Saposhi a new malware to take down all IoT devices is out

3/09/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ8p7qWG1DwmBPgKLhzzWdUqUSRexWf70vpudaCzjinTSUdHMKaE0_AZwb1d8bUoIhdL-tpGAdYEPROknhA8DhDrAq9wy5caeaAv26qLpkHmmO5kzkSKNxBtR4vv5R83lUiTNqHsbbyYy9/s1600/Saposhi-DDoS-Malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Saposhi a new malware to take down all IoT devices is out" border="0" data-original-height="750" data-original-width="1000" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ8p7qWG1DwmBPgKLhzzWdUqUSRexWf70vpudaCzjinTSUdHMKaE0_AZwb1d8bUoIhdL-tpGAdYEPROknhA8DhDrAq9wy5caeaAv26qLpkHmmO5kzkSKNxBtR4vv5R83lUiTNqHsbbyYy9/s640/Saposhi-DDoS-Malware.jpg" title="Saposhi a new malware to take down all IoT devices is out" width="640" /></a></div>
 
Cybersecurity agencies detected a new malware Saposhi , which can cripple the entire industries by taking over electronic devices and turning them into 'bots', which can be used for <a href="http://www.hackerschronicle.com/search/label/DDoS">Distributed Denial of Service</a> (DDoS) attacks . 
 
The new malware Saposhi was detected around 15 days ago according to a report of the Hindu, and is currently being watched and studied. 
 
“Saposhi is similar in its intensity to Reaper, which was taking over millions of devices at the rate of 10,000 devices per day. Various cybersecurity agencies are currently keeping tabs on it to get a better idea of what it is capable of,” he said. 
 
A Central Government organisation 'the Computer Emergency Response Team (CERT)', had issued an alert about malwares Mirai, and Reaper, but has not yet issued any alert regarding the new malware. 
 
“We need to first ensure that the information we have is indeed substantiated before raising alarm bells. Right now, what we know for sure is that Saposhi exists, and is highly capable. Factors like whether it is aimed at any particular kind of device, or has a specific purpose are still being verified,” a officer said. 
 
<a href="http://www.hackerschronicle.com/search/label/Malwares">Malwares </a>which are primarily aimed at DDoS attacks first creates a 'botnet,'network of bots, these botnet are used to ping a server at the same time. If the number of pings increases beyond the server’s capacity, the server crashes and denies service. Saposhi, Reaper and Mirai are DDoS attack malwares. 
 
In July 2016, small and medium internet service providers in Maharashtra fell prey to a DDoS attack, which caused disruption in the services of several Internet Service Providers (ISP) in the State. 
 
In 2016, Mirai, using a botnet of 5 lakh devices, had caused the servers of Dyn, a leading domain name service provider, to crash, affecting services of popular websites like Twitter, Netflix and Reddit. 
 </div>

Cybersecurity agencies detected a new malware Saposhi , which can cripple the entire industries by taking over electronic devices and t...

DDoS Exploit code to shutdown all vulnerable Memcached Servers Released online

3/08/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY_2biyz6S2H06vEQZNYt30moJnaKa9N1pO73gCZfgMo8cGLLI66wvY61YLyK_XtqjucFRcLrrwNEmDa3pBhJpig0791kXy2_uaPo5hU5-D2hMUlZIG2zQfPmrgfr-3safsS6y51p6X4xI/s1600/Memfixed-Mitigation-Tool.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="MEMFIXED DDOS MITIGATION TOOL" border="0" data-original-height="455" data-original-width="822" height="354" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjY_2biyz6S2H06vEQZNYt30moJnaKa9N1pO73gCZfgMo8cGLLI66wvY61YLyK_XtqjucFRcLrrwNEmDa3pBhJpig0791kXy2_uaPo5hU5-D2hMUlZIG2zQfPmrgfr-3safsS6y51p6X4xI/s640/Memfixed-Mitigation-Tool.png" title="memfixed-ddos-mitigation-tool" width="640" /></a></div>
 
For the last few days, Vulnerable Memcached Servers were targeted by hackers to conducted DDoS attacks including the <a href="http://www.hackerschronicle.com/2018/03/github-hit-with-biggest-ddos-attack.html" target="_blank">world’s largest ever 1.7 Tbps of DDoS attack on Github</a> website. 
 
