Sunday, April 20, 2025
Follow us On Linkedin
Home Blog Page 916

SambaCry Vulnerability used in Deploying Payloads Targeting IoT devices Particularly NAS

By
Gurubaran
-
SambaCry Vulnerability used in Deploying Payloads Targeting IoT devices Particularly NAS

Attackers using the SambaCry vulnerability to target older versions of Samba(3.5.0) to upload and execute the malicious payload. SambaCry Vulnerability(CVE-2017-7494) have the similarities of SMB vulnerability exploited by WannaCry.

Security experts from TrendMicro detected a Malware ELF_SHELLBIND.A which is similar to the functionality of SambaCry and this is the first payload with SambaCry that doesn’t have Cryptocurrency miner.

ELF_SHELLBIND targets internet of things (IoT) devices—particularly the Network Attached Storage (NAS) devices favored by small to medium businesses. ELF_SHELLBIND also targets different architectures, such as MIPS, ARM, and PowerPC.

Also Read SambaCry Vulnerability used by Hackers to attack Linux Servers and Mine’s Cryptocurrency

Execution flow

An attacker can find devices that vulnerable to Samba through Shodan(port 445) and then they prepare a script to automatically append malicious file on every IP. Once they successfully uploaded the files then they are victims of ELF_SHELLBIND.

Then after uploading malicious,(.SO) file in shared folder attacker need to trick server by sending an IPC request to run the locally stored file. Once executed it calls to change_to_root_user to run as root user and connect to Command and Control (C&C) server in East Africa “169[.]239[.]128[.]123” over TCP, port 80.

Then attackers obtain the system IP address and communications established over port 61422 and then malware wants the attacker to enter password Hardcore in it, once an attacker enters password then it grants access.

Once connection established successfully attacker have the command shell open and can get full control over the server, malware executes whatever command it received.

Mitigations

OS patches have been released already and the users who update in regular basis have no problems. If you have Samba enabled then the manufacturers have not yet patched, then the devices are vulnerable.

Also Read CoinDash Suffered a Hacking Attack And Stolen $7 Million Worth Ethereum Cryptocurrency

Millions of IoT Devices Infected with “Devil’s Ivy” Remote Code Execution Vulnerability Including Internet Connected Cameras

By
Balaji
-
Millions of IoT Devices Infected with “Devil’s Ivy” Remote Code Execution Vulnerability Including Internet Connected Cameras

A New Vulnerability called  “Devil’s Ivy” Discovered that infected Tens of Millions of IoT Devices which leads to Remotely Execute the code in IoT’s including cameras and Card Readers.

A stack Buffer over Flow Vulnerability  Presented in the many IoT Devices that cause Devil’s Ivy results in remote code execution and open source third-party code library found from gSOAP (Simple Object Access Protocol).

This RCE Flow Tested in Axis Security Cameras and later Researchers Found that Devil’s Ivy is present in 249 distinct camera models.

Also Read Hajime Worm wrestle with Mirai Botnet to Control of your IoT Devices

It allows an attacker to remotely control the infected security cameras and leads to collect the sensitive information since this Axis security Cameras Deployed in many area including Airports,Banks etc.

gSOAP  Support  Services are Affected

gSOAP is a widely used web services toolkit and many developers used gSOAP as as part of a software stack to enable devices of all kinds to talk to the internet.

This RCE Flow presented deeply in communication layer in an open source third-party toolkit called gSOAP  (Simple Object Access Protocol).

Software or device manufacturers who used gSOAP to support their services are affected by Devil’s Ivy Flow.

gSOAP Managed by a company called Genivia claimed that more than  1M downloads of gSOAP including giant customers such as IBM, Microsoft, Adobe and Xerox.

Devil’s Ivy Flow in Axis Camera Model 

Since Axis Camera Models are highly infected IoT that claims Devil’s Ivy is present in 249 distinct camera models it goes far beyond Axis.

“Axis explained the Risk Assessment, The risk for an Axis product installed protected behind a firewall or isolated network is limited. An adversary must have network access to the camera to exploit the vulnerability.”

