MongoDB Hacked in 13 seconds demanding for ransom

3/23/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM3RrQ7ct6l67yOe5gYYcqqtZ7uqmOTa-2Gn3IK-6GnuP_5drlgq214myKQEqRc6-8cTvHbkmgct3gYNOCVwcUCNuNMWwt5zBQW6rxdlu9gvyhTePv1M82P6H4skau8qTcb_HPu6m9pJI/s1600/mongodb-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="325" data-original-width="683" height="302" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjM3RrQ7ct6l67yOe5gYYcqqtZ7uqmOTa-2Gn3IK-6GnuP_5drlgq214myKQEqRc6-8cTvHbkmgct3gYNOCVwcUCNuNMWwt5zBQW6rxdlu9gvyhTePv1M82P6H4skau8qTcb_HPu6m9pJI/s640/mongodb-hacked.jpg" width="640" /></a></div>
<br />
The hackers have been exploiting unprotected MongoDB for the last couple of years, based servers to steal data and hold the exposed databases for ransom. In order to raise awareness, <b>hackers leaked 36 million records of internal data collected from several vulnerable servers.</b><br />
<br />
<br />
The IT security researchers from German firm Kromtech conducted an experiment in which they purposely left a MongoDB database exposed to the public and kept an eye on the incoming connections, to determine and measure the depth of attacks against MongoDB,.<br />
<br />
<br />
The matter seriousness can be understood by the fact that in July of 2015 John Matherly of Shodan, <b>the world’s first search engine for the Internet of Things (IoT devices) revealed that there are over 30,000 unprotected MongoDB databases exposed for public access</b>.<br />
<br />
<b>Honeypot</b>: Which is a security mechanism set to detect and counteract attempts at unauthorized use of information systems.<br />
<br />
The honeypot database contained 30GB of fake data. Little did they know, it took only three hours for hackers to identify the database before wiping out its data in just 13 seconds and leaving a ransom note demanding 0.2 Bitcoin according to Kromtech’s blog post.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSmn-WPs3HTyuG4VUdaVUsWn_d9XLO1Sjopze1P-TfmGzhXZfiL4TwwXZ8VUBX2_sRdaThLcY2Bh1uEP5-q5m26OzAkdaEyhyphenhyphenfrdL9gNLAQnSFpOpgZzS3UVk_5R0aakxJwdpdQHb0zsw/s1600/ramsom-note.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="110" data-original-width="702" height="100" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjSmn-WPs3HTyuG4VUdaVUsWn_d9XLO1Sjopze1P-TfmGzhXZfiL4TwwXZ8VUBX2_sRdaThLcY2Bh1uEP5-q5m26OzAkdaEyhyphenhyphenfrdL9gNLAQnSFpOpgZzS3UVk_5R0aakxJwdpdQHb0zsw/s640/ramsom-note.png" width="640" /></a></div>
<br />
Here it is noteworthy that in January 2017, hackers held several MongoDB databases for ransom and demanded 0.2 Bitcoin in return. It is unclear if the hackers who took over the honeypot database are part of the same group. However, according to Kromtech’s Chief Communication Officer Bob Diachenko, the attack on their database has been traced back to China.<br />
<br />
The researchers are certain that only an automated script can complete such task within 13 seconds.<br />
<br />
“The attacker connects to our database first, then drops the databases to delete them, drops the Journals to erase their tracks, creates a database called Warning with Readme collection and the Solution Record, then drops the Journals again to cover their tracks. This was all completed in just thirteen seconds, leading to the conclusion that this was the work of an automated script,” noted Kromtech researchers.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikc-ITCUJqScaHHfQxcIDKQNrql0zulaDQCWFOyDraoqbf7dHvVMBrc2mVGBw7joiAJ5CUatOiNogBu4owoGBJGlFLr0WmlA-AiVpU52BW7F0lbQRDyDBjIbJ8mS-6_k3EW4S4LJT2u6c/s1600/mongodb-hacked-in-13-seconds.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="419" data-original-width="768" height="348" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEikc-ITCUJqScaHHfQxcIDKQNrql0zulaDQCWFOyDraoqbf7dHvVMBrc2mVGBw7joiAJ5CUatOiNogBu4owoGBJGlFLr0WmlA-AiVpU52BW7F0lbQRDyDBjIbJ8mS-6_k3EW4S4LJT2u6c/s640/mongodb-hacked-in-13-seconds.jpg" width="640" /></a></div>
<br />
<b>The <a href="https://mackeepersecurity.com/post/how-long-does-it-take-for-a-mongodb-to-be-compromised">researchers </a>are advising </b>users to secure their database since exposed MongoDB servers are still at risk. <b>Another important aspect</b> of <b>ransom attacks against MongoDB is that hackers are simply deleting the database therefore even if victim pays them off, their data will never be returned.</b> Therefore, keep a back up of your data and never pay ransom in such cases.</div>

The hackers have been exploiting unprotected MongoDB for the last couple of years, based servers to steal data and hold the exposed data...