After the massive attacks on memcache servers worldwide three PoC codes were published online to exploit the thousands of Memcache servers still vulnerable. Along with PoC code a list of 17,000 vulnerable servers were also published. The PoC codes could allow even script-kiddies to launch massive <a href="http://www.hackerschronicle.com/search/label/DDoS" target="_blank">DDoS </a>attacks using UDP reflections easily. 
 
But now the researchers at <a href="https://twitter.com/SpuzNiq">SPUZ.me</a> have released a new tool to shutdown all vulnearble sers at one go. The tool is named as <a href="http://www.hackerschronicle.com/search/label/Memfixed" target="_blank">Memfixed</a>. According to the publisher: Memfixed is DDoS mitigation tool for sending flush or shutdown commands to vulnerable <a href="http://www.hackerschronicle.com/search/label/Memcache" target="_blank">Memcached </a>servers obtained using Shodan API. 
 
This tool is written in python and this allows you to shutdown/flush vulnerable Memcached servers obtained from Shodan search engine and utilising the killswitch published by a security researcher dormando. He has discovered a “kill switch” to counteract the Memcached vulnerability that recently fueled some of the largest distributed denial-of-service (DDoS) attacks in history. The tool also has the capability of shutting down or flushing specific vulnerable memcached servers for companies/services being attacked (assuming the user knows its IP address). 
 
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1K4iyFU004iDBDOTT5G39GzNB3E6VyxpcWew_pRnlbq6zzYuTjkPAd_9oDOpjdOTM4RBJ2R4KvVWTtl-wN-KHX3HnJDmCB7_KOy8EXBMKSgtusro5x01MdFQjlOAqRQI_hHJS64ZG7-Ls/s1600/Memcrashed-DDoS-Exploit.PNG" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Memcached DDoS Exploit Code" border="0" data-original-height="588" data-original-width="592" height="634" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1K4iyFU004iDBDOTT5G39GzNB3E6VyxpcWew_pRnlbq6zzYuTjkPAd_9oDOpjdOTM4RBJ2R4KvVWTtl-wN-KHX3HnJDmCB7_KOy8EXBMKSgtusro5x01MdFQjlOAqRQI_hHJS64ZG7-Ls/s640/Memcrashed-DDoS-Exploit.PNG" title="memcached-ddos-exploit-code" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Poc code to exploit vulnerable Memcache servers</td></tr>
</tbody></table>
 
Memcached is a popular open source distributed memory caching system, which came into news earlier last week when researchers detailed how hackers could abuse it to launch amplification/reflection DDoS attack by sending a forged request to the targeted Memcached server on port 11211 using a spoofed IP address that matches the victim's IP. 
 
For those unaware, Memcached-based amplification/reflection attack amplifies bandwidth of the DDoS attacks by a factor of 51,000 by exploiting thousands of misconfigured Memcached servers left exposed on the Internet.</div>

DDoS Exploit Memcache Memfixed News DDoS Exploit code to shutdown all vulnerable Memcached Servers Released online

For the last few days, Vulnerable Memcached Servers were targeted by hackers to conducted DDoS attacks including the world’s largest eve...

Millions of email servers affected with Remote Code Execution

3/07/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhs3nrpYY0xcgrriLMt2O8YgpcAxx5VzOhM11lO3WVKA192oTRV8TYnnOQRrpAVvr_65JrSEFVQQSc1hjo4B0dPZSyLKKS0TFbho4HQJb_mckC_cRlrB1Ih-gSHfi07DVFxX40dShzoZHdJ/s1600/remote-code-vulnerability-in-exim.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Vulnerability Affects millions of the Email Servers" border="0" data-original-height="570" data-original-width="1344" height="268" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhs3nrpYY0xcgrriLMt2O8YgpcAxx5VzOhM11lO3WVKA192oTRV8TYnnOQRrpAVvr_65JrSEFVQQSc1hjo4B0dPZSyLKKS0TFbho4HQJb_mckC_cRlrB1Ih-gSHfi07DVFxX40dShzoZHdJ/s640/remote-code-vulnerability-in-exim.PNG" title="Vulnerability Affects millions of the Email Servers" width="640" /></a></div>
 
 
A critical vulnerability affects millions of email servers. A fix has been released but this flaw affects more than half of the Internet's <a href="http://www.hackerschronicle.com/search/label/Email">email servers</a>, and patching the issue will take a couple of days. 
 