Demonstration of Devil’s Ivy on the Axis M3004 security camera

ONVIF forum, an organization responsible maintaining software and networking protocols said, Axis is in the company that uses in a wide range of physical security products and reported that approximately 6% of the forum members use gSOAP.

Also Read IoT Botnet is Spreading over HTTP Port 81 Exploiting Security Cameras

Report claims that tens of millions of products software products and connected devices are affected by Devil’s Ivy to some degree.

This “Devil’s Ivy” Flow was reported to Genivia and patch was immediately released.

To Read full technical Analysis visit te Technical Analysis Blog post.

CoinDash Suffered a Hacking Attack And Stolen $7 Million Worth Ethereum Cryptocurrency

By
Balaji
-
CoinDash Suffered a Hacking Attack And Stolen Million Worth Ethereum Cryptocurrency

CoinDash Website has been hacked by unknown hackers during our Token Sale event which leads to $7 million worth of Ethereum was stolen in about half an hour.

Few Days Before World’s Fourth Largest Cryptocurrency “Bithumb” Hacked and Many Number of User Accounts Compromised.

CoinDash held its Token Sale event, in which investors were meant to be able to find apps in development with virtual currency in return for a stake in such applications.

Hackers modified CoinDash Platform  Ethereum wallet address during the company’s ICO (Initial Coin Offering).

Wallet Address has been modified by hackers owned address which leads to CoinDash’s investors sending 43438.455 Ether to the wrong address owned by the attacker.

CoinDash Comformed this Breach in their Twitter Account and the platform apologized, admitting that a “hacking attack” took place during the event by an unknown perpetrator, resulting in the loss of millions in ethereum, also known as ether (ETH).

Also Read    All that You Should Know about Bitcoins and its Exchange – A Detailed Overview

CoinDash Warned  to Investors

According to CoinDash, before the hack, it received around $6 million worth of Ethereum in the first three minutes.

“CoinDash Warned to Investors, This is an emergency message delivered to you in order to stop you from sending your money to an unauthorized ETH address. It seems like our Token Sale page was tampered and the sending address was changed. Please stop from sending your funds to any of the addresses until we say otherwise. We are currently examining the situation and will shortly send further instructions.”

Also intimate that , this breach has affected both our contributors and company, and they are investigating this attack.

To assist the investigation, the company tweeted out a form for people to fill out if they tried to purchase coins.

Also Read   Biggest Bitcoin Wallet Hack in History, Around US$5 Million Worth Bitcoin Currency Stolen

Record Audio and Video Silently with Obfuscated Android Backdoor – GhostCtrl

By
Gurubaran
-
Record Audio and Video Silently with Obfuscated Android Backdoor – GhostCtrl

New Android malware variant GhostCtrl steals data, control devices functionalities and even hijack the devices. It is certainly a variant of commercially sold OmniRAT that produced headlines in November 2015.

Malware uses legitimate and popular apps like MMS, WhatsApp and Pokemon GO. Trend Micro detected it as ANDROIDOS_GHOSTCTRL.OPS / ANDROIDOS_GHOSTCTRL.OPSA, and then they named backdoor as GhostCtrl.

It is highly persistent and it even blocks “ask for install page” prompt, once installed wrapper APK launch the service to run the main APK in Background.

Malicious APK would resemble like a legitimate application and then it connects to C&C server to get commands.

Also read Android Trojan Called “SpyDealer” Spying on More Than 40 Apps Including Facebook, WhatsApp, Skype, Telegram

C&C Communication

Commands from C&C server are encrypted and then they are decrypted locally by the APK. Security researchers from Trend Micro observed all the DNS servers resolves to the same C&C Server IP address.

hef–klife[.]ddns[.]net
f–klife[.]ddns[.]net
php[.]no-ip[.]biz
ayalove[.]no-ip[.]bi

These are the commands used by attackers to manipulate the device functionalities with without users knowledge.

