Data Breach at Orbitz exposed 880,000 credit cards

3/21/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXXnPBMyuwTZoTNpyjN5CmLaO3JgDrV_xEgkSgKkPR0P4xYcnurZoX4pSXj-nu-cIXOoSwGopMJ_93H6fTS6HMEVLoE8LLvYMQZKa_IRliLx5uzrFD3dXuM1FW5x7oI8SLiHgrFdSJIL77/s1600/expedia-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="533" data-original-width="800" height="426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXXnPBMyuwTZoTNpyjN5CmLaO3JgDrV_xEgkSgKkPR0P4xYcnurZoX4pSXj-nu-cIXOoSwGopMJ_93H6fTS6HMEVLoE8LLvYMQZKa_IRliLx5uzrFD3dXuM1FW5x7oI8SLiHgrFdSJIL77/s640/expedia-hacked.jpg" width="640" /></a></div>
<br />
Travel website Orbitz, a subsidiary of Expedia Inc. disclosed Tuesday a <a href="http://www.hackerschronicle.com/search/label/databreach">security breach</a> that may have exposed data for thousands of customers, including information on 8,80,000 <a href="http://www.hackerschronicle.com/search/label/Credit%20Card">credit cards</a>.<br />
<br />
The Expedia-owned travel website operator said the breach affected an older website and the platform of an unnamed business partner. The information attackers “likely accessed” included people’s names, dates of birth, email addresses, street addresses, and genders, Orbitz said.<br />
<br />
The <a href="http://www.hackerschronicle.com/search/label/Data%20Leak">data leak</a>, which took place between Oct. and Dec. and involved records dating between Jan. 1, 2016 and Dec. 22, 2017, did not affect its current website, <a href="http://orbitz.com/">Orbitz.com</a>, nor did it involve any Social Security numbers, Orbitz said. The company said it “has not found any evidence” that other customer information was affected, like travel itineraries or passports.<br />
<br />
Orbitz advised customers who used its services during the prescribed time period to check their credit and debit card billings statements and to contact their banks if they see any fraudulent charges.<br />
<br />
Orbitz said it was in the process of notifying potential victims and that it would offer them a year of free credit monitoring services. Customers with questions can visit <a href="http://orbitz.allclearid.com/">orbitz.allclearid.com</a> for more information, the company said.<br />
<blockquote class="tr_bq">
“We deeply regret the incident,” Orbitz said in a statement, noting that it was unsure whether hackers had indeed absconded with customer information. The company determined on March 1, 2018 that it had uncovered “evidence suggesting…an attacker may have accessed personal information,” it said.</blockquote>
“We took immediate steps to investigate the incident and enhance security and monitoring of the affected platform,” Orbitz said.<br />
<br />
Expedia’s share price fell almost 2% during the day.</div>

Travel website Orbitz, a subsidiary of Expedia Inc. disclosed Tuesday a security breach that may have exposed data for thousands of cus...

Intel processors will use hardware-based protections against Meltdown and Spectre 2

3/20/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9EtGh1NAW69qca9ByY_y1QdHET3Iwt7bxUc37EhPSlTaJJFQNiy49abJzlV0iIx62d7Ni21AFBKVob3eeDXqBb5jdZeAvaLOseuAkgrXcRP0n-2GjKGTMrF-lz5cEyFGKR21uYXhsOnee/s1600/intel-meltdown-spectre-patch.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="900" data-original-width="1600" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9EtGh1NAW69qca9ByY_y1QdHET3Iwt7bxUc37EhPSlTaJJFQNiy49abJzlV0iIx62d7Ni21AFBKVob3eeDXqBb5jdZeAvaLOseuAkgrXcRP0n-2GjKGTMrF-lz5cEyFGKR21uYXhsOnee/s640/intel-meltdown-spectre-patch.png" width="640" /></a></div>
<br />
Intel has officially pushed out microcode updates with Spectre and Meltdown mitigations for all of the processors it launched in the past five years.<br />
<br />
In addition to this, the company’s CEO announced new, redesigned processor lines that will start shipping later this year and will include hardware-based protection for Meltdown (exploiting CVE-2017-5754, a rogue cata cache load flaw) and variant 2 of Spectre (exploiting CVE-2017-5715, a branch target injection <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerability</a>).<br />
<blockquote class="tr_bq">
“While [Spectre] Variant 1 will continue to be addressed via software mitigations, we are making changes to our hardware design to further address the other two,” Intel CEO Brian Krzanich <a href="https://newsroom.intel.com/editorials/advancing-security-silicon-level/">said</a>.</blockquote>
“We have redesigned parts of the processor to introduce new levels of protection through partitioning that will protect against both Variants 2 [<a href="http://www.hackerschronicle.com/search/label/spectre">Spectre</a>] and 3 [<a href="http://www.hackerschronicle.com/search/label/meltdown">Meltdown</a>]. Think of this partitioning as additional ‘protective walls’ between applications and user privilege levels to create an obstacle for bad actors. These changes will begin with our next-generation Intel Xeon Scalable processors (code-named Cascade Lake) as well as 8th Generation Intel Core processors expected to ship in the second half of 2018. ”<br />
<br />
He did not offer more details about these protections, but the video included in the announcement says that the Spectre variant 2 fixes will make it so that attackers can’t influence the path the speculative execution process and use misdirections to gain access to sensitive data. The solution, Intel says, “retains the many benefits of speculative execution, while addressing the threat of variant 2.”<br />
<br />
Organizations and users who don’t want to spend money on new processors will have to make do with the firmware updates for the old ones – and suffer some performance impacts.<br />
<br />
<blockquote class="tr_bq">
“We have now released <a href="https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf">microcode updates</a> for 100 percent of Intel products launched in the past five years that require protection against the side-channel method vulnerabilities discovered by Google,” Krzanich noted.</blockquote>
<br />
It is on industry partners like Microsoft to implement them via firmware and software updates.<br />
<br />
Krzanich, of course, advised everyone to implement the updates as they are made available.</div>