18.5 Million Websites Infected With Malware

3/22/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on"><div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhX7tz1gHmgqsrr-J_aVIopZgZubXEunrBTNrAq0HQtwzYyAXdSGnrxqAKJ8MdV_UnVTh0u8FWcayQlOibNEOIrGlRrWEzi-F5NSjTd1q6BdRC4z45xNLyFKVRYsZsOWKLNynTKk5o8XcE/s1600/website-malware-attack.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="website-malware-attack" border="0" data-original-height="438" data-original-width="1339" height="208" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhX7tz1gHmgqsrr-J_aVIopZgZubXEunrBTNrAq0HQtwzYyAXdSGnrxqAKJ8MdV_UnVTh0u8FWcayQlOibNEOIrGlRrWEzi-F5NSjTd1q6BdRC4z45xNLyFKVRYsZsOWKLNynTKk5o8XcE/s640/website-malware-attack.PNG" title="website-malware-attack" width="640" /></a></div>On the internet, there are more than 1.86 billion websites. Around 1% of these -- something like 18,500,000 -- are infected with malware at a given time each week; while the average website is attacked 44 times every day.<br />
<br />
Sitelock has published its Q4 2017 Website Security Insider analysis of malware and websites based on statistics from 6 million of its 12 million customers. All these customers use at least one of Sitelock's malware scanners, while a smaller subset also use the firm's cloud-based web application firewall (WAF). <b>The WAF provides insight into <a href="http://www.hackerschronicle.com/search/label/DDoS">DDoS </a>attacks against websites,</b> while the scanners provide insight into the state of malware in websites.<br />
<br />
The analysis shows an increase of <b>around 20% in the number of infected websites over Q3 2017</b>. <b>"We went from about 0.8% of our user base in Q3 to a little over 1% in Q4," Sitelock research analyst Jessica Ortega told SecurityWeek</b>. A 0.2% increase seems a small number, but it implies that up to 18.5 million websites worldwide may be infected with malware at any given time.<br />
<div class="separator" style="clear: both; text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi96ShNSJGwhEKKtBYEvxe-DCuwC_l6Ik61yW8duVvKOJ-jjGYp_YboO2RGKwmZmZtP49uzQxRbj6hTRZifQ00legX-H3iuO0w0ooUzTnqxgGvoNsUBTp21NdsOWadOk6BgyvgTPOD-oPo/s1600/website-attack.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="200" data-original-width="800" height="160" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi96ShNSJGwhEKKtBYEvxe-DCuwC_l6Ik61yW8duVvKOJ-jjGYp_YboO2RGKwmZmZtP49uzQxRbj6hTRZifQ00legX-H3iuO0w0ooUzTnqxgGvoNsUBTp21NdsOWadOk6BgyvgTPOD-oPo/s640/website-attack.png" width="640" /></a></div><br />
Despite the increase in infected sites, continued Ortega, "The total number of attacks or attempted attacks actually decreased by about 20% -- so what we're seeing is that it takes fewer attack attempts to compromise the websites. Attackers are becoming sneakier, and more difficult-to-decode malware is coming through."<br />
<br />
The majority of Sitelock's customers are typically small businesses and blogs. "<b>Many website owners remain unaware that website security is their responsibility and rely too heavily </b>on popular search engines and other <b>third parties to notify them when they've been compromised</b>," <b>said Ortega.</b> This doesn't work -- less than 1 in 5 infected websites are blacklisted by the search engines.<br />
<br />
Other owners rely on their CMS software provider to keep them secure with security updates. But according to Sitelock, 46% of <a href="http://www.hackerschronicle.com/search/label/Wordpress">WordPress</a> sites infected with malware were up to date with the latest core updates. Those also using plug-ins were twice as likely to be compromised.<br />
<br />
It is the sheer volume of both threats and compromises that is most surprising. During Q4 2017, <b>Sitelock cleaned an average of 672,655 <a href="http://www.hackerschronicle.com/search/label/Malwares">malici<span id="goog_234162612"></span><span id="goog_234162613"></span>ous </a>files every week. </b>It found an average of 309 infected files per site. Sixteen percent of malware results in site defacements, while more than 12% are backdoors facilitating the upload of thousands of other malicious files including exploit kits and phishing pages.<br />
<br />
<b>Jessica Ortega, a research analyst at Sitelock, comments that the malicious files are often stored on websites in zip files.</b> Even if active files are removed, the site can be compromised again, and the zip file extracted for the attacker to continue precisely as before.<br />
<br />
One of the problems is that the average website is very easy to compromise. <b>Sitelock's analysis in Q4 found an average of 414 pages per site containing cross-site scripting (XSS)</b> vulnerabilities; 959 pages per site containing SQL injection (SQLi) vulnerabilities; and 414 pages per site containing cross-site request forgery (CSRF) vulnerabilities.<br />
<br />
<blockquote class="tr_bq">Even CSM security updates can be used against the website if they are not immediately installed. <b>"Attackers can see what vulnerabilities have been patched in the latest update, and develop an exploit for those <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerabilities</a>.</b> They then scan the internet for, for example, WordPress sites that haven't yet been updated, and compromise them."</blockquote><br />
Understanding the attackers' motives is key to understanding the threat to small business websites. "A lot of attackers go for the low-hanging fruit, and small business websites are among the softest and easiest targets because so many owners don't even realize they need security," e<b>xplains Ortega</b>. One of the primary motivations is to improve the search engine rankings of the attackers' own customers, by inserting backlinks to the customer website.<br />
<br />
"Or they use it to attack the website's visitors -- for example, by phishing credentials," she continued; "and <b>obviously the longer that a phishing site stays up, the greater the number of credentials it can potentially steal.</b> Or they're just trying to further spread their malware to visitors via exploit kits."<br />
<br />
Compromising small business websites is a numbers game for the criminals. Each site has a relatively small reach in the volume of visitors that can be exploited, but the sheer number of sites combined with the ease of compromise makes it worthwhile. And it is complicated by being perhaps the last refuge of the skiddie. As large companies improve their own security, small companies increasingly attract low-skilled skiddies who hack for personal aggrandizement -- those who do it because they can, and then boast about it.<br />
<br />
<b>Sixteen percent of infected sites were subsequently defaced,</b> often with a political or religious message, often <b>by script skiddies</b>.<br />
For a list of best Android Mobile Hacking Apps: <a href="https://joyofandroid.com/best-hacking-apps-for-android/">Refer Here</a><br />
</div>

