5 Million Popular Android Phones found with pre-installed malwares

3/16/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZTEE4Eu0Mm9uTy7XH2DIQs9OMuUpOneSwROHzMWaEAGRIQyz4cPiGfLnxYIBUUTRU4_h37MkHB8YdM0X6eIXS6AyFdq7hlUqzphIauQLEFd_jTmyLPnzfjmAti3ZuBbXAqyktg5xU5IQL/s1600/android-botnet-malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Millions of Android infected with RoyyenSys Malware" border="0" data-original-height="380" data-original-width="728" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZTEE4Eu0Mm9uTy7XH2DIQs9OMuUpOneSwROHzMWaEAGRIQyz4cPiGfLnxYIBUUTRU4_h37MkHB8YdM0X6eIXS6AyFdq7hlUqzphIauQLEFd_jTmyLPnzfjmAti3ZuBbXAqyktg5xU5IQL/s640/android-botnet-malware.png" title="Millions of Android infected with RoyyenSys Malware" width="640" /></a></div>
<br />
Security researchers at CheckPoint have discovered that Chinese Cyber Criminals are using a malware named as RottenSys to attack android phones all over the world; almost 5 million android devices in their botnet network.<br />
<br />
<blockquote class="tr_bq">
"The Check Point Mobile Security Team has discovered a new widespread malware family targeting nearly 5 million users for fraudulent ad-revenues. They have named it ‘RottenSys’ for in the sample we encountered it was initially disguised as a System Wi-Fi service." according to checkpoint analysis report.</blockquote>
<br />
Experts found an unusual self-proclaimed system Wi-Fi service (<b>系统WIFI服务</b>) on a Xiaomi Redmi phone ans started their investigation. They found that the application does not provide any secure Wi-Fi related service to users. Instead, it asks for many sensitive Android permissions such as accessibility service permission, user calendar read access and silent download permission, which are not related to Wi-Fi service. Their key findings were: <br />
<ul style="text-align: left;">
<li>RottenSys, a mobile adware, has infected nearly 5 million devices since 2016.</li>
<li>Indications show the malware could have entered earlier in the supplier chain.</li>
<li>The attackers have been testing a new botnet campaign via the same C&C server.</li>
</ul>
<br />
The RottenSys malware implements two evasion techniques:<br />
<br />
<ul style="text-align: left;">
<li>The first technique consists of postponing operations for a set time.</li>
</ul>
<ul style="text-align: left;">
<li>The second technique uses a dropper which does not display any malicious activity at first. Once the device is active and the dropper contacts the Command and Control (C&C) server which sends it a list of additional components required for its activity.</li>
</ul>
<br />
The malicious code relies on two open-source projects:<br />
<br />
<ul style="text-align: left;">