The vulnerability in <a href="http://www.hackerschronicle.com/search/label/Exim">Exim, a mail transfer agent</a> (MTA) —software that runs on email servers and which relays emails from senders to recipients.According to a survey conducted in March 2018, 56% of all of the Internet's email servers run Exim, with over 63,36,687 available online at the time. 
 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsc0CuLvNkFMrSfewAAPIZwjDjoWEPgkyD8p6oPc3XB6-9nNG-_sMsKxDDc646zSfVVxTQOQyJVzWRuoS5LRqJR-rirTSGEGlehkVCO2kmy5WBfeJcJwBqkJvl1ieLAFNaQdxGTJBmB_M/s1600/vulnerable-exim-servers.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Vulnerability Affects millions of the Email Servers" border="0" data-original-height="413" data-original-width="1328" height="198" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhsc0CuLvNkFMrSfewAAPIZwjDjoWEPgkyD8p6oPc3XB6-9nNG-_sMsKxDDc646zSfVVxTQOQyJVzWRuoS5LRqJR-rirTSGEGlehkVCO2kmy5WBfeJcJwBqkJvl1ieLAFNaQdxGTJBmB_M/s640/vulnerable-exim-servers.PNG" title="Vulnerability Affects millions of the Email Servers" width="640" /></a></div>
 
A Taiwanese security researcher named Meh Chang discovered the bug, which he <a href="https://devco.re/blog/2018/03/06/exim-off-by-one-RCE-exploiting-CVE-2018-6789-en/">reported</a> to the Exim crew on February 2. The Exim team released Exim distribution 4.90.1 on February 10 that fixes the RCE issue. 
 
The bug —tracked as CVE-2018-6789 is categorized as a "pre-auth <a href="http://www.hackerschronicle.com/search/label/Remote%20Code%20Execution">remote code execution</a>," meaning an attacker could trick the Exim email server into running malicious commands before the attacker would need to authenticate on the server. 
 
The actual bug is a one-byte buffer overflow in the base64 decode function of Exim and affects all Exim versions ever released. Chang described the bug in a blog post released earlier today, detailing basic steps for exploiting Exim's SMTP daemon. 
 
In a security advisory, the Exim team publicly acknowledged the issue. "Currently we're unsure about the severity, we believe, an exploit is difficult. A mitigation isn't known," the <a href="https://exim.org/static/doc/security/CVE-2018-6789.txt">Exim team said</a>. 
 
Since Exim 4.90.1's release, updated Exim versions have trickled down to Linux distros used primarily in data centers, but the question remains about the number of unpatched systems that remain online. Taking into account that Exim is by far the most popular mail agent, CVE-2018-6789 opens a large attack surface, and Exim server owners should look into deploying the Exim 4.90.1 update as soon as possible. 
 
At the time of writing, there is no public exploit code for taking advantage of vulnerable Exim servers, but this will likely change in the days following Chang's blog post. 
 </div>

CVE-2018-6789 Email Exim News Remote Code Execution Vulnerability Millions of email servers affected with Remote Code Execution

A critical vulnerability affects millions of email servers. A fix has been released but this flaw affects more than half of the Interne...

Chinese Firm selling Smartphones with pre-installed Banking Malwares

3/05/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWokGpvxoy8oZjI0OOsnHmsDJZF42nU3B2PxFze5HaOa9uatC4LEkVg6JPnXiv6LK5yg0JGyZjpvyd3JgOk3TNKrvx_vJDxS5UWTw4GiOwILGCCyX7he3Pua0OTE6aDE_PpfX0qkCaaIb0/s1600/triada-trojan-preinstalled-on-brand-new-smartphones.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Triada Trojan pre-installed brand new Smartphones" border="0" data-original-height="840" data-original-width="1280" height="420" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgWokGpvxoy8oZjI0OOsnHmsDJZF42nU3B2PxFze5HaOa9uatC4LEkVg6JPnXiv6LK5yg0JGyZjpvyd3JgOk3TNKrvx_vJDxS5UWTw4GiOwILGCCyX7he3Pua0OTE6aDE_PpfX0qkCaaIb0/s640/triada-trojan-preinstalled-on-brand-new-smartphones.jpg" title="Triada Trojan pre-installed brand new Smartphones" width="640" /></a></div>
 