DDoS Hacking News Malwares sitelock Vulnerability 18.5 Million Websites Infected With Malware

On the internet, there are more than 1.86 billion websites. Around 1% of these -- something like 18,500,000 -- are infected with malware at ...

Data Breach at Orbitz exposed 880,000 credit cards

3/21/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXXnPBMyuwTZoTNpyjN5CmLaO3JgDrV_xEgkSgKkPR0P4xYcnurZoX4pSXj-nu-cIXOoSwGopMJ_93H6fTS6HMEVLoE8LLvYMQZKa_IRliLx5uzrFD3dXuM1FW5x7oI8SLiHgrFdSJIL77/s1600/expedia-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="533" data-original-width="800" height="426" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgXXnPBMyuwTZoTNpyjN5CmLaO3JgDrV_xEgkSgKkPR0P4xYcnurZoX4pSXj-nu-cIXOoSwGopMJ_93H6fTS6HMEVLoE8LLvYMQZKa_IRliLx5uzrFD3dXuM1FW5x7oI8SLiHgrFdSJIL77/s640/expedia-hacked.jpg" width="640" /></a></div>
<br />
Travel website Orbitz, a subsidiary of Expedia Inc. disclosed Tuesday a <a href="http://www.hackerschronicle.com/search/label/databreach">security breach</a> that may have exposed data for thousands of customers, including information on 8,80,000 <a href="http://www.hackerschronicle.com/search/label/Credit%20Card">credit cards</a>.<br />
<br />
The Expedia-owned travel website operator said the breach affected an older website and the platform of an unnamed business partner. The information attackers “likely accessed” included people’s names, dates of birth, email addresses, street addresses, and genders, Orbitz said.<br />
<br />
The <a href="http://www.hackerschronicle.com/search/label/Data%20Leak">data leak</a>, which took place between Oct. and Dec. and involved records dating between Jan. 1, 2016 and Dec. 22, 2017, did not affect its current website, <a href="http://orbitz.com/">Orbitz.com</a>, nor did it involve any Social Security numbers, Orbitz said. The company said it “has not found any evidence” that other customer information was affected, like travel itineraries or passports.<br />
<br />
Orbitz advised customers who used its services during the prescribed time period to check their credit and debit card billings statements and to contact their banks if they see any fraudulent charges.<br />
<br />
Orbitz said it was in the process of notifying potential victims and that it would offer them a year of free credit monitoring services. Customers with questions can visit <a href="http://orbitz.allclearid.com/">orbitz.allclearid.com</a> for more information, the company said.<br />
<blockquote class="tr_bq">
“We deeply regret the incident,” Orbitz said in a statement, noting that it was unsure whether hackers had indeed absconded with customer information. The company determined on March 1, 2018 that it had uncovered “evidence suggesting…an attacker may have accessed personal information,” it said.</blockquote>
“We took immediate steps to investigate the incident and enhance security and monitoring of the affected platform,” Orbitz said.<br />
<br />
Expedia’s share price fell almost 2% during the day.</div>

Credit Card Cyber Attack Cyber Crime Data Leak databreach expedia Hacking News orbitz Data Breach at Orbitz exposed 880,000 credit cards

Travel website Orbitz, a subsidiary of Expedia Inc. disclosed Tuesday a security breach that may have exposed data for thousands of cus...