Intel processors will use hardware-based protections against Meltdown and Spectre 2

CVE-2017-5715 Hacking News intel Malwares meltdown spectre Intel processors will use hardware-based protections against Meltdown and Spectre 2

Intel has officially pushed out microcode updates with Spectre and Meltdown mitigations for all of the processors it launched in the pas...

Russia Linked hacking group Sofacy APT attacking European Government Agencies

3/19/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWjy6QuFllWbAluEJnhxN3IM-J47fd6jyqAfwLumiaHtJotl50ubw46Ag1dConjKBJa8CAyD7wfi_F6VGn10Yop72k-4MHqSxXg-NtfZZQ_loZbxSZz0PVc2qkputRhlEH6xS4D2klWKmV/s1600/fancy-bear-attck.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Fancy Bear attack on European Union GOvernment" border="0" data-original-height="508" data-original-width="940" height="344" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWjy6QuFllWbAluEJnhxN3IM-J47fd6jyqAfwLumiaHtJotl50ubw46Ag1dConjKBJa8CAyD7wfi_F6VGn10Yop72k-4MHqSxXg-NtfZZQ_loZbxSZz0PVc2qkputRhlEH6xS4D2klWKmV/s640/fancy-bear-attck.jpg" title="Fancy Bear attack on European Union GOvernment" width="640" /></a></div>
<br />
Last week the US Government announced sanctions against five Russian entities and 19 individuals, including the FSB, the military intelligence agency GRU.<br />
<br />
Despite the sanctions, <a href="http://www.hackerschronicle.com/search/label/Russian%20Hackers">Russian hackers</a> continue to target entities worldwide, including US organizations.<br />
<br />
The Russian spy agencies and the individuals are accused of trying to influence the 2016 presidential election and launching massive <a href="http://www.hackerschronicle.com/2018/02/russian-military-involved-in-notpetya.html">NotPetya </a>ransomware campaign and other attacks on businesses in the energy industry.<br />
<br />
Last year, the Department of Homeland Security and Federal Bureau of Investigation issued a joint technical alert to warn of attacks on US critical infrastructure powered by Russian threat actors. The US-CERT blamed the APT group tracked as <a href="http://www.hackerschronicle.com/search/label/dragonfly">Dragonfly</a>, <a href="http://www.hackerschronicle.com/search/label/crouching%20yeti">Crouching Yeti</a>, and <a href="http://www.hackerschronicle.com/search/label/energetic%20bear">Energetic Bear</a>.<br />
<br />
Now the US-CERT updated its <a href="https://www.us-cert.gov/ncas/alerts/TA18-074A">alert </a>by providing further info that and officially linking the above APT groups to the Kremlin.<br />
<br />
The Alert (<a href="https://www.us-cert.gov/ncas/alerts/TA18-074A">TA18-074A</a>) warns of “Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors,” it label the attackers as “Russian government cyber actors.”<br />
<blockquote class="tr_bq">
“This alert provides information on Russian government actions targeting U.S. Government entities as well as organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.” reads the alert. </blockquote>
<blockquote class="tr_bq">
“It also contains indicators of compromise (IOCs) and technical details on the tactics, techniques, and procedures (TTPs) used by Russian government cyber actors on compromised victim networks.” </blockquote>
<br />
According to the DHS, based on the analysis of indicators of compromise, the Dragonfly threat actor is still very active and its attacks are ongoing.<br />
<br />
“DHS and FBI characterize this activity as a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities’ networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks.” continues the alert. “After obtaining access, the Russian government cyber actors conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems (ICS).”<br />
<br />
The Russian Government has always denied the accusations, in June 2017 Russian President Putin declared that patriotic hackers may have powered attacks against foreign countries and denied the involvement of <a href="http://www.hackerschronicle.com/search/label/Russian%20Military">Russian cyberspies</a>.<br />
<br />
A few days ago, cyber security experts at Palo Alto Networks uncovered hacking campaigns launched by Sofacy against an unnamed European government agency leveraging an updated variant of the DealersChoice tool.<br />
<br />
<blockquote class="tr_bq">
“On March 12 and March 14, we observed the Sofacy group carrying out an attack on a European government agency involving an updated variant of DealersChoice.” reads the <a href="https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/">analysis </a>published by PaloAlto Networks.</blockquote>
<br />
“The updated DealersChoice documents used a similar process to obtain a malicious Flash object from a C2 server, but the inner mechanics of the Flash object contained significant differences in comparison to the original samples we analyzed. One of the differences was a particularly clever evasion technique.”<br />
<br />
The attacks uncovered by PaloAlto aimed at a government organization in Europe used a spear phishing email referencing the “Underwater Defence & Security” conference, which will take place in the U.K. later this month.<br />
<br />
While previous versions of DealersChoice loaded a <a href="http://www.hackerschronicle.com/search/label/Malwares">malicious </a>Flash object as soon as the bait document was opened, the samples analyzed by PaloAlto that were related to the last attacks include the Flash object on page three of the document and it’s only loaded if users scroll down to it.<br />
<br />
“The user may not notice the Flash object on the page, as Word displays it as a tiny black box in the document, as seen in Figure 1. This is an interesting anti-sandbox technique, as it requires human interaction prior to the document exhibiting any malicious activity.” states the analysis.</div>

