in, as well as leak the name of the WiFi network they are using. The <a href="http://www.hackerschronicle.com/search/label/Vulnerability" target="_blank">vulnerability </a>in Hotspot Shield’s VPN service was discovered by Paulos Yibelo. Yibelo reported his findings to Beyond Security’s SecuriTeam Secure Disclosure program.<br />
<br />
“By <a href="http://www.hackerschronicle.com/search/label/Information%20Disclosure" target="_blank">disclosing information</a> such as WiFi name, an attacker can easily narrow down or pinpoint where the victim is located,” Paulos Yibelo told. When an attacker knows what country a Hotspot Shield VPN user is from, they “can narrow down a list of places” their victim is from, Yibelo said. The vulnerability in Hotspot Shield’s VPN service was tested using a proof-of-concept code that Yibelo wrote. Using Yibelo’s code they were able to identify users WiFi networks, and the vulnerability kept working when tried from different computers and different network.<br />
<br />
Yibelo was able to write his proof-of-concept code very quickly, and it is only a few lines long. The code exploits a vulnerability in the local web server installed by Hotspot Shield. Private information and configuration data are returned when the exploit calls a JavaScript file being hosted on the web server. The private information of Hotspot Shield VPN users could be captured and stored from an infected website. According to Yibelo, he was able to successfully obtain Hotspot Shield VPN users IP addresses, though he was only having mixed results and was not always able to successfully capture real IP addresses. <br />
<br />
The developer of <b>Hotspot Shield VPN</b>, AnchorFree, Inc., is strongly denying that any user’s real IP addresses are being leaked through the vulnerability discovered by Paulos Yibelo. “We have reviewed and tested the researcher’s report. We have found that this vulnerability does not leak the user’s real IP address or any personal information, but may expose some generic information such as the user’s country. We are committed to the safety and security of our users, and will provide an update this week that will completely remove the component capable of leaking even generic information,” AnchorFree’s Tim Tsoriev said in a statement.<br />
<br />
After Yibelo discovered the vulnerability in Hotspot Shield VPN, he reported it to AnchorFree in December of last year but never received a response from the company. Yibelo then submitted the vulnerability to Beyond Security through their bug bounty program. Beyond Security also did not receive a response from AnchorFree. However, in February, AnchorFree finally addressed the issue with a new version of Hotspot Shield VPN which was recently released. The new version of Hotspot Shield VPN patches the vulnerability discovered by Yibelo.<br />
<br />
Last year Hotspot Shield VPN was accused by the Center for Democracy & Technology of selling their customers private information. A formal complaint was filed with the United States Federal Trade Commission (FTC) in which they allege that Hotspot Shield was guilty of employing unfair and deceptive trade practices. AnchorFree claimed that they did not collect any personal information about Hotspot Shield VPN users. Hotspot Shield VPN comes in both a free version, as well as a paid “Elite Version” subscription. The Center for Democracy & Technology discovered that Hotspot Shield VPN was sharing information after analyzing the VPN using Carnegie Mellon University’s Mobile App Privacy Compliance automated system on the free version of the Hotspot Shield VPN service.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIgJlWniS5CWuu5l9nx6AY0a6DcztXt31kP9dyM4R3vRFDyQBxwaypgNo5iSnJk6fKCcFbcR-mgk2WQqCbk5INRXlbfQUhDUHaijpiU0hsGWgcokJG_lto__jOucT4bLw1PnSYO0iMF5WL/s1600/HotSpot-Vulnerability-POC.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hotspot Shield Information Disclosure POC" border="0" data-original-height="253" data-original-width="645" height="249" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhIgJlWniS5CWuu5l9nx6AY0a6DcztXt31kP9dyM4R3vRFDyQBxwaypgNo5iSnJk6fKCcFbcR-mgk2WQqCbk5INRXlbfQUhDUHaijpiU0hsGWgcokJG_lto__jOucT4bLw1PnSYO0iMF5WL/s640/HotSpot-Vulnerability-POC.PNG" title="Hotspot Shield Information Disclosure POC" width="640" /></a></div>
<br /></div>

CVE-2018-6460 Information Disclosure News VPN Vulnerability Hotspot Shield VPN is NO more Secure, Leaking Users Location

A security researcher has found that one of the world’s largest Virtual Private Network (VPN) providers is leaking users private inform...