Intel processors will use hardware-based protections against Meltdown and Spectre 2

3/20/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9EtGh1NAW69qca9ByY_y1QdHET3Iwt7bxUc37EhPSlTaJJFQNiy49abJzlV0iIx62d7Ni21AFBKVob3eeDXqBb5jdZeAvaLOseuAkgrXcRP0n-2GjKGTMrF-lz5cEyFGKR21uYXhsOnee/s1600/intel-meltdown-spectre-patch.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="900" data-original-width="1600" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj9EtGh1NAW69qca9ByY_y1QdHET3Iwt7bxUc37EhPSlTaJJFQNiy49abJzlV0iIx62d7Ni21AFBKVob3eeDXqBb5jdZeAvaLOseuAkgrXcRP0n-2GjKGTMrF-lz5cEyFGKR21uYXhsOnee/s640/intel-meltdown-spectre-patch.png" width="640" /></a></div>
<br />
Intel has officially pushed out microcode updates with Spectre and Meltdown mitigations for all of the processors it launched in the past five years.<br />
<br />
In addition to this, the company’s CEO announced new, redesigned processor lines that will start shipping later this year and will include hardware-based protection for Meltdown (exploiting CVE-2017-5754, a rogue cata cache load flaw) and variant 2 of Spectre (exploiting CVE-2017-5715, a branch target injection <a href="http://www.hackerschronicle.com/search/label/Vulnerability">vulnerability</a>).<br />
<blockquote class="tr_bq">
“While [Spectre] Variant 1 will continue to be addressed via software mitigations, we are making changes to our hardware design to further address the other two,” Intel CEO Brian Krzanich <a href="https://newsroom.intel.com/editorials/advancing-security-silicon-level/">said</a>.</blockquote>
“We have redesigned parts of the processor to introduce new levels of protection through partitioning that will protect against both Variants 2 [<a href="http://www.hackerschronicle.com/search/label/spectre">Spectre</a>] and 3 [<a href="http://www.hackerschronicle.com/search/label/meltdown">Meltdown</a>]. Think of this partitioning as additional ‘protective walls’ between applications and user privilege levels to create an obstacle for bad actors. These changes will begin with our next-generation Intel Xeon Scalable processors (code-named Cascade Lake) as well as 8th Generation Intel Core processors expected to ship in the second half of 2018. ”<br />
<br />
He did not offer more details about these protections, but the video included in the announcement says that the Spectre variant 2 fixes will make it so that attackers can’t influence the path the speculative execution process and use misdirections to gain access to sensitive data. The solution, Intel says, “retains the many benefits of speculative execution, while addressing the threat of variant 2.”<br />
<br />
Organizations and users who don’t want to spend money on new processors will have to make do with the firmware updates for the old ones – and suffer some performance impacts.<br />
<br />
<blockquote class="tr_bq">
“We have now released <a href="https://newsroom.intel.com/wp-content/uploads/sites/11/2018/03/microcode-update-guidance.pdf">microcode updates</a> for 100 percent of Intel products launched in the past five years that require protection against the side-channel method vulnerabilities discovered by Google,” Krzanich noted.</blockquote>
<br />
It is on industry partners like Microsoft to implement them via firmware and software updates.<br />
<br />
Krzanich, of course, advised everyone to implement the updates as they are made available.</div>

Intel processors will use hardware-based protections against Meltdown and Spectre 2

CVE-2017-5715 Hacking News intel Malwares meltdown spectre Intel processors will use hardware-based protections against Meltdown and Spectre 2

Intel has officially pushed out microcode updates with Spectre and Meltdown mitigations for all of the processors it launched in the pas...