<li>The <a href="https://github.com/wequick/small">Small  virtualization</a> framework. RottenSys uses Small to create virtualized containers for its components, with this trick the malware could run parallel tasks, overwhelming Android OS limitations.</li>
</ul>
<ul style="text-align: left;">
<li>The <a href="https://github.com/Marswin/MarsDaemon">MarsDaemon library</a> that keeps apps “undead.” MarsDaemon is used to keep processes alive, even after users close them. Using it the malware is always able to inject ad.</li>
</ul>
<blockquote class="tr_bq">
“This botnet will have extensive capabilities including silently installing additional apps and UI automation. Interestingly, a part of the controlling mechanism of the botnet is implemented in Lua scripts. Without intervention, the attackers could re-use their existing malware distribution channel and soon grasp control over millions of devices.” according to the same the analysis.</blockquote>
<br />
According to the findings, the RottenSys malware began propagating in September 2016. By 12 March 2018; 49,64,460 devices were infected by RottenSys. The <b>top impacted mobile devices brands are Honor, Huawei, and Xiaomi</b>.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxXBJHEKCJ1oz9o8PufOTzv_xLou6yIZ9Q0vRJOArfc7r6bT8zbO2SqNS5Zs9VwU197EzHf4eet2quIs8LrENggDTEp67S8-WS-PtW_ez_YDXKdCr9TSnTRshxADpPqIxJ9cwq7KgGg3bm/s1600/android-phones-infected-with-rottebsys-malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="316" data-original-width="747" height="268" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxXBJHEKCJ1oz9o8PufOTzv_xLou6yIZ9Q0vRJOArfc7r6bT8zbO2SqNS5Zs9VwU197EzHf4eet2quIs8LrENggDTEp67S8-WS-PtW_ez_YDXKdCr9TSnTRshxADpPqIxJ9cwq7KgGg3bm/s640/android-phones-infected-with-rottebsys-malware.png" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZGg8FdzCwQIbAYcRIVctfEi3NM0An11IvuJ5860GPeAoiBxnyNdHtvisEk5BNmpRPtkff5ru3uhhJMSm7s3wdeVie4TX4k7bfzwxxVDSH4RD6fA2H_rut6fv4dy9iFvq5o1vSlOoWIjb5/s1600/chinese-phones-infected-with-malwares.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="329" data-original-width="543" height="386" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZGg8FdzCwQIbAYcRIVctfEi3NM0An11IvuJ5860GPeAoiBxnyNdHtvisEk5BNmpRPtkff5ru3uhhJMSm7s3wdeVie4TX4k7bfzwxxVDSH4RD6fA2H_rut6fv4dy9iFvq5o1vSlOoWIjb5/s640/chinese-phones-infected-with-malwares.png" width="640" /></a></div>
<br />
<br />
RottenSys is totally focusing on aggressive ad network for making huge profits. In the past 10 days alone, it displayed ads 13,250,756 times (commonly called impressions) and out of which 548,822 were converted into ad clicks. We tried to roughly calculate the revenue from these impressions and clicks according to the conservative estimation of 20 cents for each click and 40 cents for each thousand impressions. According to these calculations, <b>the attackers earned over $1,15,000 from their malicious operation in the last ten days alone!</b></div>