Control the Wi-Fi state
Monitor the phone sensors’ data in real time
Set phone’s UiMode, like night mode/car mode
Control the vibrate function, including the pattern and when it will vibrate
Download pictures as wallpaper
List the file information in the current directory and upload it to the C&C server
Delete a file in the indicated directory
Rename a file in the indicated directory
Upload a desired file to the C&C server
Create an indicated directory
Use the text to speech feature (translate text to voice/audio)
Send SMS/MMS to a number specified by the attacker; the content can
also, be customized
Delete browser history
Delete SMS
Download file
Call a phone number indicated by the attacker
Open activity view-related apps; the Uniform Resource Identifier (URI)
can also be specified by the attacker (open browser, map, dial view, etc.)
Control the system infrared transmitter
Run a shell command specified by the attacker and upload the output result

GhostCtrl steals extensive rate of information when compared to any another
Android information stealers.It can fetch pieces of information like
Android OS version, username, Wi-Fi, battery, Bluetooth, and audio states, UiMode, sensor, data from the camera, browser, and searches, service processes, activity information, and wallpaper.

It is also capable of intercepting text messages to record Audio or Video and upload into C&C server.

GhostCtrl’s Versions and functions

The first version enables the framework to gain admin level privilege and has no other codes, Malware continues to evolve with Version Second and third.

The second version is like a mobile ransomware it lock’s device reset password and gain root access. Then it uses to hijack cameras record voice & video and then upload to C&C servers.

The third version posses obfuscation techniques to hide its malicious routines, it drops the wrapper and then it extracts the main APK file Dalvik Executable (DEX) and an Executable and Linkable Format file (ELF).

Common Defences

  • To stay secure, use a reputable mobile security solution to detect and remove the threats.
  • Do download apps only from the official market.
  • Before downloading, check for the number of installs, ratings and, most importantly, the content of reviews.
  • Deploy Firewall, Intrusion and prevention systems and for Mobile also.
  • Regularly backup the data at regular intervals.

Beware – WhatsApp Scam alert Subscription Ending Email or Text to Steal your Payment and Personal Data

By
Gurubaran
-
Beware – WhatsApp Scam alert Subscription Ending Email or Text to Steal your Payment and Personal Data

New social Engineering attack targeting WhatsApp users started receiving Warning that you have used the service for more than one year and that it’s time to take out a subscription?

These emails are perfectly designed by hackers to trick the users clicking on it and to get payment card information.

Also Read Kali Handbook for Ethical hackers

WhatsApp uses to request payment before but that all stopped in January 2016, Which makes the scam somewhat more acceptable is that in the past WhatsApp did use to ask users to pay a fee after they had used the service for over a year.

So, don’t be duped into clicking on suspicious links claiming to come from WhatsApp suggesting you need to pay your subscription to continue to use the app. It’s not just nonsense, it’s potentially dangerous nonsense that could leave a hole in your wallet. Says GrahamCuley in the blog post on Eset blog.

WhatsApp Scam alert Subscription Ending Email or Text

Beware of unsolicited SMS text messages claiming to come from WhatsApp demanding that you verify your account and buy a WhatsApp subscription.

Also Read A new IoT Botnet is Spreading over HTTP Port 81 and Exploit the Vulnerability in Security Cameras

Be careful with spontaneous SMS instant messages claiming to originate from WhatsApp requesting that you confirm your record and purchase a WhatsApp subscription.

You ultimately decide what links you click on, and whether you hand over your passwords and payment card details. Always think twice, because the wrong decision could prove costly. Says GrahamCuley.

New OSX/Dok Malware Targeting macOS Users to Steal Banking Credentials by Cloning Major Bank Websites

By
Balaji
-
New OSX/Dok Malware Targeting macOS Users to Steal Banking Credentials by Cloning Major Bank Websites

A New MacOS Malware “OSX/Dok” Discovered to Steal Banking Credentials by cloning major Banking website which leads victims to install the Malicious Application into victims mobile Devices.

This infection leads to potentially compromise the victims and leaks their sensitive data from their mobile platform.

OSX/Dok  Malware used to Attack Mac users via traditional Spam and Phishing Attacks and also combined with Man-in-the-Middle Attack which helps to gain complete access from victim communication and even its TLS Encrypted.

