Avengers: Endgame Leaked Online in China

4/26/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDolKTrpqGHDs64QYKSgieSRuSKbRzKuqomzLQmi0DK6pbUP_SiLGPfSSy-FqLCnF4fS8_yLwrsL0HcOjQAGc1R3G6dV1kstZKK2KfaXYYOSlwNjpZXvo_xKei_oNtfT46lxKCPMHhs6Kh/s1600/avengers-endgame-full-movie-download.jpeg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers-endgame-full-movie-download" border="0" data-original-height="468" data-original-width="1600" height="186" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjDolKTrpqGHDs64QYKSgieSRuSKbRzKuqomzLQmi0DK6pbUP_SiLGPfSSy-FqLCnF4fS8_yLwrsL0HcOjQAGc1R3G6dV1kstZKK2KfaXYYOSlwNjpZXvo_xKei_oNtfT46lxKCPMHhs6Kh/s640/avengers-endgame-full-movie-download.jpeg" title="avengers-endgame-full-movie-download" width="640" /></a></div>
<br />
<div class="separator" style="clear: both; text-align: center;">
</div>
Marvel’s latest and perhaps the most anticipated movie ever to be released Avengers: End Game has become an object of controversy lately as hackers and <a href="https://www.hackerschronicle.com/search/label/Cyber%20Crime">cybercriminals</a> are trying their best to benefit from the movie’s widespread, intense hype.<br />
<br />
Last week, Marvel fans were requested to not use social media after a video made via mobile phone containing movie spoilers was posted online. Now that the movie has been released in China and just a day is left in its US release, reports are rife that a camera version of the movie has been uploaded on various torrent platforms and piracy sites.<br />
<br />
TorrentFreak reveals that copy of Avengers: End Game has been recorded from a cinema in China and initially it exclusively appeared on Chinese torrent sites. It is interesting because the movie’s sponsors and producers chose to release it in China first and it is yet to be released in the US.<br />
<br />
Reportedly, this decision was taken to address the issue of piracy in the region. The movie has so far raked in $90 million in sales, that’s an impressive start for sure but the inevitable has happened as someone was able to record the movie in the cinema and upload it online.<br />
<br />
According to the analysis from <a href="https://torrentfreak.com/avengers-endgame-leaks-online-in-china-begins-to-spread-190424/">TorrentFreak</a>, their system notified about the appearance of a 1.2 GB cammed version of Avengers: End Game between 4:00 pm and 5:00 pm China local time, that’s merely a few hours after the movie was released in China.<br />
<blockquote class="tr_bq">
Don’t spoil the Endgame.</blockquote>