5 Million Popular Android Phones found with pre-installed malwares

Security researchers at CheckPoint have discovered that Chinese Cyber Criminals are using a malware named as RottenSys to attack android...

Hundreds of Organizations Worldwide Attacked by Qrypter Trojan

3/15/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAgVwEV_ZXbV1VRyhY4xYBu5TbeU1Cy8WuHTunkq65TGlmhGtJN71K0rSgE6uF6ivtc70Emv4KkurY_giuwD7iWvI13_F56FC1Yx-w8g6HuDoOtlAfdGU1oAMDm-Tmds5Ebv3sFLepRyzX/s1600/qrypter-rat.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Qrypter-Trojan-attack" border="0" data-original-height="558" data-original-width="1200" height="296" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAgVwEV_ZXbV1VRyhY4xYBu5TbeU1Cy8WuHTunkq65TGlmhGtJN71K0rSgE6uF6ivtc70Emv4KkurY_giuwD7iWvI13_F56FC1Yx-w8g6HuDoOtlAfdGU1oAMDm-Tmds5Ebv3sFLepRyzX/s640/qrypter-rat.jpg" title="Qrypter-Trojan-attack" width="640" /></a></div>
According to a security firm Forcepoint, Hundreds of organizations all around the globe have been targeted in a series of attacks that leverage the <b>Qrypter remote access Trojan </b>(RAT).<br />
<br />
The <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a>, often mistaken for the <b>Adwind </b>cross-platform backdoor, has been around for a couple of years, and was developed by an underground group called ‘QUA R&D’, which offers a Malware-as-a-Service (MaaS) platform. <br />
<br />
Also known as<b> Qarallax, Quaverse, QRAT</b>, and Qontroller, Forcepoint explains that <b>Qrypter is a Java-based <a href="http://www.hackerschronicle.com/search/label/rat">RAT</a> that leverages TOR-based command and control</b> (C&C) servers. It was first detailed in June 2016, after being used in an attack targeting individuals applying for a U.S. Visa in Switzerland.<br />
<br />
The malware is typically delivered via malicious email campaigns that usually consist of only a few hundred messages each. However, Qrypter continues to rise in prominence, and three Qrypter-related campaigns observed in February 2018 affected 243 organizations in total, Forcepoint's security researchers say. <br />
<br />
When executed on a victim’s system, Qrypter drops and runs two VBS files in the %Temp% folder, each featuring a random filename. The two scripts are meant to gather information on the firewall and anti-virus products installed on the computers. <br />
<br />
Qrypter is a plugin based <span id="goog_2122346973"></span><a href="http://www.hackerschronicle.com/search/label/Trojan">backdoor <span id="goog_2122346974"></span></a>that provides attackers with a broad range of capabilities: remote desktop connection, webcam access, file system manipulation, installation of additional files, and task manager control. <br />
<br />
The <b>RAT is available for rent for a price of $80</b>, payable in PerfectMoney, Bitcoin-Cash, or <a href="http://www.hackerschronicle.com/search/label/Bitcoin">Bitcoin</a>. Interested parties can purchase three months or one-year subscriptions for a discounted price, the security researchers discovered. <br />
<br />
An older Bitcoin address associated with payments for Qrypter subscriptions was appears to have received a total of 1.69 BTC (around $13,500 at the time of publishing). This, however, is only one of the addresses that the malware authors use, meaning that their earnings could be much higher.<br />
<br />
The malware developers provide support to their customers via a forum called ‘Black&White Guys’, which currently has over 2,300 registered members. <br />
<br />
Based on the content of the forum, the researchers were able to discover how QUA R&D operates. The group appears focused on keeping customers happy, and is regularly creating threads to inform and reassure users that their crypting service (available for $5) is fully undetected by anti-virus vendors. <br />
<br />
<blockquote class="tr_bq">
“Indeed, ensuring their product is fully undetectable is one of the primary priorities for the group and potentially explains why even after nearly two years Qrypter remains largely undetected by anti-virus vendors,” Forcepoint notes. </blockquote>
<br />
In addition to interacting with customers, the forum is also used to attract potential resellers, which receive discount codes to help increase Qrypter's popularity in underground circles. Furthermore, older RAT versions are offered for free to customers, and QUA R&D’s strategy also involves the cracking of competitor products, to <a href="http://www.hackerschronicle.com/2011/07/make-keylogger-and-trojan-fully.html">create FUD</a> (fear, uncertainty, and doubt) about competition.<br />
<br />
<blockquote class="tr_bq">
“While the Qrypter MaaS is relatively cheap, QUA R&D's occasional release of cracked competitor products may exponentially increase attacks in the wild by making potent crimeware accessible to anyone for free,” Forcepoint concludes.  </blockquote>
</div>

adwind Hacking News qarallax Qrypter quaverse rat Trojan Hundreds of Organizations Worldwide Attacked by Qrypter Trojan

According to a security firm Forcepoint, Hundreds of organizations all around the globe have been targeted in a series of attacks that l...