Russia Linked hacking group Sofacy APT attacking European Government Agencies

crouching yeti Cyber Attack DealersChoice dragonfly energetic bear fancy bear Hacking News Russian Hackers sofacy apt US-CERT Russia Linked hacking group Sofacy APT attacking European Government Agencies

Last week the US Government announced sanctions against five Russian entities and 19 individuals, including the FSB, the military intell...

50 Million Facebook Accounts Hijacked to help Trump Win

3/18/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUEmmat2-sv6abghJmD2zJxbrD88SmG_6cMo92OLAiycOXq81J34cWQIQ97G_3N7YUZTas813lA1CTHxmkXCBDf5SFJZObFBjEM8XcLli-fa9DBXAZBv6hdntT0zjLWuXcIcVzGomOA5No/s1600/facebook-role-in-us-elections.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="facebook-data-used-to-help-trump-win" border="0" data-original-height="400" data-original-width="800" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUEmmat2-sv6abghJmD2zJxbrD88SmG_6cMo92OLAiycOXq81J34cWQIQ97G_3N7YUZTas813lA1CTHxmkXCBDf5SFJZObFBjEM8XcLli-fa9DBXAZBv6hdntT0zjLWuXcIcVzGomOA5No/s640/facebook-role-in-us-elections.jpg" title="facebook-data-used-to-help-trump-win" width="640" /></a></div>
<br />
50 million Facebook accounts, most of them in the United States, had their data harvested in 2014 by a company looking for ways to target people with political messages. Facebook has denied this was a data breach.<br />
<br />
A whistleblower named Christopher Wylie, who used to work at a company called Cambridge Analytica, gave a dossier of evidence including “emails, invoices, contracts and bank transfers” told to the <a href="https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election">Observer</a>.<br />
<blockquote class="tr_bq">
Cambridge Analytica data breach Whistleblower Christopher Wylie says, "We exploited Facebook to harvest millions of profiles. And built models to exploit that and target their inner demons."</blockquote>
A company called Global Science Research (GSR) run by Cambridge University academic Aleksandr Kogan created an app called <b>thisisyourdigitallife </b>– a personality test people can fill out online. He worked with Cambridge Analytica which was looking for ways to influence what people think about politics. A contract was signed between GSR and a Cambridge Analytica affiliate called SCL Elections Ltd. When people filled out the personality test, they gave permission for the app to collect their Facebook data “for academic use”. However, the app also collected the data of all of the user’s Facebook friends, quickly inflating the number of people affected to the tens of millions.<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzEZt2mdJvVTXeWFflXlH9OBAS9i8YWqwjVFqBlm7CZoECbTwX9efBHzs4Nn6O3U6PNa_7ivGa3ewUalMkZb9Tt1HSiP5__joF2qYdX5YA-PTzPdJUgD2Gj1YD4V6oXxMW9sqzT-rU1q4F/s1600/Christopher-Wylie.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="392" data-original-width="600" height="417" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzEZt2mdJvVTXeWFflXlH9OBAS9i8YWqwjVFqBlm7CZoECbTwX9efBHzs4Nn6O3U6PNa_7ivGa3ewUalMkZb9Tt1HSiP5__joF2qYdX5YA-PTzPdJUgD2Gj1YD4V6oXxMW9sqzT-rU1q4F/s640/Christopher-Wylie.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Whistleblower Christopher Wylie</td></tr>
</tbody></table>
<br />
The data from 50 million Facebook profiles were looked at against the electoral register, and then used to build an algorithm which analyses people’s personality traits in relation to their voting behaviour. This could then be used to find potential swing voters and create messages tailored to influence them politically. <br />
<br />