Credit Card numbers worth $3.6 million out on Sale

2/27/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnn03SWfFMh4V2pD0esGaBgEhnVGn7fNBxQS62MBJ3-6Foa5XrXB8ppXzsSLA9zN626CBZ489t34mCUphdKQ9vTDK0k-23vpZgzDrVM-QRN9mXbNhi8Nv_IlNSJB9AA7wW6EFrMHQrjIJ4/s1600/Credit-Cards_Data_Leaked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Russian hackers selling stolen credit card numbers" border="0" data-original-height="353" data-original-width="582" height="387" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnn03SWfFMh4V2pD0esGaBgEhnVGn7fNBxQS62MBJ3-6Foa5XrXB8ppXzsSLA9zN626CBZ489t34mCUphdKQ9vTDK0k-23vpZgzDrVM-QRN9mXbNhi8Nv_IlNSJB9AA7wW6EFrMHQrjIJ4/s640/Credit-Cards_Data_Leaked.jpg" title="Russian hackers selling stolen credit card numbers" width="640" /></a></div>
<br />
Russian computer hackers operating in Colorado and 15 other states used data-mining <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">viruses </a>to steal thousands of <a href="http://www.hackerschronicle.com/search/label/Credit%20Card" target="_blank">credit card</a> numbers from U.S. residents in 20 states and sold them on the <a href="http://www.hackerschronicle.com/search/label/Darknet" target="_blank">darknet </a>for more than $3.6 million, according to federal court documents.<br />
<br />
As part of the wide-scale criminal operation, so-called “<a href="http://www.hackerschronicle.com/search/label/Carding" target="_blank">carders</a>” from Russia advertised and sold the numbers to Ukrainian operatives using the <b>Rescator network of websites</b> — named for a Ukranian hacker who specializes in the sale of stolen credit cards.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Russian%20Hackers" target="_blank">Russian thieves</a> instructed clandestine organizations to pay for batches of stolen credit card numbers using <a href="http://www.hackerschronicle.com/2018/02/western-union-money-transfer-hacked.html" target="_blank">Western Union</a> and <b>MoneyGram</b> International, according to documents filed by federal prosecutors in Denver U.S. District Court.<br />
<br />
The documents did not indicate whether anyone has been arrested in connection to the scheme. Agents from the Department of Homeland Security based in Colorado uncovered the operation. The U.S. Attorney’s Office in Colorado filed forfeiture claims Friday against two Colorado bank accounts, the documents reveal.<br />
<br />
Criminals use software to access hidden websites and blogs on the <a href="http://www.hackerschronicle.com/search/label/Darknet" target="_blank"><b>darknet </b></a>so they can operate <a href="http://www.hackerschronicle.com/search/label/Anonymous" target="_blank">anonymously</a>. As part of their investigation, Homeland Security agents made undercover purchases of batches of stolen credit cards. <br />
<br />
A web of conspirators in Colorado and 15 other states funneled money back to accounts set up in the Russian Federation.<br />
<br />
<b>MoneyGram </b>officials contacted Homeland Security agents in November of 2014 and notified them of <b>137 wire transfers totaling $170,000</b>. The agents determined in March of 2016 that conspirators wired money to payees in the Ukraine, the documents indicate. In 2015 and 2016, conspirators allegedly sent <b>3,997 wires totaling $3,598,160</b>, records indicate.</div>

Carding Credit Card Hacking News Russian Hackers Credit Card numbers worth $3.6 million out on Sale

Russian computer hackers operating in Colorado and 15 other states used data-mining viruses to steal thousands of credit card numbers f...