ISRO computers infected with Malwares, Could be Hacked

3/14/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtAoCP4N_b7bZzZsDPujcRd4jTlXUpqHy2oQBMrNtsCQ68UOoIJwYgYhb-Mf3QFHpBMeM12af-3wFRZrJNX_TVnHPr9xC9UpPyIjz6fcK9Nt4KB7csDCkPXfhbwwt1AFVohsoWD4oK9MQx/s1600/ISRO-infected-with-trojan.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Malware-attack-on-ISRO" border="0" data-original-height="338" data-original-width="666" height="324" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhtAoCP4N_b7bZzZsDPujcRd4jTlXUpqHy2oQBMrNtsCQ68UOoIJwYgYhb-Mf3QFHpBMeM12af-3wFRZrJNX_TVnHPr9xC9UpPyIjz6fcK9Nt4KB7csDCkPXfhbwwt1AFVohsoWD4oK9MQx/s640/ISRO-infected-with-trojan.jpg" title="Malware-attack-on-ISRO" width="640" /></a></div>
<br />
Security researchers have claimed that a malware has infected computer systems of  India’s premier space research agency, <a href="http://www.hackerschronicle.com/search/label/isro">Indian Space and Research Organization</a> (ISRO).<br />
<br />
Indian and French security experts believe that using the <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerability</a>, hackers could have easily taken control of ISRO’s command rocket launches.<br />
<br />
On December 2017, the researchers detected a trojan malware, known as <a href="http://www.hackerschronicle.com/search/label/xtremerat">XtremeRAT</a>, in ISRO servers and they immediately reported to the agency by an Indian researcher. However, ISRO  responded and resolved the issue only after French researcher Robert Baptiste reached out to the agency on Twitter.<br />
<br />
“ISRO in their conversation with me informed that that investigated and found a UTM login port that was not mapped internally to any systems.They claimed to have disabled that port for now,” said Baptiste quoting ISRO’s communication.<br />
<br />
The <a href="http://www.hackerschronicle.com/search/label/Malwares">malware </a>had infected the ISRO’s Telemetry, Tracking and Command Networks (ISTRAC) whose main function is to provide tracking support for all the satellite and launch vehicle missions of ISRO.<br />
<br />
“The malware was probably infected on a computer that had access to servers used for Tracking and Command (TTC) services that help launch vehicle lift-off till injection of a satellite. A computer which was probably used to command rocket launches and separation of a satellite. I say ‘probably infected’ because no one knows which computer was used,” said the Indian researcher.<br />
<br />
<b>XtremeRAT </b>is a commercially available <a href="http://www.hackerschronicle.com/search/label/rat">remote access Trojan</a> (RATs) used by hackers to conduct cyber espionage. There are a number of RATs that are available for free and can be purchased online. It allows the hacker to hack specific target’s servers and databases.<br />
<br />
"If infected with a <a href="http://www.hackerschronicle.com/search/label/Trojan">trojan</a>, the attacker owns the computer. The hacker can command the computer to do absolutely anything he wants. He just has to use the Remote Desktop Protocol  (RDP) to access a computer. Has there been a data loss? most likely yes,” says the Indian researcher. </div>

Hacking News isro Malwares rat Trojan xtremerat ISRO computers infected with Malwares, Could be Hacked