More than 40 models of low-cost Android smartphones are sold already infected with the Triada banking trojan, says Dr.Web, a Russia-based antivirus vendor. The security vendor published today a list of 42 Android models its researchers analyzed and found to be infected with the Android.Triada.231 trojan. 
 
<a href="http://www.hackerschronicle.com/search/label/Triada" target="_blank">Triada </a>is a very powerful Android banking trojan discovered in early 2016. It can root devices and then infect Zygote, a core <a href="http://www.hackerschronicle.com/search/label/Android" target="_blank">Android operating system</a> process, where it's almost impossible to remove without wiping the entire device and reinstalling the OS. Dr.Web says it found the trojan on newly shipped devices from lesser-known brands —mostly based in China— such as Leagoo, Doogee. Vertex, Advan, Cherry Mobile, and others. 
 
 
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCB5gEGCxF-NDcRb8zROpOkYNcfqXWrJuWu5nGZ7-WKEfCP56LQWC_pGRKufzMaaE1kdwqnC7yqDCV_RXJoF38NysnwpRwrV6AX9zqdeI-2twH-AP21yv4X4I5g-g81ZbGbh-Dc1_dzjTM/s1600/how-triada-works.png" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="1600" data-original-width="1229" height="400" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCB5gEGCxF-NDcRb8zROpOkYNcfqXWrJuWu5nGZ7-WKEfCP56LQWC_pGRKufzMaaE1kdwqnC7yqDCV_RXJoF38NysnwpRwrV6AX9zqdeI-2twH-AP21yv4X4I5g-g81ZbGbh-Dc1_dzjTM/s400/how-triada-works.png" width="306" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">How Triada Works</td></tr>
</tbody></table>
 
 
"The <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware </a>is present in the devices which are sold not only in Russia but globally," a Dr.Web spokesperson told Bleeping Computer earlier today via email. "For instance, in Poland, Indonesia, China, the Checz Republic, Mexico, Kazakhstan and Serbia." 
 
Dr.Web's recent discovery isn't new, but it's a continuation of previous research. Back in July 2017, researchers found the same Triada trojan on four low-cost Android smartphone models —Leagoo M5 Plus, Leagoo M8, Nomu S10, and Nomu S20. Researchers continued to look into the matter and eventually discovered 42 smartphone models that were coming with malware pre-installed out of the box. 
 
Experts say that their discovery over the summer didn't deter whoever was behind this action to stop. For example, they found Triada pre-installed on Leagoo M9 phones, a model launched in December 2017. 
 
The antivirus vendor says it contacted all affected vendors, believing one of their shared resellers was injecting the trojan before shipping devices forward. Instead, researchers figured out that a software developer from Shanghai was most likely the source of the Triada infection. 
 
"This company provided Leagoo with one of its applications to be included into an image of the mobile operating system, as well as with an instruction to add third-party code into the system libraries before their compilation," researchers say. "Unfortunately, this controversial request did not evoke any suspicions from the manufacturer. Ultimately, Android.Triada.231 got to the smartphones without any obstacles." 
 
Researchers say this Triada-infected application developed by the Shanghai company was signed with the same certificate that was seen in another malware infection, in November 2016 —an Android app with over 1 million downloads on the Google Play Store that was infecting users with the Android.MulDrop adware. 
 
In the end, this is just another case when users suffer the consequences of companies that fail to validate their software supply chain. 
 