According to Checkpoint Researchers, the attackers are purchasing dozens of Apple certificates to sign on the application bundle and bypass GateKeeper Apple is constantly revoking the compromised certificates as Checkpoint informing them. however, new ones appear on a daily basis.

How Does OSX/Dok Work

The attack vector this Malware as usual through Phishing Mail that contains a Zip File with Malicious Applications.

Once Malware infected the targetted victims,  using shell codes it modifies the Update settings and disables security updates.

“It modifies the local host file in a way that prevents the victim and some Apple services to communicate outside by adding lines to the host’s file

This Malware maintains its obfuscation by signing the application using Apple certificate by legitimate App developer which leads to bypass the Apple Gatekeeper that used to prevent to install unsigned Applications.

“The malware authors keep naming the application bundle similar to the ones used by Apple, such as “App1e.AppStore” or “iTunes.AppStore”, trying to make it look more credible. Checkpoint said.

Also Read   New Most Highly Sophisticated Spyware “MacSpy” for OS X – “RAT as a Service” Available for Sale Through Email

Steals Bank Credentials

This Malware used Tor Network as a communication channel to communicate with command and control over  Darkweb and Proxy .

According to Malware geo-locates the victim it seems that the malware targets mainly European residents.

By helping of Local Proxy that Malware setting up in the Victims Machine, all the Traffic will Be Redirected to above-mentioned Domains (such as ‘credit-suisse’, ‘globalance-bank’, ‘cbhbank’), etc. then it will redirect to Malicious C&C server on TOR.

So once victims trying to Visit this Website then it will redirect to Malicious phishing website which is mostly under the Phishing financial Banking website that looks same as original bank website.

Fake Bank Page of infected Machine (Source: Checkpoint)

Orginal Page of same Bank (Source: Checkpoint)

In this Indication we can see that, C&C server is using Old copy rights page, and phishing page missed original Credit-Suisse SSL certificate and using the fake certificate instead.

Another indication Clearly showing that, there is not proper token based authentication since original bank are using Auth Token  which the server verifies and only then responds.

Also Read  Running OSX relatively safe? New Malware strains targeting all versions of MacOSX clients

A Powerful .NET Spyware Creating Backdoor and Records Full videos, Spying on User Activities

By
Balaji
-
A Powerful .NET Spyware Creating Backdoor and Records Full videos, Spying on User Activities

A New.NET Spyware Discovered as “Backdoor.DuBled”  has some sophisticated functions unlike other spyware,it can also records full videos, spying on user activities ,and send it across to an attacker.

Recent Malware are embedded with legitimate applications that used to evade malware to get caught up by the AV Vendors.This .NET Spyware incorporate legitimate applications in their malicious package and Downlaod a legitimate ffmpeg.

It is also have ability to saving keystrokes and logging the running applications.

According to Malwarebytes, Drop the JS executable into  %TEMP% Folder and executable installs itself creating its own Folder in  %APPDATA%. and an Additional copy of the malware is also dropped in the startup folder.

After further analyze,Researchers found that dropped files contents are not Encrypted And also malware downloads legitimate applications: Rar.exe, ffmpeg.exe.

Spyware Communication

Thi spyware communicate with command & control server over TCP using port 98 and server initiate the “idjamel” comclient.

Once client received  Command form server , client responds the information that collected about the infected victims machine.

Malware sharing the information including machine name/username, the operating system installed, and a list of running processes.

Malicious package of the  payload is the layer containing all the malicious features and its not well obfuscated so researchers easily Decompiled it.

Recording Videos

Main Motivation of this Spyware is, spying the victims and creating the Backdoor for the infected the machine.

Mainly Targetting  is to steal the Bank information form the Victims by Recording videos while the Victims browsing the bank websites.

Malwarebytes said, Periodically, the check is made, whether the target from the list has been open in the browser. In case if it was detected, the malware deploys video recorder.

“The malware also has a feature of making simple screenshots, saved as JPG. The pictures and the captured logs are periodically compressed by the Rar application, and then also sent to the CnC “

The mentioned malware family was first discovered in 2015 by MalwarHunterTeam.