Security researchers have claimed that a malware has infected computer systems of India’s premier space research agency, Indian Space a...

Calendar app in Mac App Store is openly mining cryptocurrency in background

3/13/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnp2gfb-T4DnvsHXezl5oNNba6XRwuEuLIfSdCLiBD_8951TnC2rwl-U5icAfUFJTACq-v6ieYzJ7S48td97pqrXtcWOGBZKiELIxK6COmmBPKi-jlDcb5YNr38xxmHg7UHKq0Bzwntt4-/s1600/calendar-2-mining-monero.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Popular Calendar 2 app openly mines Monero by default" border="0" data-original-height="582" data-original-width="571" height="640" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjnp2gfb-T4DnvsHXezl5oNNba6XRwuEuLIfSdCLiBD_8951TnC2rwl-U5icAfUFJTACq-v6ieYzJ7S48td97pqrXtcWOGBZKiELIxK6COmmBPKi-jlDcb5YNr38xxmHg7UHKq0Bzwntt4-/s640/calendar-2-mining-monero.jpg" title="Popular Calendar 2 app openly mines Monero by default" width="625" /></a></div>
A schedule application in the Mac App Store <b>Calendar 2</b> has been mining <a href="http://www.hackerschronicle.com/search/label/Cryptocurrency">cryptocurrency </a>out of sight in return for giving clients extra highlights — and an alternative to quit mining has been broken. Up until this point, Apple has not taken the booking application Calendar 2 down, even after Ars Technica informed the organization that <a href="https://itunes.apple.com/us/app/calendar-2/id415181149?mt=12">Calendar 2</a> has been mining virtual currency. <br />
<br />
The application is a buffed-up variant of Apple's Calendar application in <a href="http://www.hackerschronicle.com/search/label/macOS">macOS</a>, yet as of late, its designer, Qbix, added additional code to mine <a href="http://www.hackerschronicle.com/search/label/Monero">monero</a>, an advanced coin propelled in April 2014 and intended to be a more unknown adaptation of bitcoin, as you can't see exchanges on an open record. That makes Calendar 2 something of an irregularity in the App Store — there don't have all the earmarks of being other mining applications in the store, not to mention applications that utilization mining as an approach to get extra an incentive from non-paying clients. <br />
<br />
The miner keeps running in return for giving the clients a chance to get to more premium highlights. Clients can quit by keeping premium highlights off or paying for them through the App Store. <br />
<br />
Be that as it may, as Ars noticed, the application had a bug that kept the digger running, regardless of whether clients endeavored to quit, and a moment bug that made the excavator expend a larger number of assets than initially proposed. A client noted on Twitter that the application "<b>ate 200% CPU until the point that I discovered it and murdered it. I didn't expect a mineworker contamination from an App Store seller. Amazing</b>." The application's present rating is two out of five in the App Store, with numerous current surveys docking stars due to the undesirable mining. Qbix expressed that it was highly involved with distributing a fix for the bugs. <br />
<br />
Mining programs tend to support Monero over <a href="http://www.hackerschronicle.com/search/label/Bitcoin">Bitcoin </a>or Ethereum, as Monero has a more CPU-friendly hashing calculation. </div>