Cambridge Analytica is being investigated by the Electoral Commission for its possible role in the EU referendum and by the Information Comissioner’s Office over using data analytics for political purposes. The firm is also being investigated in the United States by special counsel Robert Mueller, a former FBI director who is investigating possible collusion between Russia and President Donald Trump’s election campaign. Wylie has also passed on his dossier of evidence to the National Crime Agency’s <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime">cybercrime </a>unit and the Information Commissioner’s Office. <br />
<br />
On Friday, just before the story broke, Facebook announced it was suspending Cambridge Analytica and GSR’s Aleksandr Kogan from Facebook while it carries out an investigation into “misuse of data”. It has also suspended whistleblower Christopher Wylie from using Facebook. Facebook denies this was a data breach, as GSR got the data “in a legitimate way” but it broke Facebook rules by passing the data on to third parties. Facebook also claims it removed the app in 2015 and written proof that all data had been destroyed. <br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0JDngUw212kzFYdmkkRzd8_J_emRKgptPvshjts-Jv2ybjWq-SoTfe5jiGSfoPhyphenhyphenN8XwVZlaxHbBhTWvO8IEMz25-E7szxKwDvq3iuVgWF1h__r36OcOuGGxrEONx-1Qi639p7wbFMLhl/s1600/steve-bannon.jpeg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="366" data-original-width="650" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0JDngUw212kzFYdmkkRzd8_J_emRKgptPvshjts-Jv2ybjWq-SoTfe5jiGSfoPhyphenhyphenN8XwVZlaxHbBhTWvO8IEMz25-E7szxKwDvq3iuVgWF1h__r36OcOuGGxrEONx-1Qi639p7wbFMLhl/s640/steve-bannon.jpeg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Donald Trump adviser Steve Bannon</td></tr>
</tbody></table>
Cambridge Analytica’s vice president at the time was Steve Bannon, who was also head of the right-wing website Breitbart and was running Donald Trump’s campaign to become US President. Bannon later became President Trump’s chief of staff, but was fired last year. Cambridge Analytica was funded by Robert Mercer, a hedge fund billionaire and Trump’s biggest campaign donor. GSR’s Aleksandr Kogan is also an associate professor at St Petersburg State University in Russia and has received grants from the Russian government to research Facebook users’ emotional states. <br />
<br />
Cambridge Analytica told the Observer its contract with GSR said Kogan must seek “informed consent” for data collection. It’s affiliate SCL Elections worked with Facebook to make sure no terms had been “knowingly breached” and was given a signed statement that all data had been deleted. Cambridge Analytica also claims none of the data was used in the 2016 US presidential election.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhL3cEUwXfZGi_aT6TJ1y_sxG50AXS5rkSAXZ_5e3JnOjWbv1PWBjUapBWjgkgJc4gcr3RMmpet8HVZ7H3yz7Y7hMkhwWypwmUVTrFAoseHatkUrtvFy5hrnGSnpVxcg8AD8Jib5oPH66zr/s1600/facebook-us-elections.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="693" data-original-width="861" height="513" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhL3cEUwXfZGi_aT6TJ1y_sxG50AXS5rkSAXZ_5e3JnOjWbv1PWBjUapBWjgkgJc4gcr3RMmpet8HVZ7H3yz7Y7hMkhwWypwmUVTrFAoseHatkUrtvFy5hrnGSnpVxcg8AD8Jib5oPH66zr/s640/facebook-us-elections.PNG" width="640" /></a></div>
</div>

50 Million Facebook Accounts Hijacked to help Trump Win

aggregateiq cambridge analytica Cyber Crime Data Leak databreach donald trump facebook Hacking News US Elections 50 Million Facebook Accounts Hijacked to help Trump Win

50 million Facebook accounts, most of them in the United States, had their data harvested in 2014 by a company looking for ways to targe...