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1cZRLTltdArqER839hE8T7pSHG7STItqVm00OFhibryop8C-3lbufICNeMdf5Fv6w8G2vvWqN6GhtoDCDLZDlO-6vi_tpUXZMuscpcZm90ViGJ4m58GJUVIVJ-cNAxtpEHT3KrXOWDYoN/s1600/avengers-end-game-leaked-online.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers end game leaked online" border="0" data-original-height="340" data-original-width="600" height="362" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh1cZRLTltdArqER839hE8T7pSHG7STItqVm00OFhibryop8C-3lbufICNeMdf5Fv6w8G2vvWqN6GhtoDCDLZDlO-6vi_tpUXZMuscpcZm90ViGJ4m58GJUVIVJ-cNAxtpEHT3KrXOWDYoN/s640/avengers-end-game-leaked-online.jpg" title="avengers end game leaked online" width="640" /></a></div>
As soon as the movie was released online, dozens of users located in <a href="https://www.hackerschronicle.com/search/label/Chinese%20Hackers">China</a> started sharing it on torrent sites. Then came the 2 GB version of the movie and new copies are also emerging at regular intervals. The initial versions were basically different variants of the first torrent shared on Thunder torrent site; it became evident because all the new variants had the same client code starting from 7.10.35.XXX.<br />
<br />
The good news is that the pirated version circulating on torrent sites is of pretty bad quality as the movie continuously flickers, is semi-rotated and there are watermarks of a gambling site visible throughout. TorrentFreak also noted that the pirated version has made it to piracy sites in the UK as well.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRbOR3N9msJP1t9eGyimwPvEx4Q42RoBPPYG2thkDZVbCSwWXtPbEW347Wh9Tdbvqg6OQB5Ptz_PlAyu8Ffz-h-yiA5gxk9ptRfQXWym44wzK0KwIkJO4fCM2j8e5oGvbwtKNkKtXSVAIn/s1600/avengers4torrentdata-1.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="avengers end game available on torrent" border="0" data-original-height="354" data-original-width="600" height="376" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiRbOR3N9msJP1t9eGyimwPvEx4Q42RoBPPYG2thkDZVbCSwWXtPbEW347Wh9Tdbvqg6OQB5Ptz_PlAyu8Ffz-h-yiA5gxk9ptRfQXWym44wzK0KwIkJO4fCM2j8e5oGvbwtKNkKtXSVAIn/s640/avengers4torrentdata-1.png" title="avengers end game available on torrent" width="640" /></a></div>
<br />
<br />
It is worth mentioning that the initial version of the movie’s copy was dubbed in Chinese but later another version with English audio and Chinese subtitles was released online. Moreover, an improved version of the movie has also been released that has been sponsored by a <a href="https://www.hackerschronicle.com/search/label/Russian%20Hackers">russian</a> betting company 1XBet.<br />
<br />
Avengers: End Game is touted as the final and conclusive chapter of the franchise. So far 22 films have been released since 2008 under the Marvel Cinematic Universe banner. The makers have tried their best to keep the movie’s storyline a secret, so much so that even the journalists weren’t allowed to watch the movie prior to interviewing its star cast. </div>