Calendar app in Mac App Store is openly mining cryptocurrency in background

Apple App Store Calender2 cryprocurrency mining Cryptocurrency Cryptocurrency Malware Cryptomining mac software macOS Monero Calendar app in Mac App Store is openly mining cryptocurrency in background

A schedule application in the Mac App Store Calendar 2 has been mining cryptocurrency out of sight in return for giving clients extra h...

Chinese Spies using malwares to attack U.K. Government

3/12/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGm8M94_eBC7PlQ8oRsH1Y4aope0ywG21Rrhw4_Fnd_Xnf-7RQqySzE8Vivx_A0XPFFwWxmRAOdOq407qtfp7qrn9QTcDtGaAxHSyjhPgBkCp6g-H6SRtz_K2Ka2VjIXqajXnVBNl0Yd9w/s1600/Chinese-hackers-attacking-UK-Government.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Chinese Hackers Attacking UK Government with Malwares" border="0" data-original-height="667" data-original-width="1000" height="425" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgGm8M94_eBC7PlQ8oRsH1Y4aope0ywG21Rrhw4_Fnd_Xnf-7RQqySzE8Vivx_A0XPFFwWxmRAOdOq407qtfp7qrn9QTcDtGaAxHSyjhPgBkCp6g-H6SRtz_K2Ka2VjIXqajXnVBNl0Yd9w/s640/Chinese-hackers-attacking-UK-Government.jpg" title="Chinese Hackers Attacking UK Government with Malwares" width="640" /></a></div>
A known cyber espionage group believed to be operating out of <a href="http://www.hackerschronicle.com/search/label/Chinese%20Hackers">China </a>was last year spotted using new malware in an attack aimed at an organization that provides services to the U.K. government.<br />
<br />
Details about the attack were presented last week at Kaspersky’s Security Analyst Summit (SAS) in Cancun by Ahmed Zaki, senior malware researcher at NCC Group.<br />
<br />
The attack has been attributed to a threat actor known as APT15, Ke3chang, Mirage, Vixen Panda and Playful Dragon. NCC Group started analyzing the group’s recent activities after it targeted one of its customers, a global company that provides a wide range of services to the United Kingdom government.<br />
<br />
Acording to securityweek Researchers believe the <b>attackers had been targeting various U.K. government departments and military technology</b> through its customer. NCC has not made any statements regarding attribution, but Zaki did mention during his presentation at SAS that APT15 was particularly active during hours that correspond to working hours in East Asia.<br />
<br />
APT15 has been active since at least 2010 and it has targeted organizations all around the world using its own malware and Word, Adobe Reader and Java exploits. The group has improved its tools and techniques over the years, and NCC recently spotted two new backdoors it created.<br />
<br />
One of the backdoors has been dubbed RoyalCLI and is considered a successor of BS2005, a piece of malware that is often used by the group. RoyalCLI leverages similar encryption and encoding routines, and they both communicate with command and control (C&C) servers via Internet Explorer using the IWebBrowser2 interface.<br />
<br />
The malware uses the Windows command prompt (cmd.exe) to execute a majority of its commands. It’s designed to copy the cmd.exe file and modify it, which allows it to bypass policies that might prevent the command prompt from running on the targeted device.  <br />
<br />
The second backdoor, named RoyalDNS, uses DNS, specifically TXT records, to communicate with the C&C server. This piece of malware receives commands, executes them, and returns output through DNS.<br />
<br />
In the case of the attack analyzed by NCC, the hackers compromised more than 30 hosts, with forensic artifacts showing that the initial intrusion may have occurred as early as May 2016. NCC was asked by the client to stop its investigation in June 2017, but resumed it in August after the threat actor managed to regain access to the victim’s network. Experts determined that the hackers had stolen a VPN certificate from a compromised host and used it to regain access via the corporate VPN.<br />
<br />
The commands sent by the attackers to the RoyalCLI and BS2005 malware were cached to the disk of compromised devices, allowing researchers to recover over 200 commands. Since one of the commands contained a typo, investigators determined that they were likely sent by a human operative rather than an automated process.<br />
<br />
In addition to BS2005, RoyalCLI and RoyalDNS, APT15 used custom-built keyloggers, and Microsoft SharePoint and Exchange enumeration and data dumping tools. The group’s arsenal also includes widely available tools such as Mimikatz, CSVDE, NetEnum, and RemoteExec.<br />
<br />
Moreover, the attackers relied on various Windows commands to conduct reconnaissance, including tasklist, ping, netstat, net, systeminfo, ipconfig and bcp. For lateral movement they leveraged the net command and manually copied files to and from compromised hosts.<br />
<br />
“Through our investigation we were able to identify and monitor the attack process from start to finish, offering us unique insight into the behaviour of this group,” Zaki said. “It’s clear to see that this is a highly sophisticated threat actor that has no problem writing tools which are specific to its victims.”</div>

APT Chinese Hackers Chinese Spies Hacking News RoyalCLI RoyalDNS Chinese Spies using malwares to attack U.K. Government

A known cyber espionage group believed to be operating out of China was last year spotted using new malware in an attack aimed at an org...

Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

3/10/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdV7v7ncahe3qwjXHcok_B73pE_DNqfje6O7Q30mp3Zo1V1TZtqUKjP9luc1VvqZjcL9DdzR6EFbGO_wBBFmTFmxdrlzDHmgnmqmGYuzhv3nT1eZGKUJLuuB-GTvK96Byo-Te-UdzKKiDq/s1600/cryptoccurency-mining-malware-RedisWannaMine.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Hackers are targeting Redis and Windows servers for cryptomining " border="0" data-original-height="465" data-original-width="720" height="411" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgdV7v7ncahe3qwjXHcok_B73pE_DNqfje6O7Q30mp3Zo1V1TZtqUKjP9luc1VvqZjcL9DdzR6EFbGO_wBBFmTFmxdrlzDHmgnmqmGYuzhv3nT1eZGKUJLuuB-GTvK96Byo-Te-UdzKKiDq/s640/cryptoccurency-mining-malware-RedisWannaMine.jpg" title="Hackers are targeting Redis and Windows servers for cryptomining " width="640" /></a></div>
<br />
Security researchers at Imperva have come across a new <a href="http://www.hackerschronicle.com/search/label/Cryptojacking">cryptojacking </a>worm that infects Redis and Windows servers with cryptomining <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a>.<br />
<br />
The attack, which has been dubbed <a href="http://www.hackerschronicle.com/search/label/RedisWannaMine">RedisWannaMine </a>by researchers from security firm Imperva, scans for <b>misconfigured Redis deployments and Windows Servers that are still vulnerable to the Eternal Blue SMB <a href="http://www.hackerschronicle.com/search/label/Exploits">exploit</a>.</b><br />
<br />
While investigating an attack against a web server that attempted to exploit the <b>CVE-2017-9805</b> vulnerability in Apache Struts, the Imperva researchers located a command-and-control server hosting multiple attack scripts. One of those scripts was a new cryptomining downloader that exhibited worm-like behavior.<br />
<br />
When executed, the script attempts to install a variety of packages through apt-get or yum—depending on the Linux distribution—creates entries in crontab for persistence and adds a new authorized SSH key for authentication. It then proceeds to download a tool called masscan from GitHub and compiles it.<br />
<br />
<b>Masscan is a high-performance TCP port scanner</b> and is used by <b>RedisWannaMine </b>to scan external and internal IP addresses for Redis deployments. Redis is an in-memory data store that can be used as a database, cache or message broker. It is usually deployed on internal networks, but thousands of such servers have been found exposed on the internet in the past. The project page of <a href="https://github.com/robertdavidgraham/masscan">Masscan</a> describes it as “<b>TCP port scanner, spews SYN packets asynchronously, scanning entire Internet in under 5 minutes</b>.”<br />
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJMVXe1axhx_0ifPV9UQfCDbpGj7tB7CVqo97UHjD9NP-PWON8uni3Mt8IizLcBToJNJ3Zc3mHPcVqbcw_SYEPegsRg_gD2szWYtMy7mTf1mTMDI4OlM-LLyM33gKHR8POmdvnMP3Doms/s1600/mascan-TCP-Scanner.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Masscan a high-performance TCP port scanner" border="0" data-original-height="206" data-original-width="845" height="155" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQJMVXe1axhx_0ifPV9UQfCDbpGj7tB7CVqo97UHjD9NP-PWON8uni3Mt8IizLcBToJNJ3Zc3mHPcVqbcw_SYEPegsRg_gD2szWYtMy7mTf1mTMDI4OlM-LLyM33gKHR8POmdvnMP3Doms/s640/mascan-TCP-Scanner.png" title="Masscan a high-performance TCP port scanner" width="640" /></a></div>
<br />
<br />
When an unprotected Redis server is discovered, the script installs cryptomining malware on it and creates crontab entries for persistence. The script then launches another scan, this time for Windows Servers that accept SMB connections.<br />
<br />
The goal of the second scan is to find servers that are vulnerable to the Eternal Blue SMB exploit used by <a href="http://www.hackerschronicle.com/search/label/WannaCry">WannaCry</a>, <a href="http://www.hackerschronicle.com/search/label/notPetya">NotPetya </a>and other malware attacks over the past year. When such a servers are identified, the script downloads and installs a different cryptomining component for Windows.<br />
<br />
Compared to past cryptojacking attacks that primarily target servers available on the internet, <b>RedisWannaMine also spreads laterally through local networks, making it much more dangerous to companies.</b><br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXH9YAByWecwOsKjw_3-Hh9YEHhFJv6d1_vJ60su3ELwMZLe2IYggemN0gZj5AgFg-YHsy7XiuYUfviIo26KgUk77daHKbinqPVTKH208B9EnAWqf4wGQRsgcdyX-K9WbO6NlKtrHbzQgI/s1600/working-of-RedisWannaMine.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Working of RedisWannaMine Malware" border="0" data-original-height="570" data-original-width="1024" height="355" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjXH9YAByWecwOsKjw_3-Hh9YEHhFJv6d1_vJ60su3ELwMZLe2IYggemN0gZj5AgFg-YHsy7XiuYUfviIo26KgUk77daHKbinqPVTKH208B9EnAWqf4wGQRsgcdyX-K9WbO6NlKtrHbzQgI/s640/working-of-RedisWannaMine.png" title="Working of RedisWannaMine Malware" width="640" /></a></div>
<br />
The malware “is more complex in terms of evasion techniques and capabilities,” the Imperva researchers said in a report. “It demonstrates a worm-like behavior combined with advanced exploits to increase the attackers’ infection rate and fatten their wallets. In a nutshell, cryptojacking attackers have upped their game and they are getting crazier by the minute!” </div>

Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Cryptocurrency Cryptojacking Cryptomining CVE-2017-9805 Redis RedisWannaMine Windows Server Redis and Windows servers targeted by a new cryptomining malware RedisWannaMine

Security researchers at Imperva have come across a new cryptojacking worm that infects Redis and Windows servers with cryptomining malwa...

Saposhi a new malware to take down all IoT devices is out

3/09/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ8p7qWG1DwmBPgKLhzzWdUqUSRexWf70vpudaCzjinTSUdHMKaE0_AZwb1d8bUoIhdL-tpGAdYEPROknhA8DhDrAq9wy5caeaAv26qLpkHmmO5kzkSKNxBtR4vv5R83lUiTNqHsbbyYy9/s1600/Saposhi-DDoS-Malware.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Saposhi a new malware to take down all IoT devices is out" border="0" data-original-height="750" data-original-width="1000" height="480" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgQ8p7qWG1DwmBPgKLhzzWdUqUSRexWf70vpudaCzjinTSUdHMKaE0_AZwb1d8bUoIhdL-tpGAdYEPROknhA8DhDrAq9wy5caeaAv26qLpkHmmO5kzkSKNxBtR4vv5R83lUiTNqHsbbyYy9/s640/Saposhi-DDoS-Malware.jpg" title="Saposhi a new malware to take down all IoT devices is out" width="640" /></a></div>
<br />
Cybersecurity agencies detected a new malware <b>Saposhi</b> , which can cripple the entire industries by taking over electronic devices and turning them into 'bots', which can be used for <a href="http://www.hackerschronicle.com/search/label/DDoS">Distributed Denial of Service</a> (DDoS) attacks .<br />
<br />
The <b>new malware Saposhi was detected around 15 days ago</b> according to a report of the Hindu, and is currently being watched and studied.<br />
<br />
<b>“Saposhi is similar in its intensity to Reaper, which was taking over millions of devices at the rate of 10,000 devices per day.</b> Various cybersecurity agencies are currently keeping tabs on it to get a better idea of what it is capable of,” he said.<br />
<br />
A Central Government organisation <b>'the Computer Emergency Response Team (CERT)', had issued an alert about malwares </b>Mirai, and Reaper, but has not yet issued any alert regarding the new malware.<br />
<br />
<b>“We need to first ensure that the information we have is indeed substantiated before raising alarm bells.</b> Right now, what we know for sure is that Saposhi exists, and is highly capable. Factors like whether it is aimed at any particular kind of device, or has a specific purpose are still being verified,” a officer said.<br />
<br />
<a href="http://www.hackerschronicle.com/search/label/Malwares">Malwares </a>which are primarily aimed at DDoS attacks first creates a 'botnet,'network of bots, these botnet are used to ping a server at the same time. If the<b> number of pings increases beyond the server’s capacity, the server crashes and denies service.</b> Saposhi, Reaper and Mirai are DDoS attack malwares.<br />
<br />
In July 2016, small and medium internet service providers in Maharashtra fell prey to a DDoS attack, which caused disruption in the services of several Internet Service Providers (ISP) in the State.<br />
<br />
In 2016, Mirai, using a botnet of 5 lakh devices, had caused the servers of Dyn, a leading domain name service provider, to crash, affecting services of popular websites like Twitter, Netflix and Reddit.<br />
<br /></div>

Botnet CyberSecurity DDoS Malwares Mirai News Reaper Saposhi Saposhi a new malware to take down all IoT devices is out

Cybersecurity agencies detected a new malware Saposhi , which can cripple the entire industries by taking over electronic devices and t...