Hacks

Internet-connected devices have been one of the most remarkable developments that have happened to humankind in the last decade. Although this development is a good thing, it also stipulates a high security and privacy risk to personal information. In one such recent privacy mishap, smart IP cameras manufactured by Chinese smartphone maker Xiaomi found mistakenly sharing surveillance footage of Xiaomi users with other random users without any permission. The issue appears to affect Xiaomi IP cameras only when streamed through connected Google's Nest Hub, which came into light when a  Reddit user  claimed that his Google Nest Hub is apparently pulling random feeds from other users instead of his own Xiaomi Mijia cameras. The Reddit user also shared some photos showing other people's homes, an older adult sleeping on a chair, and a baby sleeping in its crib that appeared on his Nest Hub screen. It appears the issue doesn't reside in Google products; instead, it co...

Landry's, a popular restaurant chain in the United States, has announced a malware attack on its point of sale (POS) systems that allowed cybercriminals to steal customers' payment card information. Landry's owns and operates more than 600 bars, restaurants, hotels, casinos, food and beverage outlets with over 60 different brands such as Landry's Seafood, Chart House, Saltgrass Steak House, Claim Jumper, Morton's The Steakhouse, Mastro's Restaurants, and Rainforest Cafe. According to the  breach notification  published this week, the malware was designed to search for and likely steal sensitive customer credit card data, including credit card numbers, expiration dates, verification codes and, in some cases, cardholder names. The PoS malware infected point-of-sale terminals at all Landry's owned locations, but, fortunately, due to end-to-end encryption technology used by the company, attackers failed to steal payment card data from cards swiped at its r...

Researchers discovered a new wave of custom malware campaign named as “Dudell” from previous unknown cyberespionage group dubbed  Rancor . Rancor Threat group active since 2017, and they continuously targeting the government organization until January 2019, in this current campaign, researchers discovered an undocumented custom malware. Additionally, the group using another malware family called “Derusbi” to load a secondary payload once it infiltrates a target, and malware will be installed in the victim’s machine by conducting 2 rounds of attack. Researchers observed that, the attacker sent via 149.28.156[.]61 to deliver either Derusbi or KHRat samples with either  cswksfwq.kfesv[.]xyz or connect.bafunpda[.]xyz as C2. Rancor has a record of conducting targeted attacks in Southeast Asia throughout 2017 and 2018. DUDELL Malware Infection Process DUDELL malware initially observed form weaponized Microsoft excel document via malspam...

A zero-day vulnerability in Dropbox for Windows allows attackers to escalate privileges from simple windows users privilege to the reserved SYSTEM privilege. The vulnerability resides in the  DropBoxUpdater service , which is responsible for keeping the client application up to date. Dropbox Updater Vulnerability The vulnerability was discovered by security researcher Decoder and  Chris Danieli  and they have created a  PoC  to test the vulnerability. The DropBoxUpdater is the component of the Dropbox Client Software suite, the updater installed as a service and keeps 2 scheduled tasks running with SYSTEM permissions. Dropboxupdate writes the log files in the directory “c:\ProgramData\Dropbox\Update\Log”, any users can access the directories or to add, delete the files. Another notable thing is that SetSecurity call made through SYSTEM privileges on the files, this allows an attacker to exploit via  hardlink . “But we have a problem h...

Despite the importance of setting strong passwords, users continue to setup week passwords which are easy to guess for an attacker. A strong password is key to protect your digital assets. Here is the list of  Worst Passwords 2019 Memorizing strong separate passwords for each account is also a difficult task,  password managers  are the solution for this problem. Worst Passwords 2019 Nordpass  compiled  a list of 200 most popular passwords that were leaked in data breaches just this year. The analysis shows that still people using weak passwords. The bad news is that when compared to  2018 leaked passwords  nothing changed, “12345”, “123456” and “123456789” remains at the top spot. Following that “test1” and “password” remain popular. If you have a weak password then it is a cakewalk for hackers, they can gain access to your account easily by using brute force techniques. A strong password should have at least six characters that includ...

Researchers discovered over 100 malicious apps from Google play store that downloaded by more than 4.6 android users around the globe. Most of the malicious apps are commits ad fraud, and the app malicious apps are using the same common code package dubbed “Soraka” ( com.android.sorakalibrary.* ). “GBHackers on Security” reported  several adware incidents  in the past few months, and it’s rapidly growing to exclusively target the Android users to generate millions of dollars revenue. Malware, Spyware, and Adware can accompany them, become a parasite in user’s systems resulting in unnecessary disruptions, and breaches of the personal data in your Android devices. In addition to the Soraka code package, Researchers also discovered, in some of the apps, a variant with similar functionality which we dubbed “Sogo” ( com.android.sogolibrary.* ): Some of The Malicious Apps Activities An app called “ Best Fortune Explorer App ” published under the publisher JavierGent...

Hackers abuse legitimate RDP service to use fileless attack techniques for dropping multi-purpose off-the-shelf tools for device fingerprinting and to deploy malicious payloads ranging from ransomware to cryptocurrency miners. The Remote Desktop is the built-in feature with most of the Windows installation and it has built-in file-sharing functionality that is used by the attackers as an infection vector. Abusing Remote Desktop Server Feature The infection starts by abusing the feature of the Windows Remote Desktop Server in which the  RDP  client shares the virtual network file share location named “ tsclient ” of the connected computer. Attackers use these paths to create multiple-letter directory names. PC Drives According to Bitdefender researchers  report , the attackers placed a malicious component of the attack named  worker.exe  located on the network share on the “tsclient” network location and it can be executed using explorer.exe or ...