Marvel’s latest and perhaps the most anticipated movie ever to be released Avengers: End Game has become an object of controversy lat...

Password Expiry rules are useless: Microsoft

4/25/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqUF_WuEse2kZ0JaRkL9KfdsgNTITKFOlBjF3k_mgQ9Sx5gPpxQr007nzlJWs4CJE9aybr4FNChxuvk8JDa-vFbo7xU0ux-sQgS_mTuiDb-hLTKDmcAklCDvRsRY2yy1sJciX5C6j71tJ4/s1600/microsoft-password-expiry.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="microsoft password expiry" border="0" data-original-height="749" data-original-width="1092" height="438" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqUF_WuEse2kZ0JaRkL9KfdsgNTITKFOlBjF3k_mgQ9Sx5gPpxQr007nzlJWs4CJE9aybr4FNChxuvk8JDa-vFbo7xU0ux-sQgS_mTuiDb-hLTKDmcAklCDvRsRY2yy1sJciX5C6j71tJ4/s640/microsoft-password-expiry.png" title="microsoft password expiry" width="640" /></a></div>
<br />
 <span class="caption">Ever had to change your password for no reason? </span><span class="caption">Before, it was annoying. Now, it's useless.</span><br />
<br />
Microsoft has admitted that one of the great curses of our time, the password reset rule, is nonsense.<br />
<br />
"When humans are assigned or forced to create passwords that are hard to remember, too often they'll write them down where others can see them," Microsoft's <a href="https://twitter.com/AaronMargosis">Aaron Margosis</a> wrote in a <a href="https://blogs.technet.microsoft.com/secguide/2019/04/24/security-baseline-draft-for-windows-10-v1903-and-windows-server-v1903/">blog post</a> Wednesday. Worse, Margosis wrote, when people are forced to change their passwords, too often they make a "small and predictable alteration to their existing password," or they'll just forget it.<br />
<br />
The blog post introduces a broader set of "<a href="https://docs.microsoft.com/en-us/windows/security/threat-protection/windows-security-baselines">baseline</a>" security settings Microsoft is considering recommending to companies that use its computer management software. Think of them as defaults of a sort.<br />
<br />
Unfortunately, Microsoft isn't simply yanking the password reset feature, which would be the humane thing to do. In the end, it'll still be up to your company's tech team whether to listen to reason or continue living in the security Stone Age.<br />
<br />
It's worth noting that Microsoft isn't changing recommendations around the way we create passwords. In fact, the company recommends companies increasingly ban typical bad passwords, and force employees to use multifactor authentication. <br />
<br />
<blockquote>
"Periodic password expiration is an ancient and obsolete mitigation of very low value," Margosis wrote.</blockquote>
<br />
But make no mistake, <a href="https://www.hackerschronicle.com/search/label/Microsoft">Microsoft</a>, whose Windows software powers nearly 80% of the world's computers, has finally seen the light. <span style="font-size: xx-small;"><a href="http://cnet.com/">Source</a></span></div>