Analyzed samples

  1. 2a07346045558f49cad9da0d249963f1 – dropper (JS)
  2. 049af19db6ddd998ac94be3147050217 – dropped executable (C#)
  3. 9c9f9b127becf7667df4ff9726420ccb – loader
  4. 85d35dd33f898a1f03ffb3b2ec111132 – final payload

Downloaded plugins:

  1. e907ebeda7d6fd7f0017a6fb048c4d23 – remotedesktop.dll
  2. d628d2a9726b777961f2d1346f988767 – processmanager.dll

Still More than 50,000 hosts are vulnerable to ETERNAL BLUE Exploit

By
Gurubaran
-
Still More than 50,000 hosts are vulnerable to ETERNAL BLUE Exploit

Eternal Blues, a tool used in finding computers and Endpoints vulnerable to the NSA’s ETERNALBLUE exploit. All we need to do is just to hit a scan, and it will generate the vulnerability report.

EternalBlue Malware infecting Windows based Server Message Block (SMB) protocol Developed By National Security (NSA) and believes that it has been released by Shadow Brokers hackers Group in April 2017 and it has been used for Wanna cry Cyber Attack.

Tool developer EladErez says the tool scanned more than 50,000 hosts vulnerable to ETERNALBLUE exploit.

Still More than 50,000 hosts are vulnerable to ETERNAL BLUE Exploit

Also Read NSA Malware “EternalBlue” Successfully Exploit and Port into Microsoft Windows 10

Total number of Scans

Tool scanned almost 8 million IPs and France is the winner with 1.5 million scans, still a majority of hosts (53.82%)  still have SMBv1 enabled but most of them applied MS17-010 patch.

Microsoft recommends users to move for v2 or v3, newer and more secure versions of the protocol. 1 out of 9 hosts in a network is vulnerable to EternalBlue says EladErez.

Actually, the results are higher if the scan performed in local environments then there is no statistics, some users may set statistics disabled.

You can download the Scanner from EladErez homepage.

Also Read 6 Million Verizon Customers Data Leaked online Due to Misconfigured File Repository

Vault 7 Leaks : CIA Android Hacking Tool “HighRise” Steals Data From Compromised Android Phones via SMS – WikiLeaks

By
Balaji
-
Vault 7 Leaks : CIA Android Hacking Tool “HighRise” Steals Data From Compromised Android Phones via SMS – WikiLeaks

WikiLeaks Revealed a CIA Secret Document of  Android Mobile Hacking Tool called “HighRise” steal the victims Android smartphones data and send to CIA Control server using SMS messages for communication between Victims and CIA Controlled listener posts.

WikiLeaks Revealed Few days before Another CIA Cyber Weapons called “BothanSpy” and “Gyrfalcon” steals the SSH Credentials from both Windows and Linux Platform.

Highrise is a Malicious Android Application Developed by CIA for mobile devices running Android 4.0 to 4.3 with Redirection Function for SMS messaging. And it acts as an SMS proxy for communication between implants and listening posts.

This Application separates the targets and listening port by an act as a proxy and incoming SMS Messages received by HighRise via the Internet and  Send “outgoing” SMS messages via the HighRise host to CIA  listener.

HighRise Provide Highly Encrypted communication channels between Highrise filed operator (targeted victims) and listener posts over TLS/SSL secured internet communications.

How Do Highrise Attack Target Victims

HighRise v2.0 is a successor of HighRise 1.4 to operate with  Android 4.0 to 4.3  devices and old version of Android allowed to easily allowed an event as soon as HighRise installed.

HighRise installed to victims Android Mobile as an application called TideCheck by using browser Navigation to “http://highriseLP.net/files/highrise.apk” for installing into target phone.

CIA Android Hacking Tool "HighRise" Steals Data through SMS
CIA Android Hacking Tool "HighRise" Steals Data through SMS
CIA Android Hacking Tool "HighRise" Steals Data through SMS

According to CIA Document, Once downloaded, tap the entry in your downloads pages and click “OK” to accept the installation. Once installed, proceed to HighRise activation.

HighRise application first must be manually run once before it will automatically run in the background or after a reboot.

Once the installation has completed, it will promote to enter the password.after entering the password “inshallah”  then select the enter code Button.