Details about tool used by FBI to unlock any Iphone disclosed

3/17/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEie9nNpjo21KXHc6fFJdGFOPCYExqI8z04EGLNY9nH8X3a9u6oLWu8L4tbJOhSh5EArzHWNcrZNK7lbnISY8iq893LiIucqNY1VA8lDCw8pi9E9uvnwmIEcirP4B-SWEyC9siHtxHQGd_ki/s1600/unlock-iphone.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="FBI's tool to unlock any iPhone disclosed" border="0" data-original-height="506" data-original-width="900" height="356" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEie9nNpjo21KXHc6fFJdGFOPCYExqI8z04EGLNY9nH8X3a9u6oLWu8L4tbJOhSh5EArzHWNcrZNK7lbnISY8iq893LiIucqNY1VA8lDCw8pi9E9uvnwmIEcirP4B-SWEyC9siHtxHQGd_ki/s640/unlock-iphone.jpg" title="FBI's tool to unlock any iPhone disclosed" width="640" /></a></div>
A series of hot debates about the backdoor access should be provided or not to law enforcement agencies to <a href="http://www.hackerschronicle.com/search/label/apple">Apple </a>devices started after the case of San Bernadino's locked iPhone. But anyhow agency found a way to unlock the iPhone by taking the help from an Israeli company named Cellebrite, which provides iPhone unlocking services to law enforcement agencies.<br />
<br />
But recently name of new a device known as <a href="https://graykey.grayshift.com/">GrayKey</a>, is being circulated in the market. The GrayKey claims to be able to unlock any <a href="http://www.hackerschronicle.com/search/label/iOS">iOS-powered</a> devices such as iPads, iPods and iPhones. It can also copy the data inside that phone, which can be browsed over a web based portal. Grayshift is based in Atlanta, Georgia, Grayshift was founded in 2016, and is a privately-held company with fewer than 50 employees.<br />
<br />
According to Forbes, the GrayKey <a href="http://www.hackerschronicle.com/search/label/iphone%20unlocking">iPhone unlocker</a> device is marketed for in-house use at law enforcement offices or labs. This is drastically different from Cellebrite’s overall business model, in that it puts complete control of the process in the hands of law enforcement.<br />
<br />
A security firm <a href="https://blog.malwarebytes.com/security-world/2018/03/graykey-iphone-unlocker-poses-serious-security-concerns/">Malwarebytes </a>have released the leaked images and working of this device. GrayKey is a 4x4x2 inch gray box, with two lightning cables sticking out of the front.  It is very much easy to crack a iPhone's passcode.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV5KY24wEDQ9bcBj3Df1ECFQJ3LZ62g1iodhjUrS0ZVYvJ5WKIBJpDY9e8459lLu7EcjoBPab8uoYbqcWu7ac2Roe3clzm4_TPywLG2Sc0neXQmUSN8icwoPoe01LTIv5VWLGmLzNzThkk/s1600/GrayKey-iphone-unlocking-device.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GrayKey iphone unlocking device" border="0" data-original-height="288" data-original-width="600" height="306" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV5KY24wEDQ9bcBj3Df1ECFQJ3LZ62g1iodhjUrS0ZVYvJ5WKIBJpDY9e8459lLu7EcjoBPab8uoYbqcWu7ac2Roe3clzm4_TPywLG2Sc0neXQmUSN8icwoPoe01LTIv5VWLGmLzNzThkk/s640/GrayKey-iphone-unlocking-device.png" title="GrayKey iphone unlocking device" width="640" /></a></div>