Microsoft Password Password Expiry Technology Password Expiry rules are useless: Microsoft

Ever had to change your password for no reason? Before, it was annoying. Now, it's useless. Microsoft has admitted that one of ...

Bodybuilding.com confirms Data Breach

4/24/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjav4fT_vy7AeU-yBoFGrd1P0avUFMV_V3pVWbMrJnnzVZTdh9WNajlxHgh7WH3clxT3ByH0VgxReB0_Cod9GEQWwfNLirHPGCoUEYnFJ0nEtY2-tDMBaa4TzgiV8_i9EjE8FaEjB2RlnSm/s1600/bodybuilding-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="Bodybuilding.com hacked" border="0" data-original-height="425" data-original-width="1000" height="272" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjav4fT_vy7AeU-yBoFGrd1P0avUFMV_V3pVWbMrJnnzVZTdh9WNajlxHgh7WH3clxT3ByH0VgxReB0_Cod9GEQWwfNLirHPGCoUEYnFJ0nEtY2-tDMBaa4TzgiV8_i9EjE8FaEjB2RlnSm/s640/bodybuilding-hacked.jpg" title="Bodybuilding.com hacked" width="640" /></a></div>
<br />
Bodybuilding.com, the internet's biggest online store and online forum for fitness and bodybuilding enthusiasts, has disclosed last week a security breach that impacted its IT systems.<br />
<br />
Customer data might have been exposed, the company said in a <a href="https://www.bodybuilding.com/help?notifications&data-incident">short message</a> posted on its website. Its staff isn't sure if the attacker accessed customer data, though.<br />
<br />
A third-party security firm was hired to help with the investigation, but forensics experts couldn't confirm that customer data was stolen from Bodybuilding.com's servers, either.<br />
<br />
Bodybuilding.com said investigators traced the unauthorized activity to a phishing email its staff received in July 2018. At least one employee appears to have fallen for this email.<br />
<br />
Hackers used the data they obtained from this phishing email to access the company's network in February 2019. Bodybuilding.com didn't say when it detected the intrusion, but it said it finished its investigation on April 12. It went public with the security breach a week later, on April 19.<br />
<br />
<blockquote class="tr_bq">
We became aware of a data security incident involving unauthorized access to our systems in February 2019. We engaged one of the leading data security firms to conduct a thorough investigation, which traced the unauthorized activity to a phishing email received in July 2018. On April 12, 2019, we concluded our investigation and could not rule out that personal information may have been accessed.</blockquote>
<br />
Despite not knowing if hackers accessed customer data, Bodybuilding.com decided to do the right thing and notify all of its customers of the security incident, as a precaution.<br />
<br />
It also reset all users' passwords as well, to prevent any abuse in case attackers did manage to steal any data.<br />
<br />
According to the company, if hackers did manage to access and steal customer data, possibly exposed details will include name, email address, billing/shipping addresses, phone number, order history, any communications with Bodybuilding.com, birthdate, and any information included in BodySpace profiles.<br />
<br />
Social Security numbers and payment card details were not exposed, the company said, as the site never collected this information in the first place.<br />
<br />
Besides notifying users of the breach, Bodybuilding.com is also alerting users that scammers might also try to imitate its data breach disclosure notifications for online fraud or phishing attacks.<br />
<br />
<blockquote class="tr_bq">
Please note that the email from Bodybuilding.com does not ask you to click on any links or contain attachments and does not request your personal data. If the email you received about this issue prompts you to click on a link, suggests you download an attachment, or asks you for information, the email was not sent by Bodybuilding.com and may be an attempt to steal your personal data. Avoid clicking on links or downloading attachments from such suspicious emails. Any link included in our email to users directs users to insert the Bodybuilding.com FAQs URL into your browser and does not request your personal data.</blockquote>
<a href="https://www.zdnet.com/google-amp/article/bodybuilding-com-discloses-security-breach/"><span style="font-size: xx-small;">Source</span></a></div>