Russia Linked hacking group Sofacy APT attacking European Government Agencies

3/19/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWjy6QuFllWbAluEJnhxN3IM-J47fd6jyqAfwLumiaHtJotl50ubw46Ag1dConjKBJa8CAyD7wfi_F6VGn10Yop72k-4MHqSxXg-NtfZZQ_loZbxSZz0PVc2qkputRhlEH6xS4D2klWKmV/s1600/fancy-bear-attck.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Fancy Bear attack on European Union GOvernment" border="0" data-original-height="508" data-original-width="940" height="344" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhWjy6QuFllWbAluEJnhxN3IM-J47fd6jyqAfwLumiaHtJotl50ubw46Ag1dConjKBJa8CAyD7wfi_F6VGn10Yop72k-4MHqSxXg-NtfZZQ_loZbxSZz0PVc2qkputRhlEH6xS4D2klWKmV/s640/fancy-bear-attck.jpg" title="Fancy Bear attack on European Union GOvernment" width="640" /></a></div>
<br />
Last week the US Government announced sanctions against five Russian entities and 19 individuals, including the FSB, the military intelligence agency GRU.<br />
<br />
Despite the sanctions, <a href="http://www.hackerschronicle.com/search/label/Russian%20Hackers">Russian hackers</a> continue to target entities worldwide, including US organizations.<br />
<br />
The Russian spy agencies and the individuals are accused of trying to influence the 2016 presidential election and launching massive <a href="http://www.hackerschronicle.com/2018/02/russian-military-involved-in-notpetya.html">NotPetya </a>ransomware campaign and other attacks on businesses in the energy industry.<br />
<br />
Last year, the Department of Homeland Security and Federal Bureau of Investigation issued a joint technical alert to warn of attacks on US critical infrastructure powered by Russian threat actors. The US-CERT blamed the APT group tracked as <a href="http://www.hackerschronicle.com/search/label/dragonfly">Dragonfly</a>, <a href="http://www.hackerschronicle.com/search/label/crouching%20yeti">Crouching Yeti</a>, and <a href="http://www.hackerschronicle.com/search/label/energetic%20bear">Energetic Bear</a>.<br />
<br />
Now the US-CERT updated its <a href="https://www.us-cert.gov/ncas/alerts/TA18-074A">alert </a>by providing further info that and officially linking the above APT groups to the Kremlin.<br />
<br />
The Alert (<a href="https://www.us-cert.gov/ncas/alerts/TA18-074A">TA18-074A</a>) warns of “Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors,” it label the attackers as “Russian government cyber actors.”<br />
<blockquote class="tr_bq">
“This alert provides information on Russian government actions targeting U.S. Government entities as well as organizations in the energy, nuclear, commercial facilities, water, aviation, and critical manufacturing sectors.” reads the alert. </blockquote>
<blockquote class="tr_bq">
“It also contains indicators of compromise (IOCs) and technical details on the tactics, techniques, and procedures (TTPs) used by Russian government cyber actors on compromised victim networks.” </blockquote>
<br />
According to the DHS, based on the analysis of indicators of compromise, the Dragonfly threat actor is still very active and its attacks are ongoing.<br />
<br />
“DHS and FBI characterize this activity as a multi-stage intrusion campaign by Russian government cyber actors who targeted small commercial facilities’ networks where they staged malware, conducted spear phishing, and gained remote access into energy sector networks.” continues the alert. “After obtaining access, the Russian government cyber actors conducted network reconnaissance, moved laterally, and collected information pertaining to Industrial Control Systems (ICS).”<br />
<br />
The Russian Government has always denied the accusations, in June 2017 Russian President Putin declared that patriotic hackers may have powered attacks against foreign countries and denied the involvement of <a href="http://www.hackerschronicle.com/search/label/Russian%20Military">Russian cyberspies</a>.<br />
<br />
A few days ago, cyber security experts at Palo Alto Networks uncovered hacking campaigns launched by Sofacy against an unnamed European government agency leveraging an updated variant of the DealersChoice tool.<br />
<br />
<blockquote class="tr_bq">
“On March 12 and March 14, we observed the Sofacy group carrying out an attack on a European government agency involving an updated variant of DealersChoice.” reads the <a href="https://researchcenter.paloaltonetworks.com/2018/03/unit42-sofacy-uses-dealerschoice-target-european-government-agency/">analysis </a>published by PaloAlto Networks.</blockquote>
<br />
“The updated DealersChoice documents used a similar process to obtain a malicious Flash object from a C2 server, but the inner mechanics of the Flash object contained significant differences in comparison to the original samples we analyzed. One of the differences was a particularly clever evasion technique.”<br />
<br />
The attacks uncovered by PaloAlto aimed at a government organization in Europe used a spear phishing email referencing the “Underwater Defence & Security” conference, which will take place in the U.K. later this month.<br />
<br />
While previous versions of DealersChoice loaded a <a href="http://www.hackerschronicle.com/search/label/Malwares">malicious </a>Flash object as soon as the bait document was opened, the samples analyzed by PaloAlto that were related to the last attacks include the Flash object on page three of the document and it’s only loaded if users scroll down to it.<br />
<br />
“The user may not notice the Flash object on the page, as Word displays it as a tiny black box in the document, as seen in Figure 1. This is an interesting anti-sandbox technique, as it requires human interaction prior to the document exhibiting any malicious activity.” states the analysis.</div>

Russia Linked hacking group Sofacy APT attacking European Government Agencies

crouching yeti Cyber Attack DealersChoice dragonfly energetic bear fancy bear Hacking News Russian Hackers sofacy apt US-CERT Russia Linked hacking group Sofacy APT attacking European Government Agencies

Last week the US Government announced sanctions against five Russian entities and 19 individuals, including the FSB, the military intell...