The list of Android smartphone models that Dr.Web found infected with the Triada trojan right out of the box is below: 
<div class="content shadow-radial">
Leagoo M5 
Leagoo M5 Plus 
Leagoo M5 Edge 
Leagoo M8 
Leagoo M8 Pro 
Leagoo Z5C 
Leagoo T1 Plus 
Leagoo Z3C 
Leagoo Z1C 
Leagoo M9 
ARK Benefit M8 
Zopo Speed 7 Plus 
UHANS A101 
Doogee X5 Max 
Doogee X5 Max Pro 
Doogee Shoot 1 
Doogee Shoot 2 
Tecno W2 
Homtom HT16 
Umi London 
Kiano Elegance 5.1 
iLife Fivo Lite 
Mito A39 
Vertex Impress InTouch 4G 
Vertex Impress Genius 
myPhone Hammer Energy 
Advan S5E NXT 
Advan S4Z 
Advan i5E 
STF AERIAL PLUS 
STF JOY PRO 
Tesla SP6.2 
Cubot Rainbow 
EXTREME 7 
Haier T51 
Cherry Mobile Flare S5 
Cherry Mobile Flare J2S 
Cherry Mobile Flare P1 
NOA H6 
Pelitt T1 PLUS 
Prestigio Grace M5 LTE 
BQ 5510</div>
</div>

Android Malwares News Triada Trojan Chinese Firm selling Smartphones with pre-installed Banking Malwares

More than 40 models of low-cost Android smartphones are sold already infected with the Triada banking trojan, says Dr.Web, a Russia-base...

4000 Government Websites Hacked in less than 4 Hours to Mine Cryptocurrency

3/03/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnJjqeIjcqU3MGFmsgNnL0NeymCNjU4wfbAPOJzO7r3dusjiHbjsAgXgK-3KytrKTYX_nru_Xf_Jd3jVU4bICc1ulejSq4tNjczTh46yG_aqNpuXbOMn6J4zp77oKxIdldi_BFDqmSTFwa/s1600/United-States-courts-portal-Hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Government Websites Hacked to mine Cryptocurrency" border="0" data-original-height="360" data-original-width="1000" height="230" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhnJjqeIjcqU3MGFmsgNnL0NeymCNjU4wfbAPOJzO7r3dusjiHbjsAgXgK-3KytrKTYX_nru_Xf_Jd3jVU4bICc1ulejSq4tNjczTh46yG_aqNpuXbOMn6J4zp77oKxIdldi_BFDqmSTFwa/s640/United-States-courts-portal-Hacked.jpg" title="Government Websites Hacked to mine Cryptocurrency" width="640" /></a></div>
Over four thousand high profile government websites have been compromised by <a href="http://www.hackerschronicle.com/search/label/Dark%20Web" target="_blank">dark web</a> hackers across the globe, mining virtual currency secretly, and particularly Monero. 
 
<a href="http://www.hackerschronicle.com/search/label/Monero" target="_blank">Monero </a>has become one of the popular cryptocurrency recently especially on the ‘<a href="http://www.hackerschronicle.com/search/label/Dark%20Web" target="_blank">dark web</a>’– a section of the internet that can only be accessed using a special browser which is capable of anonymizing your browsing location as well as identity. Dark web criminals are taking advantage of this anonymity by trading illegal commodities, substances and services using virtual currencies. 
 
4,275 websites including those in the U.K., the U.S., Ireland, Australian and Canada with government websites with hundreds of thousands of visitors were hacked in less than a period of four hours and unwittingly mined for <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency" target="_blank">cryptocurrency </a>exploiting a security breach. Some of the compromised websites include the United States courts online portal, the United States Information Commissioner Office; the National Health Service in the United Kingdom and the Victorian Parliament website in Australia. The attack by a cryptojacking code hit common websites which had the text-to-speech accessibility script Browsealoud for the visually impaired from Texthelp company. 
 
Recently, Monero has grown in popularity with a market capitalization of $4 billion. Its privacy feature has contributed to its momentum on the dark web making it harder to track compared to bitcoin. 
 
The prices of virtual currency in the market skyrocketed recently and as a scheme that has drawn the attention of criminals. <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime" target="_blank">Cybercrimes </a>increased especially on cryptocurrency as criminals tried to cash in on the skyrocketing crypto prices. The cybercrime industry is recently believed to be overtaking the illegal drug trafficking industry in terms of revenue and hence attracting criminals. 
 