bodybuilding.com databreach Hacking News News Phishing Security Bodybuilding.com confirms Data Breach

Bodybuilding.com, the internet's biggest online store and online forum for fitness and bodybuilding enthusiasts, has disclosed last ...

2 Million Wi-Fi Passwords Leaked

4/23/2019 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<br />
<table align="center" cellpadding="0" cellspacing="0" class="tr-caption-container" style="margin-left: auto; margin-right: auto; text-align: center;"><tbody>
<tr><td style="text-align: center;"><a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_JzcJ1AsuRYfsljM1cITPR7YLgu-D-N76enZhfj9tuMOE08vCJnkM1jG-LmooyQWWC4TBPZ4GvvJqj0LTXuC_bEQ33v_D4qofBTBGN9gVbsA5rWJ-FhRiggoxyFtpd47iomLFe0IwzTIt/s1600/wifi-finder.jpg" imageanchor="1" style="margin-left: auto; margin-right: auto;"><img alt="Wi-Fi Hotspot Finder Spills 2 Million Passwords" border="0" data-original-height="933" data-original-width="1390" height="427" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_JzcJ1AsuRYfsljM1cITPR7YLgu-D-N76enZhfj9tuMOE08vCJnkM1jG-LmooyQWWC4TBPZ4GvvJqj0LTXuC_bEQ33v_D4qofBTBGN9gVbsA5rWJ-FhRiggoxyFtpd47iomLFe0IwzTIt/s640/wifi-finder.jpg" title="Wi-Fi Hotspot Finder Spills 2 Million Passwords" width="640" /></a></td></tr>
<tr><td class="tr-caption" style="text-align: center;">Wi-Fi Hotspot Finder Spills 2 Million Passwords Online</td></tr>
</tbody></table>
A popular hotspot finder app for Android exposed the Wi-Fi network passwords for more than two million networks.<br /><br />The app, downloaded by thousands of users, allowed anyone to search for Wi-Fi networks in their nearby area. The app allows the user to upload Wi-Fi network passwords from their devices to its database for others to use.<br /><br />That database of more than two million network passwords, however, was left exposed and unprotected, allowing anyone to access and download the contents in bulk.<br /><br />Sanyam Jain, a security researcher and a member of the GDI Foundation, found the database and reported the findings to TechCrunch.<br /><br />We spent more than two weeks trying to contact the developer, believed to be based in China, to no avail. Eventually we contacted the host, DigitalOcean, which took down the database within a day of reaching out.<br /><br />“We notified the user and have taken the [server] hosting the exposed database offline,” a spokesperson told.<br /><br />Each record contained the Wi-Fi network name, its precise geolocation, its basic service set identifier (BSSID) and network password stored in plaintext.<br /><br />Although the app developer claims the app only provides passwords for public hotspots, a review of the data showed countless home Wi-Fi networks. The exposed data didn’t include contact information for any of the Wi-Fi network owners, but the geolocation of each Wi-Fi network correlated on a map often included networks in wholly residential areas or where no discernible businesses exist.<br /><br />The app doesn’t require users to obtain the permission from the network owner, exposing Wi-Fi networks to unauthorized access. With access to a network, an attacker may be able to modify router settings to point unsuspecting users to malicious websites by changing the DNS server, a vital system used to convert web addresses into the IP addresses used to locate web servers on the internet. When on a network, an attacker also can read the unencrypted traffic that goes across the wireless network, allowing them to steal passwords and secrets.<br /><br />Tens of thousands of the exposed Wi-Fi passwords are for networks based in the U.S.<br />
Source: <a href="https://techcrunch.com/2019/04/22/hotspot-password-leak/">TechChrunch</a></div>