Winter olympics was not Hacked by North Korea but Russian Military

2/26/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilMAqOWIvOZkyujul2Cc2y6puvJ9Mv0NDaNkDfiLl0mPBq0FEZDKGCsGIRBWkFJm4XrYhasegsSwZWrU-IZJWmPq5TjVoGrfYMlbB26XccVP2iBfoVVeUE7fTgZLZ8_hCXHZ5m2DNxG2l4/s1600/winter-olympics-hacked-by-russian-military.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Winter Olympic Hacked by Russian Military" border="0" data-original-height="466" data-original-width="700" height="425" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEilMAqOWIvOZkyujul2Cc2y6puvJ9Mv0NDaNkDfiLl0mPBq0FEZDKGCsGIRBWkFJm4XrYhasegsSwZWrU-IZJWmPq5TjVoGrfYMlbB26XccVP2iBfoVVeUE7fTgZLZ8_hCXHZ5m2DNxG2l4/s640/winter-olympics-hacked-by-russian-military.jpg" title="Winter Olympic Hacked by Russian Military" width="640" /></a></div>
<br />
We already knew that the opening ceremony of the <a href="http://www.hackerschronicle.com/2018/02/winter-olympics-website-hacked.html" target="_blank">Winter Olympics</a> in Pyeongchang, South Korea was hit by a cyberattack. Now it appears we know the culprit: Russian military spies.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Russian%20Military" target="_blank">Russian military spies</a> hacked hundreds of computers used by Winter Olympics organizers and tried to make it look like the work of North Korea, the Washington Post reported Sunday, quoting US intelligence sources.<br />
<br />
South Korea had previously announced that it was investigating the failure of several Olympic-linked internet sites and broadcast systems just as the opening ceremonies were taking place on February 9.<br />
<br />
The Post reported that Russia's GRU military intelligence agency managed to take control in early February of 300 computers linked to the Olympic organization. As a result, many attendees were unable to print their tickets for the ceremony, leaving empty seats.<br />
<br />
It said the Russians had hacked South Korean computer routers and inserted a form of "malware" that allowed them to gather data and paralyze the network. <a href="http://www.hackerschronicle.com/search/label/Russian%20Hackers" target="_blank">The Russians</a> used a North Korean internet provider to make it appear the attack originated in North Korea, in what is known as a "false flag" operation, the Post said.<br />
<br />
While American officials quoted in the article were unable to say whether the hackers had activated the <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware</a>, they said the cyber attack against the Games -- from which Russia's team was excluded for doping -- was worrisome. <br />
<br />
Some analysts believe the <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime" target="_blank">cyber attack</a> was retribution for that ban. Some Russian athletes were allowed to compete, but only under the designation of "Olympic Athletes from Russia." <br />
<br />
The Winter Games saw dramatic gestures aimed at easing the raw tensions dividing the two Koreas, as both countries' athletes marched together during the opening ceremonies, and they fielded a single women's ice hockey team. <br />
<br />
The sister of North Korean leader Kim Jong-Un made several high-profile appearances in the early days of the Games, and a large squad of North Korean cheerleaders drew intense interest.  <br />
<br />
Finally, at the Games' closing ceremony Sunday, South Korean President Moon Jae-in and North Korean General Kim Yong Chol -- a man considered a "<b>war criminal</b>" by many in the South for his role in two deadly attacks on Southern targets -- exchanged a very public handshake.</div>

Hacking News Russian Hackers Russian Military Winter Olympics Winter olympics was not Hacked by North Korea but Russian Military

We already knew that the opening ceremony of the Winter Olympics in Pyeongchang, South Korea was hit by a cyberattack. Now it appears w...