The hacking process involved insertion of a <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malicious </a>code that takes over a portion of a victim’s computer and central processing. Therefore the hacker has the ability of opening a website using a browser in order to mine virtual currency. 
 
The process of mining digital coins requiring less processing power such as Monero is much easier compared to mining bitcoin from websites as it requires powerful specialized computers and software, making Monero mining a better fit for saving on time and energy, making it a very attractive option to criminals. 
 
The dark web hackers had an easier time as they did not compromise each of the 4,275 websites at once, but rather hacked a globally-used plugin named ‘Browsealoud’ which is capable of reading out text from websites for the blind. 
 
After the Browsealoud code was hacked, CoinHive’s Monero miner was silently and secretly injected. Thereafter, any website using the Browsealoud plugin was automatically compromised. 
 
However the cyber-attack was deemed successful as there were basic regulatory measures and requirements over accessibility of some of these government websites that have not been met.</div>

Cryptocurrency Cyber Crime Dark Web Hacking News Monero News 4000 Government Websites Hacked in less than 4 Hours to Mine Cryptocurrency

Over four thousand high profile government websites have been compromised by dark web hackers across the globe, mining virtual currency...

GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

3/02/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
 
 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCA2KmPcZ6tl-1mNqQitTXlcWy_r0PhcOLRKlZI_gPKiQYsjMR1YT2KeOMAYepOISIHRnna0HJngpaUGoeSU1WKZF3L3b66Hnhef6ZozmJpocjc-vTKPseqnsxfBJOz0YAM6iTytCL4FIf/s1600/github-under-biggest-ddos-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps" border="0" data-original-height="577" data-original-width="770" height="476" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhCA2KmPcZ6tl-1mNqQitTXlcWy_r0PhcOLRKlZI_gPKiQYsjMR1YT2KeOMAYepOISIHRnna0HJngpaUGoeSU1WKZF3L3b66Hnhef6ZozmJpocjc-vTKPseqnsxfBJOz0YAM6iTytCL4FIf/s640/github-under-biggest-ddos-attack.png" title="GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps" width="640" /></a></div>
On Wednesday, developer repository site <a href="http://www.hackerschronicle.com/search/label/GitHub" target="_blank">GitHub </a>was hit with a critical DDoS attack that took the site offline multiple times for a few minutes each time. According to a GitHub incident report, the first portion of the attack against the developer platform peaked at 1.35Tbps, and there was a second 400Gbps spike later. This would make it the biggest <a href="http://www.hackerschronicle.com/search/label/DDoS" target="_blank">DDoS </a>attack recorded so far. Until now, the biggest clocked in at around 1.1Tbps. 
 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_6SU_nmV8Bv4GmW9X_53gPWM1IX0B3UkKuRnggsV_NUHpGSXvuppv8h_9tZs6xs0Adc4dC6C3Kn7ny_2BzJrOL-hyTuVn6UI80yv1Z08LzDI5DlpgY_YTiOgXuCBb7oGQCfOLrTC_OCST/s1600/GitHub-hit-by-memcached-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub Under Memcached Attack" border="0" data-original-height="515" data-original-width="1357" height="241" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg_6SU_nmV8Bv4GmW9X_53gPWM1IX0B3UkKuRnggsV_NUHpGSXvuppv8h_9tZs6xs0Adc4dC6C3Kn7ny_2BzJrOL-hyTuVn6UI80yv1Z08LzDI5DlpgY_YTiOgXuCBb7oGQCfOLrTC_OCST/s640/GitHub-hit-by-memcached-attack.png" title="GitHub Under Memcached Attack" width="640" /></a></div>
 
According to the <a href="https://githubengineering.com/ddos-incident-report/" target="_blank">incident report</a>, GitHub was offline Wednesday from 17:21 to 17:26 UTC and intermittently unavailable from 17:26 to 17:30 UTC, thanks to the attack. The report noted that user data wasn't at risk during the attack. 
 
The GitHub attack is the latest in a string of incidents where hackers have exploited a vulnerability in the <a href="http://www.hackerschronicle.com/search/label/Memcache" target="_blank">memcached </a>protocol to amplify the impact of such an attack. Memcached is typically used to speed up websites, but an issue with its UDP protocol makes the attack amplification possible, as noted by <a href="http://www.hackerschronicle.com/search/label/CloudFlare" target="_blank">CloudFlare</a>. 
 