Data Leak DigitalOcean Hacking News Wi-Fi WiFi Finder 2 Million Wi-Fi Passwords Leaked

Wi-Fi Hotspot Finder Spills 2 Million Passwords Online A popular hotspot finder app for Android exposed the Wi-Fi network passwords fo...

Personal Data of FBI Agents leaked

4/15/2019 cyb3r.gladiat0r 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHQpeMQxcICm5IPBC_C1bUWF43XRKGUxb3tFKXY50jQ3HOJl22SLE2a444BP1IU7I8Nqw1Kx3T4yYR9wedV1QGhx_Qv6hKLYOofV0lK7XvhSUARbGaXIJrYyKEYRKrFeR8zTntUkHRu6Q/s1600/fbi-leak.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="hackers leak personal data of fbi agent" border="0" data-original-height="820" data-original-width="1236" height="424" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjHQpeMQxcICm5IPBC_C1bUWF43XRKGUxb3tFKXY50jQ3HOJl22SLE2a444BP1IU7I8Nqw1Kx3T4yYR9wedV1QGhx_Qv6hKLYOofV0lK7XvhSUARbGaXIJrYyKEYRKrFeR8zTntUkHRu6Q/s640/fbi-leak.jpg" title="hackers leak personal data of fbi agent" width="640" /></a></div>
<div class="separator" style="clear: both; text-align: center;">
hackers leak personal data of fbi agent</div>
Three websites belonging to the Federal Bureau of Investigation’s (FBI) National Academy Association (FBINAA) were hacked apparently by three hackers after they managed to breach their security, steal and upload data online.<br />
<br />
Part of the uploaded content was dozens of documents containing personal information of federal agents and law enforcement officers. The information includes email IDs (both private and government), names, job titles, contact numbers, and postal addresses.<br />
<br />
Reportedly, thousands of officials have their private information leaked online since there are around 4,000 unique records of personal credentials of federal officials. The data was stolen from three of the many chapter websites affiliated with the FBINAA across the US.<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhN6bJUgoWgbaZ0Dd4-FDX80kqJHTM7896N74ufcx7K8JJ47rXpLIJNSBrbaaXvyAP36uBDhYAepOeFEWWKLL5HVwrTWAQgKb5EGLIA6hDSJsHX0TjgPezpCDlOkw4x9MYUOq3Mv8RwPPI/s1600/FBI-data-leaked.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img alt="FBI Data Leak" border="0" data-original-height="370" data-original-width="930" height="252" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhN6bJUgoWgbaZ0Dd4-FDX80kqJHTM7896N74ufcx7K8JJ47rXpLIJNSBrbaaXvyAP36uBDhYAepOeFEWWKLL5HVwrTWAQgKb5EGLIA6hDSJsHX0TjgPezpCDlOkw4x9MYUOq3Mv8RwPPI/s640/FBI-data-leaked.png" title="FBI Data Leak" width="640" /></a></div>
These websites are used for promotional purposes primarily for the FBI training academy in Quantico, VA. The hackers identified and exploited several flaws in the three websites and stole the entire contents of the yet unnamed websites. Afterward, the hackers transferred the data on their personal website.<br />
<br />
While speaking with one of the hackers, <a href="https://techcrunch.com/2019/04/12/police-data-hack/">TechCrunch</a> learned that the trio has managed to hack over 1,000 websites so far and the <a href="https://www.hackerschronicle.com/search/label/Cyber%20Crime">cybercriminals</a> are now trying to organize and structure the acquired information.<br />
<br />
<blockquote class="tr_bq">
    “Soon they will be sold. I think something else will publish from the list of hacked government sites,” the unidentified hacker told.</blockquote>
<br />
When asked if the hackers were aware of the fact that uploading such sensitive data online would endanger the security of federal agents and law enforcement officials, the hacker plainly replied “Probably, Yes,” adding that they have more than a million employees’ data belonging to various federal agencies and public service organizations in the US.<br />
<br />
<blockquote class="tr_bq">
    “We hacked more than 1,000 sites,” said the hacker. “Now we are structuring all the data, and soon they will be sold. I think something else will publish from the list of hacked government sites.” We asked if the hacker was worried that the files they put up for download would put federal agents and law enforcement at risk. “Probably, yes,” the hacker said.</blockquote>
<br />
The hackers do not intend to sell the stolen data on hacker forums or the Dark Web marketplace but will be offering it for free just to prove the legitimacy of the claim that they have the data and for the sake of experience. TechCrunch reported that there are over ten hackers involved and they mainly use public exploits to target websites that haven’t been updated or contain outdated plugins.<br />
<br />
While having an encrypted chat session , the hacker gave proof of some of the other websites that they have breached, which included Foxconn’s subdomain too.</div>