50 Million Facebook Accounts Hijacked to help Trump Win

3/18/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUEmmat2-sv6abghJmD2zJxbrD88SmG_6cMo92OLAiycOXq81J34cWQIQ97G_3N7YUZTas813lA1CTHxmkXCBDf5SFJZObFBjEM8XcLli-fa9DBXAZBv6hdntT0zjLWuXcIcVzGomOA5No/s1600/facebook-role-in-us-elections.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="facebook-data-used-to-help-trump-win" border="0" data-original-height="400" data-original-width="800" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgUEmmat2-sv6abghJmD2zJxbrD88SmG_6cMo92OLAiycOXq81J34cWQIQ97G_3N7YUZTas813lA1CTHxmkXCBDf5SFJZObFBjEM8XcLli-fa9DBXAZBv6hdntT0zjLWuXcIcVzGomOA5No/s640/facebook-role-in-us-elections.jpg" title="facebook-data-used-to-help-trump-win" width="640" /></a></div>
<br />
50 million Facebook accounts, most of them in the United States, had their data harvested in 2014 by a company looking for ways to target people with political messages. Facebook has denied this was a data breach.<br />
<br />
A whistleblower named Christopher Wylie, who used to work at a company called Cambridge Analytica, gave a dossier of evidence including “emails, invoices, contracts and bank transfers” told to the <a href="https://www.theguardian.com/news/2018/mar/17/cambridge-analytica-facebook-influence-us-election">Observer</a>.<br />
<blockquote class="tr_bq">
Cambridge Analytica data breach Whistleblower Christopher Wylie says, "We exploited Facebook to harvest millions of profiles. And built models to exploit that and target their inner demons."</blockquote>
A company called Global Science Research (GSR) run by Cambridge University academic Aleksandr Kogan created an app called <b>thisisyourdigitallife </b>– a personality test people can fill out online. He worked with Cambridge Analytica which was looking for ways to influence what people think about politics. A contract was signed between GSR and a Cambridge Analytica affiliate called SCL Elections Ltd. When people filled out the personality test, they gave permission for the app to collect their Facebook data “for academic use”. However, the app also collected the data of all of the user’s Facebook friends, quickly inflating the number of people affected to the tens of millions.<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzEZt2mdJvVTXeWFflXlH9OBAS9i8YWqwjVFqBlm7CZoECbTwX9efBHzs4Nn6O3U6PNa_7ivGa3ewUalMkZb9Tt1HSiP5__joF2qYdX5YA-PTzPdJUgD2Gj1YD4V6oXxMW9sqzT-rU1q4F/s1600/Christopher-Wylie.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="392" data-original-width="600" height="417" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzEZt2mdJvVTXeWFflXlH9OBAS9i8YWqwjVFqBlm7CZoECbTwX9efBHzs4Nn6O3U6PNa_7ivGa3ewUalMkZb9Tt1HSiP5__joF2qYdX5YA-PTzPdJUgD2Gj1YD4V6oXxMW9sqzT-rU1q4F/s640/Christopher-Wylie.jpg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Whistleblower Christopher Wylie</td></tr>
</tbody></table>
<br />
The data from 50 million Facebook profiles were looked at against the electoral register, and then used to build an algorithm which analyses people’s personality traits in relation to their voting behaviour. This could then be used to find potential swing voters and create messages tailored to influence them politically. <br />
<br />
Cambridge Analytica is being investigated by the Electoral Commission for its possible role in the EU referendum and by the Information Comissioner’s Office over using data analytics for political purposes. The firm is also being investigated in the United States by special counsel Robert Mueller, a former FBI director who is investigating possible collusion between Russia and President Donald Trump’s election campaign. Wylie has also passed on his dossier of evidence to the National Crime Agency’s <a href="http://www.hackerschronicle.com/search/label/Cyber%20Crime">cybercrime </a>unit and the Information Commissioner’s Office. <br />
<br />
On Friday, just before the story broke, Facebook announced it was suspending Cambridge Analytica and GSR’s Aleksandr Kogan from Facebook while it carries out an investigation into “misuse of data”. It has also suspended whistleblower Christopher Wylie from using Facebook. Facebook denies this was a data breach, as GSR got the data “in a legitimate way” but it broke Facebook rules by passing the data on to third parties. Facebook also claims it removed the app in 2015 and written proof that all data had been destroyed. <br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0JDngUw212kzFYdmkkRzd8_J_emRKgptPvshjts-Jv2ybjWq-SoTfe5jiGSfoPhyphenhyphenN8XwVZlaxHbBhTWvO8IEMz25-E7szxKwDvq3iuVgWF1h__r36OcOuGGxrEONx-1Qi639p7wbFMLhl/s1600/steve-bannon.jpeg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img border="0" data-original-height="366" data-original-width="650" height="360" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh0JDngUw212kzFYdmkkRzd8_J_emRKgptPvshjts-Jv2ybjWq-SoTfe5jiGSfoPhyphenhyphenN8XwVZlaxHbBhTWvO8IEMz25-E7szxKwDvq3iuVgWF1h__r36OcOuGGxrEONx-1Qi639p7wbFMLhl/s640/steve-bannon.jpeg" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Donald Trump adviser Steve Bannon</td></tr>
</tbody></table>
Cambridge Analytica’s vice president at the time was Steve Bannon, who was also head of the right-wing website Breitbart and was running Donald Trump’s campaign to become US President. Bannon later became President Trump’s chief of staff, but was fired last year. Cambridge Analytica was funded by Robert Mercer, a hedge fund billionaire and Trump’s biggest campaign donor. GSR’s Aleksandr Kogan is also an associate professor at St Petersburg State University in Russia and has received grants from the Russian government to research Facebook users’ emotional states. <br />
<br />
Cambridge Analytica told the Observer its contract with GSR said Kogan must seek “informed consent” for data collection. It’s affiliate SCL Elections worked with Facebook to make sure no terms had been “knowingly breached” and was given a signed statement that all data had been deleted. Cambridge Analytica also claims none of the data was used in the 2016 US presidential election.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhL3cEUwXfZGi_aT6TJ1y_sxG50AXS5rkSAXZ_5e3JnOjWbv1PWBjUapBWjgkgJc4gcr3RMmpet8HVZ7H3yz7Y7hMkhwWypwmUVTrFAoseHatkUrtvFy5hrnGSnpVxcg8AD8Jib5oPH66zr/s1600/facebook-us-elections.PNG" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="693" data-original-width="861" height="513" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhL3cEUwXfZGi_aT6TJ1y_sxG50AXS5rkSAXZ_5e3JnOjWbv1PWBjUapBWjgkgJc4gcr3RMmpet8HVZ7H3yz7Y7hMkhwWypwmUVTrFAoseHatkUrtvFy5hrnGSnpVxcg8AD8Jib5oPH66zr/s640/facebook-us-elections.PNG" width="640" /></a></div>
</div>