Memcached, as is likely inferred by the name, is a tool that uses data caching to help ease the burden on data stores, it's not necessarily meant to be used with systems that are connected to the internet. But, that hasn't stopped attackers from finding a way to use it to launch and accelerate cyberattacks. By mislabeling a victim's IP as a target address, attackers can overload their network with traffic (up to 51,200x more in acceleration) and trigger a denial of service attack. 
 
<div style="text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOkQ5ZxWG7Fi2puxFcePSQ1YyR7XFqjde3vyIWj4n7lKdSCXNiUxU-aG9KAT9JGFTMm1BRcBFg9IBvVmiemZPCSnduAH8jon0e1MAIZu2mkCAMgAzZRGRkZQ4xhs2IEB_w8OywmARvCBU9/s1600/memcache-ddos.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="411" data-original-width="640" height="256" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiOkQ5ZxWG7Fi2puxFcePSQ1YyR7XFqjde3vyIWj4n7lKdSCXNiUxU-aG9KAT9JGFTMm1BRcBFg9IBvVmiemZPCSnduAH8jon0e1MAIZu2mkCAMgAzZRGRkZQ4xhs2IEB_w8OywmARvCBU9/s400/memcache-ddos.png" width="400" /></a></div>
To fix its own problem, GitHub moved some of its traffic to Akamai for additional capacity at the edge. In its own post <a href="https://blogs.akamai.com/2018/03/memcached-fueled-13-tbps-attacks.html" target="_blank">Akamai</a>, one of the companies who discovered the vulnerability early on, wrote that it predicts "many more, potentially larger attacks in the near future. Akamai has seen a marked increase in scanning for open memcached servers since the initial disclosure." 
 
Josh Shaul, vice president of web security at Akami told, “we modeled our capacity based on five times the biggest attack that the internet has ever seen. So I would have been certain that we could handle 1.3 Tbps, but at the same time we never had a terabit and a half come in all at once.” 
 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHPtaGUF_LQ_T0f-Iq0eo3WtjgLo9Jov2obzmFbqzDui0PFaAQB0TC-hzWy_JfmexZ8ix3Lvj_yZ5cEzAux-Bp8KNRUoDadmrPuBGV8uiwh1ue70RBQt4Zdx0G8T8GT0-nJHW_Kp81wNs0/s1600/GitHub-under-ddos-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GitHub under DDOS attack" border="0" data-original-height="137" data-original-width="720" height="120" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgHPtaGUF_LQ_T0f-Iq0eo3WtjgLo9Jov2obzmFbqzDui0PFaAQB0TC-hzWy_JfmexZ8ix3Lvj_yZ5cEzAux-Bp8KNRUoDadmrPuBGV8uiwh1ue70RBQt4Zdx0G8T8GT0-nJHW_Kp81wNs0/s640/GitHub-under-ddos-attack.png" title="GitHub under DDOS attack" width="640" /></a></div>
 
 
There are few parallels to the scale of the attack, with GitHub saying there were “over a thousand different autonomous systems across tens of thousands of unique endpoints.”  </div>

Cyber Attack DDoS GitHub Memcache News GitHub Hit with Biggest DDoS Attack ever recorded, 1.3 Tbps

On Wednesday, developer repository site GitHub was hit with a critical DDoS attack that took the site offline multiple times for a few ...

Hundreds of WordPress & Joomla websites infected by ionCube Malware

3/01/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCISRo1hVEm5OFH1EX19PrnmdBIUzNSp6gAAdsBSrLx5s5IaAAgkIQAr0prPNAVrgGoobG6Ffa2swbhS559R1Ho20Z1KVrXHE_G4Ke8WQH-K_8pQ3Fg3bwrEVSvnKMoZtlvlZlp57xHcUT/s1600/Wordpress-ionCube-Malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Joomla infected by malware" border="0" data-original-height="330" data-original-width="680" height="308" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgCISRo1hVEm5OFH1EX19PrnmdBIUzNSp6gAAdsBSrLx5s5IaAAgkIQAr0prPNAVrgGoobG6Ffa2swbhS559R1Ho20Z1KVrXHE_G4Ke8WQH-K_8pQ3Fg3bwrEVSvnKMoZtlvlZlp57xHcUT/s640/Wordpress-ionCube-Malware.jpg" title="Wordpress infected by malware" width="640" /></a></div>
 