Data Leak FBI Hacking News Personal Data of FBI Agents leaked

hackers leak personal data of fbi agent Three websites belonging to the Federal Bureau of Investigation’s (FBI) National Academy Associ...

Voting Machine firewall details and passwords leaked online

4/06/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div style="margin-bottom: .0001pt; margin: 0mm;">
<br />
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7B6FUrs1Xkli2dBiG8sucr_mhoaIIoVfv2I0nvFZIBpm74L9LvSHN2FbDe1nUzJ0NUVdI5v2MCvi-6QYPNPryWwmQbAzUkNvLB1F8IUvQ6WDpJ4p6zBLJO4GCYh4Erl14C6orQfKWFvY/s1600/Electronic-Voting-hacked.jpg" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="1200" data-original-width="1600" height="300" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg7B6FUrs1Xkli2dBiG8sucr_mhoaIIoVfv2I0nvFZIBpm74L9LvSHN2FbDe1nUzJ0NUVdI5v2MCvi-6QYPNPryWwmQbAzUkNvLB1F8IUvQ6WDpJ4p6zBLJO4GCYh4Erl14C6orQfKWFvY/s400/Electronic-Voting-hacked.jpg" width="400" /></a></div>
<br />
A sysadmin at a number one mechanical device vendor denote a firewall configuration file, as well as passwords, into a public Cisco support forum in 2011, gap the corporate up to attainable attack.<br />
The config files expose a wealth of knowledge helpful to Associate in Nursing wrongdoer, as well as the name, hostname, and ASA version range. whereas <b>there's no proof that the mechanical device vendor was compromised, this accidental discharge of knowledge is "juicy intelligence,"</b> Dan Tentler, founder and corporate executive of satellite cluster, Associate in Nursing attack simulation security company, tells.<br />
<br />
"If you have got a crack team of housebreaker varieties and they are all attending to burgled a building, this firewall configuration file is that the equivalent of finding the ground set up of the building they're reaching to burgled," Tentler says.<br />
<br />
Compromising the c<b>omputer code offer chain of a mechanical device vendor would be a years-long endeavor, requiring careful designing and long-run persistence within the company's network.</b> It remains unclear if this "floor plan" was ever employed by Associate in Nursing wrongdoer because the mechanical device vendor has not answered that question with rhetorical certainty.<br />
One of the ASA devices seems to be a firewall on the company's development and testing network. Associate in Nursing wrongdoer World Health Organization used this intelligence to compromise the mechanical device vendor's network may have used works backdoors ("remote access software") to hack vote machines. they might have deep-seated refined microcode backdoors or engaged in spear phishing attacks against native election officers.<br />
<br />
A nation-state wrongdoer may even have derived the mechanical device ASCII text file and used it to seem for security flaws. "The mechanical device vendors...are actually on the microwave radar of powerful attackers, as well as nation-state adversaries," Alex Halderman, a prof of computing at the University of Michigan, Associate in Nursing a knowledgeable of mechanical device security, tells. "The networks they're mistreatment for developing, testing, and debugging election system computer code area unit probably to be probed by attackers World Health Organization would wish to weaken the protection of our elections."<br />
<br />
"If you'll get into one in every of these vendors," he adds, <b>"take the ASCII text file to the vote machines, that is of huge advantage to somebody UN agency needs to attack them."</b><br />
In the forum postings, that area unit still public at the time of this writing, the mechanical device merchandiser worker asked for facilitate configuring a Cisco ASA 5505 — a firewall appliance — and includes sensitive details regarding the company's internal network layout, likewise as passwords (likely the default passwords), writing, "Here is my running config."<br />
<br />
In one forum post, the worker asks for help:<br />
I am making an attempt to line up a DMZ with an interior VLAN to transfer SFTP (SSH) firmly. I am unable to get the within the computer to attach to the SFTP (SSH) server. I actually have bought and activated the safety upgrade My DMZ server. My computer making an attempt to travel from the within to the DMZ.<br />
The employee continues to provoke facilitate, writing in another forum post, "I would really like to trammel the safety on my Firewall. am I able to take away my ‘any any’ statements in my access lists? Here's my config."<br />
<br />
It's doable, of course, that the sysadmin modified the passwords before posting to the <b>Cisco support forum, though the language used ("Here is my running config") suggests otherwise.</b> it is also doable the passwords were modified afterward.<br />
Even if the passwords were ne'er valid, this firewall config offers associate aggressor valuable intelligence. "This info is incredibly helpful for associate aggressor that’s targeting this organization with a political goal in mind," Tentler says. "If Russia found this and was deciding to focus on this organization, this can be gold."<br />
<br />
We found what we have a tendency to believe to be the employee’s LinkedIn profile, that shows the worker now not works for the corporate. Neither the mechanical device merchandiser nor the previous worker competent our press inquiries.<br />
"I hope that vendor has enforced immensely higher security coaching since 2011 so as to avoid additional security leaks of this nature," Halderman says, "but nothing that I actually have seen would lead Maine to<b> believe their security has improved to the extent necessary to stave off nation-state adversaries</b>."<br />
<br />
<br /></div>
</div>

Cisco Cyber Crime evm hacking evm tempering Hacking News voting machine Voting Machine firewall details and passwords leaked online

A sysadmin at a number one mechanical device vendor denote a firewall configuration file, as well as passwords, into a public Cisco su...