2,000 Computers of Department of Telecom, Infected with Ransomware

2/25/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl3ZfURe3ZAbtIzrkTlb4jfgZvVseEQxB7hlblYzUvyTxsUmoc1MriDmqSdKEn3_0j7f6AlAB7fw4dnWwuyaZCL68_JhnblYxRZwJpiVe9lI6_g9qXaCdQ-ViguE4i4L4e_LNI7KbHbLmH/s1600/samsam-ransomware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Computers of Department of Telecom Hacked" border="0" data-original-height="471" data-original-width="624" height="481" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgl3ZfURe3ZAbtIzrkTlb4jfgZvVseEQxB7hlblYzUvyTxsUmoc1MriDmqSdKEn3_0j7f6AlAB7fw4dnWwuyaZCL68_JhnblYxRZwJpiVe9lI6_g9qXaCdQ-ViguE4i4L4e_LNI7KbHbLmH/s640/samsam-ransomware.png" title="Computers of Department of Telecom Infected" width="640" /></a></div>
<br />
<a href="http://www.hackerschronicle.com/search/label/SamSam" target="_blank">SamSam</a> ransomware made the headlines again, this time it infected over 2,000 computers at the Colorado Department of Transportation (DOT). The DOT has shut down the infected workstations and is currently working with security firm McAfee to restore the ordinary operations. Officials confirmed the <a href="http://www.hackerschronicle.com/search/label/Ransomeware" target="_blank">ransomware </a>requested a bitcoin payment.<br />
<br />
“The Colorado Department of Transportation has ordered an estimated 2,000 employees to shut down their computers following a ransomware attack Wednesday morning.” wrote the CBS Denver.<br />
<br />
The CDOT spokesperson Amy Ford said employees were instructed to turn off their computers at the start of business Wednesday after ransomware infiltrated the CDOT network. “We’re working on it right now,” added Ford.<br />
<br />
The good news is that crucial systems at the Colorado DOT such as surveillance cameras, traffic alerts were not affected by the ransomware. David McCurdy, OIT’s Chief Technology Officer, issued the following statement:<br />
<br />
“Early this morning state security tools detected that a ransomware virus had infected systems at the Colorado Department of Transportation. The state moved quickly to quarantine the systems to prevent further spread of the virus. OIT, FBI and other security agencies are working together to determine a root cause analysis. This ransomware virus was a variant and the state worked with its antivirus software provider to implement a fix today. The state has robust backup and security tools and has no intention of paying ransomware. Teams will continue to monitor the situation closely and will be working into the night.”<br />
<br />
The Colorado DOT officials confirmed that the agency will not pay the ransom and it will restore data from backups.<br />
<br />
The SamSam ransomware is an old threat, attacks were observed in 2015 and the list of victims is long, many of them belong to the healthcare industry. The attackers spread the malware by gaining access to a company’s internal networks by brute-forcing RDP connections.<br />
<br />
Among the victims of the Samsam Ransomware there is the MedStar non-profit group that manages 10 hospitals in the Baltimore and Washington area. Crooks behind the attack on MedStar requested 45 <a href="http://www.hackerschronicle.com/search/label/Bitcoin" target="_blank">Bitcoins </a>(about US$18,500) for restoring the encrypted files, but the organization refused to pay the Ransom because it had a backup of the encrypted information.<br />
<br />
In April 2016, the FBI issued a confidential urgent “Flash” message to the businesses and organizations about the Samsam Ransomware.<br />
<br />
Back to the present, the Samsam Ransomware made the headlines in the first days of 2018, the malicious code infected systems of some high-profile targets, including hospitals, an ICS firm, and a city council.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZWzpSAFohcXWmdcyvYDk6JJEOhV0p7j8OOblhEqfN23RlYTlGpT64cmezbc2NBgDTzhBaBdfXTyKokK1CiIzMWyeygCdUMDWA3e7cSVOw78MDJxW8LDI-n0kq75usuKjM0w12iSJsnDnu/s1600/SamSam-note.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="309" data-original-width="511" height="193" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZWzpSAFohcXWmdcyvYDk6JJEOhV0p7j8OOblhEqfN23RlYTlGpT64cmezbc2NBgDTzhBaBdfXTyKokK1CiIzMWyeygCdUMDWA3e7cSVOw78MDJxW8LDI-n0kq75usuKjM0w12iSJsnDnu/s320/SamSam-note.png" width="320" /></a></div>
</div>

Hacking News News Ransomware SamSam 2,000 Computers of Department of Telecom, Infected with Ransomware

SamSam ransomware made the headlines again, this time it infected over 2,000 computers at the Colorado Department of Transportation (DO...