50 Million Facebook Accounts Hijacked to help Trump Win

aggregateiq cambridge analytica Cyber Crime Data Leak databreach donald trump facebook Hacking News US Elections 50 Million Facebook Accounts Hijacked to help Trump Win

50 million Facebook accounts, most of them in the United States, had their data harvested in 2014 by a company looking for ways to targe...

Details about tool used by FBI to unlock any Iphone disclosed

3/17/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEie9nNpjo21KXHc6fFJdGFOPCYExqI8z04EGLNY9nH8X3a9u6oLWu8L4tbJOhSh5EArzHWNcrZNK7lbnISY8iq893LiIucqNY1VA8lDCw8pi9E9uvnwmIEcirP4B-SWEyC9siHtxHQGd_ki/s1600/unlock-iphone.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="FBI's tool to unlock any iPhone disclosed" border="0" data-original-height="506" data-original-width="900" height="356" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEie9nNpjo21KXHc6fFJdGFOPCYExqI8z04EGLNY9nH8X3a9u6oLWu8L4tbJOhSh5EArzHWNcrZNK7lbnISY8iq893LiIucqNY1VA8lDCw8pi9E9uvnwmIEcirP4B-SWEyC9siHtxHQGd_ki/s640/unlock-iphone.jpg" title="FBI's tool to unlock any iPhone disclosed" width="640" /></a></div>
A series of hot debates about the backdoor access should be provided or not to law enforcement agencies to <a href="http://www.hackerschronicle.com/search/label/apple">Apple </a>devices started after the case of San Bernadino's locked iPhone. But anyhow agency found a way to unlock the iPhone by taking the help from an Israeli company named Cellebrite, which provides iPhone unlocking services to law enforcement agencies.<br />
<br />
But recently name of new a device known as <a href="https://graykey.grayshift.com/">GrayKey</a>, is being circulated in the market. The GrayKey claims to be able to unlock any <a href="http://www.hackerschronicle.com/search/label/iOS">iOS-powered</a> devices such as iPads, iPods and iPhones. It can also copy the data inside that phone, which can be browsed over a web based portal. Grayshift is based in Atlanta, Georgia, Grayshift was founded in 2016, and is a privately-held company with fewer than 50 employees.<br />
<br />
According to Forbes, the GrayKey <a href="http://www.hackerschronicle.com/search/label/iphone%20unlocking">iPhone unlocker</a> device is marketed for in-house use at law enforcement offices or labs. This is drastically different from Cellebrite’s overall business model, in that it puts complete control of the process in the hands of law enforcement.<br />
<br />
A security firm <a href="https://blog.malwarebytes.com/security-world/2018/03/graykey-iphone-unlocker-poses-serious-security-concerns/">Malwarebytes </a>have released the leaked images and working of this device. GrayKey is a 4x4x2 inch gray box, with two lightning cables sticking out of the front.  It is very much easy to crack a iPhone's passcode.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV5KY24wEDQ9bcBj3Df1ECFQJ3LZ62g1iodhjUrS0ZVYvJ5WKIBJpDY9e8459lLu7EcjoBPab8uoYbqcWu7ac2Roe3clzm4_TPywLG2Sc0neXQmUSN8icwoPoe01LTIv5VWLGmLzNzThkk/s1600/GrayKey-iphone-unlocking-device.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GrayKey iphone unlocking device" border="0" data-original-height="288" data-original-width="600" height="306" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhV5KY24wEDQ9bcBj3Df1ECFQJ3LZ62g1iodhjUrS0ZVYvJ5WKIBJpDY9e8459lLu7EcjoBPab8uoYbqcWu7ac2Roe3clzm4_TPywLG2Sc0neXQmUSN8icwoPoe01LTIv5VWLGmLzNzThkk/s640/GrayKey-iphone-unlocking-device.png" title="GrayKey iphone unlocking device" width="640" /></a></div>