<br />
Two <a href="http://www.hackerschronicle.com/search/label/iphone">iPhones </a>can be connected at one time, and are connected for about two minutes. After that, they are disconnected from the device, but are not yet cracked. Some time later, the phones will display a black screen with the passcode, among other information. The exact length of time varies, taking about two hours in the observations of our source. It can take up to three days or longer for six-digit passcodes, according to Grayshift documents, and the time needed for longer passphrases is not mentioned. According to Grayshift, even disabled phones can be unlocked.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjP95h2V4sdTVLVQtq1Clob1PUlZhyiOyjB0tsBMkC6JU_-kVthXnqt-qrrUHujK-U0chO8BCOsgrV40Rr2jFg_sASjO35z5sRoTwsOs_usUMFwUAmyLsPCQpWxBO5KpPqb7VedfCHEXOgb/s1600/GrayKey-unlocked-iPhone.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GrayKey-unlocked-iPhone.png" border="0" data-original-height="565" data-original-width="600" height="602" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjP95h2V4sdTVLVQtq1Clob1PUlZhyiOyjB0tsBMkC6JU_-kVthXnqt-qrrUHujK-U0chO8BCOsgrV40Rr2jFg_sASjO35z5sRoTwsOs_usUMFwUAmyLsPCQpWxBO5KpPqb7VedfCHEXOgb/s640/GrayKey-unlocked-iPhone.png" title="GrayKey-unlocked-iPhone" width="640" /></a></div>
<br />
After the device is unlocked, the full contents of the filesystem are downloaded to the GrayKey device. From there, they can be accessed through a web-based interface on a connected computer, and downloaded for analysis. The full, unencrypted contents of the key-chain are also available for download.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf0IKmJuMJ4MQLHhyphenhyphendZDmg_4E_Mhd3FWVAawhkPlfG9q5R46OMUn_A4CQ-w8bkphrT7Y58itN386t4KcAuQAYI8pmSSZ_EaSI0_BKMwJ2d17ZQr1pFHbSGNQzYrs-LjndHWqN4_503juxM/s1600/iphone-jailbreak.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="FBI is using this blackbox which can unlock any iPhone in the world" border="0" data-original-height="304" data-original-width="600" height="324" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf0IKmJuMJ4MQLHhyphenhyphendZDmg_4E_Mhd3FWVAawhkPlfG9q5R46OMUn_A4CQ-w8bkphrT7Y58itN386t4KcAuQAYI8pmSSZ_EaSI0_BKMwJ2d17ZQr1pFHbSGNQzYrs-LjndHWqN4_503juxM/s640/iphone-jailbreak.png" title="FBI is using this blackbox which can unlock any iPhone in the world" width="640" /></a></div>
<br />
The GrayKey device itself comes in two “flavors.” The first, a $15,000 option, requires Internet connectivity to work. It is strictly geofenced, meaning that once it is set up, it cannot be used on any other network.<br />
<br />
However, there is also a $30,000 option. At this price, the device requires no Internet connection whatsoever and has no limit to the number of unlocks. It will work for as long as Apple fixes the vulnerabilities the device depends on.</div>