Security researchers at SiteLock have discovered that hundreds of websites based on WordPress, Joomla and CodeIgniter have been infected with <a href="http://www.hackerschronicle.com/search/label/Malwares" target="_blank">malware </a>that masquerades as legitimate ionCube-encoded files. 
 
ionCube is an encoding technology used to protect PHP software from being viewed, changed, and run on unlicensed computers. 
 
The experts were analyzing an infected <a href="http://www.hackerschronicle.com/search/label/Wordpress" target="_blank">WordPress </a>website when discovered a number of suspicious obfuscated files – such as “diff98.php” and “wrgcduzk.php” – appearing almost identical to legitimate ionCube-encoded files. Further analysis conducted revealed that hundreds of websites were infected by the same ionCube Malware. 
 
“While reviewing an infected site, the SiteLock Research team found a number of suspiciously named, obfuscated files that appear almost identical to legitimate ionCube-encoded files. We determined the suspicious ionCube files were malicious, and found that hundreds of sites and thousands of files were affected.” reads the analysis published by SiteLock. 
 
“Overall, our investigation found over 700 infected sites, totalling over 7,000 infected files.” 
 
Further analysis revealed that attackers also compromised <a href="http://www.hackerschronicle.com/search/label/Joomla" target="_blank">Joomla </a>and <a href="http://www.hackerschronicle.com/search/label/CodeIgniter" target="_blank">CodeIgniter </a>websites. Threat actors packed their malware in a manner that appears ionCube-encoded files. 
 
The malicious code could theoretically infect any website based on a web server running PHP, once decoded, the fake ionCube files compose the ionCube malware. 
 
“While there’s still some degree of obfuscation, the presence of the $_POST and $_COOKIE superglobals and the eval request at the end of the file reveal its true purpose: to accept and execute remotely supplied code.” continues the analysis. “It looks like the remote code supplied to this file is further obfuscated and there may be some sort of access control implemented, judging by the GUID-formatted string present.” 
 
 
The researchers also provided recommendations to mitigate the ionCube Malware, they suggest administrators check the presence of ionCube-encoded files as an indicator of compromise. 
 
If an infection is detected, the scanning of the entire site is recommended, to completely eliminate the threat, the researchers also suggest the adoption of a web application <a href="http://www.hackerschronicle.com/search/label/Firewall" target="_blank">firewall </a>(WAF). 
 
“If you find indicators of this infection, we strongly recommend having your site scanned for malware as soon as possible, as this malware seldom appears on its own.” concluded the analysis. 
 
“This is especially important if you are using an ionCube-encoded application, as manually differentiating the malicious files from the legitimate ones is difficult, and it is common to see up to 100 slightly different variants of this malware on a single site. “ 
 
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjG2L3QHgleFLiGBwrwUF9mAtKK6KMFj1qG1bwIDIBEqOjGYAeNF0kz2JPqNiiS_RdFwXk7-WnV885oD1wfunLLE6tQ_692BaUArItvSegjDxj7phn5zy7BLYBBRSD4WaimFw9PlUpFhiG0/s1600/ionCube-Malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="ionCube Malware" border="0" data-original-height="516" data-original-width="940" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjG2L3QHgleFLiGBwrwUF9mAtKK6KMFj1qG1bwIDIBEqOjGYAeNF0kz2JPqNiiS_RdFwXk7-WnV885oD1wfunLLE6tQ_692BaUArItvSegjDxj7phn5zy7BLYBBRSD4WaimFw9PlUpFhiG0/s640/ionCube-Malware.png" title="ionCube Malware" width="640" /></a></div>
</div>

CodeIgniter ionCube Joomla Malwares News Wordpress Hundreds of WordPress & Joomla websites infected by ionCube Malware

Security researchers at SiteLock have discovered that hundreds of websites based on WordPress, Joomla and CodeIgniter have been infected...