Under Armour Fitness App MyFitnessPal data breached affecting 150 million users

4/03/2018 The Hackers Chronicle 0

<div dir="ltr" style="text-align: left;" trbidi="on">
<div class="separator" style="clear: both; text-align: center;">
<a href="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgt3FA8mAmz1C1o0BjaaMWheMFcBxhvgcylN7-KTbsqpGh92hAMUOWeq9gpBEfP5gWl77xbCxGB42KLXYAE6qVFRbvgZ5j6QZjg8dO9uFQnG7dXw_COuSBCVDG7qEb6MLnD_kPsFZY4s5La/s1600/under-armour-data-leak.png" imageanchor="1" style="margin-left: 1em; margin-right: 1em;"><img border="0" data-original-height="470" data-original-width="940" height="320" src="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgt3FA8mAmz1C1o0BjaaMWheMFcBxhvgcylN7-KTbsqpGh92hAMUOWeq9gpBEfP5gWl77xbCxGB42KLXYAE6qVFRbvgZ5j6QZjg8dO9uFQnG7dXw_COuSBCVDG7qEb6MLnD_kPsFZY4s5La/s640/under-armour-data-leak.png" width="640" /></a></div>
<div class="MsoNormal" style="background: white; margin: 7.5pt 0mm 3.75pt;">
 </div>
<div class="MsoNormal" style="background: white; margin: 7.5pt 0mm 3.75pt;">
Under Armour, Inc. last week <a href="https://content.myfitnesspal.com/security-information/notice.html">announced </a>that it is notifying users of MyFitnessPal - the company's food and nutrition application and website - about a massive data breach affecting 150 million users. But according to the comapny sources, Payment card data was not compromised because it is collected and processed separately. </div>
<div class="MsoNormal" style="background: white; margin: 7.5pt 0mm 3.75pt;">
A massive data breach on March 29 that impacted 150 million user accounts of the fitness vendor’s popular MyFitnessPal application Under Armour reported, which provides exercise, diet and calorie counting capabilities.<br />
"On March 25, the MyFitnessPal team became aware that an unauthorized party acquired data associated with MyFitnessPal user accounts in late February 2018.” Armour stated, Under Armour has not publicly identified the root cause of the breach.<br />
<br />
The data taken includes <b>usernames, email addresses and hashed passwords.</b> Rather than being stored in plain text, hashed passwords are scrambled cryptographically to protect passwords from being easily reused.<br />
<br />
On March 30, the company began to inform about the leakage of data to 150 million users . Users received the following e-mail:<br />
<blockquote class="tr_bq">
To the MyFitnessPal Community: <br />We have included your MyFitnessPal account information. We understand your protection and information seriously. <br />On March 25, 2018, we became aware of the MyFitnessPal user accounts. The related information included usernames, e-mail addresses, and hashed passwords - the majority of the hashing function called bcrypt used to secure passwords.<br />Once we became aware, we quickly took steps to determine the nature and scope of the issue. We are working with leading data security. We are also notified and are coordinating with law enforcement authorities. <br />We are <br />notifying MyFitnessPal users to provide information on how they can protect their data. <br />We will be requiring MyFitnessPal users to change their passwords and urge users to do so immediately. <br />We continue to monitor for suspected activity. <br />We continue to make enhancements to our systems to detect and prevent unauthorized access to user information.<br />We take our steps to safeguard your information. We recommend you: <br />Change your password for your account. MyFitnessPal account. <br />Review your accounts for suspicious activity. <br />Be cautious of any unsolicited communications. <br />Avoid clicking on links or downloading attachments from suspicious emails. <br />For more information, please go to <a href="https://content.myfitnesspal.com/security-information/FAQ.html">https://content.myfitnesspal.com/security-information/FAQ.html</a>. <br />Sincerely, <br />Paul Fipps <br />Chief Digital Officer</blockquote>
<br />If you have used this application and wherever you have had the same or similar password, change it as soon as possible.<br /><br />And if you logged in via <a href="https://www.hackerschronicle.com/search/label/facebook">Facebook </a>to the application , firstly - this is not the smartest approach (never do it!), And secondly, go to the Facebook options and receive the app all rights and link again. If you really need to log in via fejs, it would be better if you created an account in your application by e-mail.<br />
<br /></div>
</div>

Under Armour Fitness App MyFitnessPal data breached affecting 150 million users

Cyber Attack Data Leak databreach Hacking News MyFitnessPal under armour Under Armour Fitness App MyFitnessPal data breached affecting 150 million users

Under Armour, Inc. last week announced that it is notifying users of MyFitnessPal - the company's food and nutrition application...