<br />
Two <a href="http://www.hackerschronicle.com/search/label/iphone">iPhones </a>can be connected at one time, and are connected for about two minutes. After that, they are disconnected from the device, but are not yet cracked. Some time later, the phones will display a black screen with the passcode, among other information. The exact length of time varies, taking about two hours in the observations of our source. It can take up to three days or longer for six-digit passcodes, according to Grayshift documents, and the time needed for longer passphrases is not mentioned. According to Grayshift, even disabled phones can be unlocked.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjP95h2V4sdTVLVQtq1Clob1PUlZhyiOyjB0tsBMkC6JU_-kVthXnqt-qrrUHujK-U0chO8BCOsgrV40Rr2jFg_sASjO35z5sRoTwsOs_usUMFwUAmyLsPCQpWxBO5KpPqb7VedfCHEXOgb/s1600/GrayKey-unlocked-iPhone.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="GrayKey-unlocked-iPhone.png" border="0" data-original-height="565" data-original-width="600" height="602" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjP95h2V4sdTVLVQtq1Clob1PUlZhyiOyjB0tsBMkC6JU_-kVthXnqt-qrrUHujK-U0chO8BCOsgrV40Rr2jFg_sASjO35z5sRoTwsOs_usUMFwUAmyLsPCQpWxBO5KpPqb7VedfCHEXOgb/s640/GrayKey-unlocked-iPhone.png" title="GrayKey-unlocked-iPhone" width="640" /></a></div>
<br />
After the device is unlocked, the full contents of the filesystem are downloaded to the GrayKey device. From there, they can be accessed through a web-based interface on a connected computer, and downloaded for analysis. The full, unencrypted contents of the key-chain are also available for download.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf0IKmJuMJ4MQLHhyphenhyphendZDmg_4E_Mhd3FWVAawhkPlfG9q5R46OMUn_A4CQ-w8bkphrT7Y58itN386t4KcAuQAYI8pmSSZ_EaSI0_BKMwJ2d17ZQr1pFHbSGNQzYrs-LjndHWqN4_503juxM/s1600/iphone-jailbreak.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="FBI is using this blackbox which can unlock any iPhone in the world" border="0" data-original-height="304" data-original-width="600" height="324" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhf0IKmJuMJ4MQLHhyphenhyphendZDmg_4E_Mhd3FWVAawhkPlfG9q5R46OMUn_A4CQ-w8bkphrT7Y58itN386t4KcAuQAYI8pmSSZ_EaSI0_BKMwJ2d17ZQr1pFHbSGNQzYrs-LjndHWqN4_503juxM/s640/iphone-jailbreak.png" title="FBI is using this blackbox which can unlock any iPhone in the world" width="640" /></a></div>
<br />
The GrayKey device itself comes in two “flavors.” The first, a $15,000 option, requires Internet connectivity to work. It is strictly geofenced, meaning that once it is set up, it cannot be used on any other network.<br />
<br />
However, there is also a $30,000 option. At this price, the device requires no Internet connection whatsoever and has no limit to the number of unlocks. It will work for as long as Apple fixes the vulnerabilities the device depends on.</div>

apple graykey Hacking News iOS iphone iphone unlocking jailbreak Details about tool used by FBI to unlock any Iphone disclosed

A series of hot debates about the backdoor access should be provided or not to law enforcement agencies to Apple devices started after t...