After entering the password process, press “initialize” button to activate the application. once activation will be done, then it will automatically  HighRise will run in the background listening for events.

Once activated the application, the HighRise configuration will be displayed and To return directly to the configuration, from the main menu, select the button labeled “Show Configuration”. 

Once all the appropriate Configuration was done, HighRise can be used to send short messages from the HighRise host to the LP.

Previous CIA Leaked Tools by WikiLeaks

Gyrfalcon –  Vault 7 Leaks: CIA Hacking Tools “BothanSpy” and “Gyrfalcon” Steals SSH Credentials From Windows and Linux Computers – WikiLeaks

OutlawCountry – Vault 7 Leaks: CIA Malware “OutlawCountry” Controls Linux Machine and Redirect the Victims Traffic into CIA Controlled Machine – WikiLeaks

ELSA – Vault 7 Leaks: CIA Malware “ELSA” Tracking Geo-Location of WiFi Enabled Windows Computers – WikiLeaks

Brutal Kangaroo – CIA Hacking Tool “Brutal Kangaroo” Revealed to Hack Air-Gapped Networks by using USB Thumb Drives -WikiLeaks

CherryBlossom –  Wikileaks Revealed New CIA Wireless Hacking Tool “Cherry Blossom” Compromise Your Wireless Network Devices using MITM Attack

Pandemic –  New CIA Cyberweapon Malware “Pandemic” installed in Victims Machine and Replaced Target files where remote users use SMB to Download

6 Million Verizon Customers Data Leaked online Due to Misconfigured File Repository

By
Balaji
-
6 Million Verizon Customers Data Leaked online Due to Misconfigured File Repository

Telecommunications giant Verizon’s Customers 6 Million Sensitive personal data leaked online due to misconfigured cloud-based file repository and this Misconfiguraton leads to exposed customer phone numbers, names, and some PIN codes publicly available online.

This Data Breach occurred due to “Human Error” and  Verizon’s Cloud-based file server was operated by Verizon’s Third Party vendor  NICE Systems.

Data Repository Belongs to unprotected  Amazon Web Services S3 bucket and Verizon used NICE Systems technology in its back-office and call center operations.

This Leak Discovered by UpGuard  ,the company — the same company that discovered leaked voter data in June.

Also Read   198 Million American Voters Personal Records Leaked In Public- Biggest Voters Data Leak Ever

Leaked Data Contain Verizon Call Center logs

Exposed data contained 6 million records of subscribers who called the phone giant’s Verizon’s customer services in the past six months and the leaked data was downloaded by anyone by easy guess web address.

An indicator of this attack was repository’s subdomain, “Verizon-sftp,” and Folders were titled from “Jan-2017” through “June-2017,” and each folder contained folders for each day of the month.

The “verizon-sftp” repository (Soruce: UpGaurd)

Each Folder Contains directories of each and every days of the month and each day’s folder contains the compressed files.

According to UpGuard , Once unzipped, the contents of these daily logging folders are revealed to be sizable text files, some as large as 23 GB and the text Files contains composed of voice recognition log files, the records of an individual’s call to a customer support line, including fields like “TimeInQueue” and “TransferToAgent.”

“Other fields and their answers, such as “CallCenterPassword,” indicate which account-holders have requested a higher standard of security for customer service calls to change account settings, allowing any potential scammers in possession of the logs to determine which customers would be easier to victimize.”

Nice Systems Unprotected  cloud server also contained data from French mobile telco Orange S.A. but unlike Verizon ,those data not as sensitive as the data stored in the Verizon directory.

UpGuard spoke person Dan O’Sullivan said, exposed PIN codes is a concern because it allows scammers to access someone’s phone service if they convince a customer service agent they’re the account holder.

Also Read   Massive WWE Data Breach Over 3 Million Fans Records Exposed

1...915916917...945Page 916 of 945

GBHackers on Security is a top cybersecurity news platform, delivering up-to-date coverage on breaches, emerging threats, malware, vulnerabilities, and global cyber incidents.

Company

Trending

Categories

Copyright @ 2016 - 2025 GBHackers On Security - All Rights Reserved