apple graykey Hacking News iOS iphone iphone unlocking jailbreak Details about tool used by FBI to unlock any Iphone disclosed

A series of hot debates about the backdoor access should be provided or not to law enforcement agencies to Apple devices started after t...

5 Million Popular Android Phones found with pre-installed malwares

3/16/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZTEE4Eu0Mm9uTy7XH2DIQs9OMuUpOneSwROHzMWaEAGRIQyz4cPiGfLnxYIBUUTRU4_h37MkHB8YdM0X6eIXS6AyFdq7hlUqzphIauQLEFd_jTmyLPnzfjmAti3ZuBbXAqyktg5xU5IQL/s1600/android-botnet-malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Millions of Android infected with RoyyenSys Malware" border="0" data-original-height="380" data-original-width="728" height="334" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjZTEE4Eu0Mm9uTy7XH2DIQs9OMuUpOneSwROHzMWaEAGRIQyz4cPiGfLnxYIBUUTRU4_h37MkHB8YdM0X6eIXS6AyFdq7hlUqzphIauQLEFd_jTmyLPnzfjmAti3ZuBbXAqyktg5xU5IQL/s640/android-botnet-malware.png" title="Millions of Android infected with RoyyenSys Malware" width="640" /></a></div>
<br />
Security researchers at CheckPoint have discovered that Chinese Cyber Criminals are using a malware named as RottenSys to attack android phones all over the world; almost 5 million android devices in their botnet network.<br />
<br />
<blockquote class="tr_bq">
"The Check Point Mobile Security Team has discovered a new widespread malware family targeting nearly 5 million users for fraudulent ad-revenues. They have named it ‘RottenSys’ for in the sample we encountered it was initially disguised as a System Wi-Fi service." according to checkpoint analysis report.</blockquote>
<br />
Experts found an unusual self-proclaimed system Wi-Fi service (<b>系统WIFI服务</b>) on a Xiaomi Redmi phone ans started their investigation. They found that the application does not provide any secure Wi-Fi related service to users. Instead, it asks for many sensitive Android permissions such as accessibility service permission, user calendar read access and silent download permission, which are not related to Wi-Fi service. Their key findings were: <br />
<ul style="text-align: left;">
<li>RottenSys, a mobile adware, has infected nearly 5 million devices since 2016.</li>
<li>Indications show the malware could have entered earlier in the supplier chain.</li>
<li>The attackers have been testing a new botnet campaign via the same C&C server.</li>
</ul>
<br />
The RottenSys malware implements two evasion techniques:<br />
<br />
<ul style="text-align: left;">
<li>The first technique consists of postponing operations for a set time.</li>
</ul>
<ul style="text-align: left;">
<li>The second technique uses a dropper which does not display any malicious activity at first. Once the device is active and the dropper contacts the Command and Control (C&C) server which sends it a list of additional components required for its activity.</li>
</ul>
<br />
The malicious code relies on two open-source projects:<br />
<br />
<ul style="text-align: left;">
<li>The <a href="https://github.com/wequick/small">Small  virtualization</a> framework. RottenSys uses Small to create virtualized containers for its components, with this trick the malware could run parallel tasks, overwhelming Android OS limitations.</li>
</ul>
<ul style="text-align: left;">
<li>The <a href="https://github.com/Marswin/MarsDaemon">MarsDaemon library</a> that keeps apps “undead.” MarsDaemon is used to keep processes alive, even after users close them. Using it the malware is always able to inject ad.</li>
</ul>
<blockquote class="tr_bq">
“This botnet will have extensive capabilities including silently installing additional apps and UI automation. Interestingly, a part of the controlling mechanism of the botnet is implemented in Lua scripts. Without intervention, the attackers could re-use their existing malware distribution channel and soon grasp control over millions of devices.” according to the same the analysis.</blockquote>
<br />
According to the findings, the RottenSys malware began propagating in September 2016. By 12 March 2018; 49,64,460 devices were infected by RottenSys. The <b>top impacted mobile devices brands are Honor, Huawei, and Xiaomi</b>.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxXBJHEKCJ1oz9o8PufOTzv_xLou6yIZ9Q0vRJOArfc7r6bT8zbO2SqNS5Zs9VwU197EzHf4eet2quIs8LrENggDTEp67S8-WS-PtW_ez_YDXKdCr9TSnTRshxADpPqIxJ9cwq7KgGg3bm/s1600/android-phones-infected-with-rottebsys-malware.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="316" data-original-width="747" height="268" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgxXBJHEKCJ1oz9o8PufOTzv_xLou6yIZ9Q0vRJOArfc7r6bT8zbO2SqNS5Zs9VwU197EzHf4eet2quIs8LrENggDTEp67S8-WS-PtW_ez_YDXKdCr9TSnTRshxADpPqIxJ9cwq7KgGg3bm/s640/android-phones-infected-with-rottebsys-malware.png" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZGg8FdzCwQIbAYcRIVctfEi3NM0An11IvuJ5860GPeAoiBxnyNdHtvisEk5BNmpRPtkff5ru3uhhJMSm7s3wdeVie4TX4k7bfzwxxVDSH4RD6fA2H_rut6fv4dy9iFvq5o1vSlOoWIjb5/s1600/chinese-phones-infected-with-malwares.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="329" data-original-width="543" height="386" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZGg8FdzCwQIbAYcRIVctfEi3NM0An11IvuJ5860GPeAoiBxnyNdHtvisEk5BNmpRPtkff5ru3uhhJMSm7s3wdeVie4TX4k7bfzwxxVDSH4RD6fA2H_rut6fv4dy9iFvq5o1vSlOoWIjb5/s640/chinese-phones-infected-with-malwares.png" width="640" /></a></div>
<br />
<br />
RottenSys is totally focusing on aggressive ad network for making huge profits. In the past 10 days alone, it displayed ads 13,250,756 times (commonly called impressions) and out of which 548,822 were converted into ad clicks. We tried to roughly calculate the revenue from these impressions and clicks according to the conservative estimation of 20 cents for each click and 40 cents for each thousand impressions. According to these calculations, <b>the attackers earned over $1,15,000 from their malicious operation in the last ten days alone!</b></div>

5 Million Popular Android Phones found with pre-installed malwares

Botnet Chinese Hackers Hacking News honor huawei Malwares rottensys xiomi 5 Million Popular Android Phones found with pre-installed malwares

Security researchers at CheckPoint have discovered that Chinese Cyber Criminals are using a malware named as RottenSys to attack android...

Hundreds of Organizations Worldwide Attacked by Qrypter Trojan

3/15/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAgVwEV_ZXbV1VRyhY4xYBu5TbeU1Cy8WuHTunkq65TGlmhGtJN71K0rSgE6uF6ivtc70Emv4KkurY_giuwD7iWvI13_F56FC1Yx-w8g6HuDoOtlAfdGU1oAMDm-Tmds5Ebv3sFLepRyzX/s1600/qrypter-rat.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Qrypter-Trojan-attack" border="0" data-original-height="558" data-original-width="1200" height="296" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgAgVwEV_ZXbV1VRyhY4xYBu5TbeU1Cy8WuHTunkq65TGlmhGtJN71K0rSgE6uF6ivtc70Emv4KkurY_giuwD7iWvI13_F56FC1Yx-w8g6HuDoOtlAfdGU1oAMDm-Tmds5Ebv3sFLepRyzX/s640/qrypter-rat.jpg" title="Qrypter-Trojan-attack" width="640" /></a></div>
According to a security firm Forcepoint, Hundreds of organizations all around the globe have been targeted in a series of attacks that leverage the <b>Qrypter remote access Trojan </b>(RAT).<br />
<br />
The <a href="http://www.hackerschronicle.com/search/label/Malwares">malware</a>, often mistaken for the <b>Adwind </b>cross-platform backdoor, has been around for a couple of years, and was developed by an underground group called ‘QUA R&D’, which offers a Malware-as-a-Service (MaaS) platform. <br />
<br />
Also known as<b> Qarallax, Quaverse, QRAT</b>, and Qontroller, Forcepoint explains that <b>Qrypter is a Java-based <a href="http://www.hackerschronicle.com/search/label/rat">RAT</a> that leverages TOR-based command and control</b> (C&C) servers. It was first detailed in June 2016, after being used in an attack targeting individuals applying for a U.S. Visa in Switzerland.<br />
<br />
The malware is typically delivered via malicious email campaigns that usually consist of only a few hundred messages each. However, Qrypter continues to rise in prominence, and three Qrypter-related campaigns observed in February 2018 affected 243 organizations in total, Forcepoint's security researchers say. <br />
<br />
When executed on a victim’s system, Qrypter drops and runs two VBS files in the %Temp% folder, each featuring a random filename. The two scripts are meant to gather information on the firewall and anti-virus products installed on the computers. <br />
<br />
Qrypter is a plugin based <span id="goog_2122346973"></span><a href="http://www.hackerschronicle.com/search/label/Trojan">backdoor <span id="goog_2122346974"></span></a>that provides attackers with a broad range of capabilities: remote desktop connection, webcam access, file system manipulation, installation of additional files, and task manager control. <br />
<br />
The <b>RAT is available for rent for a price of $80</b>, payable in PerfectMoney, Bitcoin-Cash, or <a href="http://www.hackerschronicle.com/search/label/Bitcoin">Bitcoin</a>. Interested parties can purchase three months or one-year subscriptions for a discounted price, the security researchers discovered. <br />
<br />
An older Bitcoin address associated with payments for Qrypter subscriptions was appears to have received a total of 1.69 BTC (around $13,500 at the time of publishing). This, however, is only one of the addresses that the malware authors use, meaning that their earnings could be much higher.<br />
<br />
The malware developers provide support to their customers via a forum called ‘Black&White Guys’, which currently has over 2,300 registered members. <br />
<br />
Based on the content of the forum, the researchers were able to discover how QUA R&D operates. The group appears focused on keeping customers happy, and is regularly creating threads to inform and reassure users that their crypting service (available for $5) is fully undetected by anti-virus vendors. <br />
<br />
<blockquote class="tr_bq">
“Indeed, ensuring their product is fully undetectable is one of the primary priorities for the group and potentially explains why even after nearly two years Qrypter remains largely undetected by anti-virus vendors,” Forcepoint notes. </blockquote>
<br />
In addition to interacting with customers, the forum is also used to attract potential resellers, which receive discount codes to help increase Qrypter's popularity in underground circles. Furthermore, older RAT versions are offered for free to customers, and QUA R&D’s strategy also involves the cracking of competitor products, to <a href="http://www.hackerschronicle.com/2011/07/make-keylogger-and-trojan-fully.html">create FUD</a> (fear, uncertainty, and doubt) about competition.<br />
<br />
<blockquote class="tr_bq">
“While the Qrypter MaaS is relatively cheap, QUA R&D's occasional release of cracked competitor products may exponentially increase attacks in the wild by making potent crimeware accessible to anyone for free,” Forcepoint concludes.  </blockquote>
</div>

adwind Hacking News qarallax Qrypter quaverse rat Trojan Hundreds of Organizations Worldwide Attacked by Qrypter Trojan

According to a security firm Forcepoint, Hundreds of organizations all around the globe have been targeted in a series of attacks that l...