Tag: hackers

Posted on

Thieves try to steal a Tesla

Thieves steal Tesla carTake a look at a recent attempt of a couple of U.K. thieves to steal a Tesla Model S. They’re smart enough to actually gain entrance to the vehicle without the fob but they’re not smart enough to unplug the charger!

The owner of the vehicle does admit to not doing a couple of things that could have actually prevented the bad guys from gaining entrance including setting a PIN and using a Faraday pouch for the fob (while would block fob’s signal).

But it just goes to show that even “sophisticated” criminals who use technology aren’t always the brightest.

Source: electrek

 

Posted on

ATM Hacking Malware Being Sold On The Dark Web – Cheap!

The website is called ATMjackpot and sells the malware title Cutlet Maker. The name comes from Russian slang “Cutlet” which means a “roll of money.”

The malware coders claim that it works on any Wincor Nixdorf ATM. Most ATMs are vulnerable to hackers because the machines have a computer inside that run an operating system just like a desktop PC.  Many ATM computers still use old operating systems like Windows XP which is no longer supported or updated to fight the latest threats. This fact, coupled with open and available USB ports makes the machines the perfect targets for hackers.

Posted on

Hackers Leak Future Game Of Thrones Episode

The hacking group also stole and uploaded episodes of other popular shows to a site they created to display what they have stolen.

“Hi to all mankind,” was sent out via an email. “The greatest leak of cyber-space era is happening.”

Avoiding sites that contain leaked and pirated movies and television shows is a good idea because it’s likely that along with spoilers and leaked footage, the site and any downloaded files will come bundled with malicious software.

In a statement, HBO said:
“We immediately began investigating the incident and are working with law enforcement and outside cybersecurity firms,”
“Data protection is a top priority at HBO, and we take seriously our responsibility to protect the data we hold.”

Posted on

Russian Hackers Develop A New Malware To Target U.S. Electric Grid

Russian hackers have developed a new weapon in the form of a new malware family directly targeting systems that operate the U.S. electricity grid.

According to this Washington Post article, researchers from Dragos Inc and ESET identified the new threat that is being called CrashOverride. So far the malware has only disrupted the power grid of one energy system in the Ukrane, but with modifications it could be weaponized and used to target the U.S. according to Sergio Caltagirone, director of threat intelligence for Dragos Inc. “It’s the culmination of over a decade of theory and attack scenarios,” Caltagirone warned. “It’s a game changer.” That attack, which left 225,000 customers without power, was carried out by Russian government hackers, according to US research groups..

Dragos Inc is calling the hacking group that created the new malware “Electrum.”

Posted on

“OK Google. Is My Virtual Assistant Secure?”

For years, people have cringed over the idea of the government or the FBI wire tapping phones or browsing internet history and other basic invasion of privacy. The idea of cybercriminals stealing your personal data from your computer or mobile device is an ongoing threat. But how many people are considering the danger & security of a personal assistant such as Alexa?

To give you a good example of how fragile these things are, Burger King created a commercial in which one of the employees says at the end “Ok Google. What’s a Whopper burger?” Triggering the Google home assistant to then read off a very descriptive Wikipedia ad that would hopefully persuade the listener to go buy a Whopper. A little invasive, right? People were not excited about this ad, and Google had to block that certain command, yet people are gladly putting these devices in their homes everyday.

We feel that you should keep in mind a few things about Alexa and Google home before you install into your house, such as, the fact that virtual assistants lack security. What happens when hackers figure out how to subliminally hack the airwaves and tell your device to deposit your money into someone else’s account? How low of an audio level will the device accept and is there a way to test this? There seems to be no real test or standard as to how these devices work and that seems to open the door to a lot of security issues.

These personal assistants know everything. They know what you’re watching, what you’re listening to, what you’re searching, photographing and buying. We are really just adding to Google’s empire of data collection and who is keeping track of what is being sold or used of that information?

Considering personal assistants fit into the category of smart home devices linked to a server, its important to consider they may be at risk for IoT (Internet of Things) attacks as well. We’ve seen these types of attacks being used to target companies & not necessarily for spying on home users, but the main goal is the same. Hackers want to see and hear your private data so they can use that information against you to benefit themselves.

A few tips to those who chose to install a Siri, Alexa, Google Home device:

+ If you are not currently using your personal assistant, it’s wise to mute it or put it to sleep so that it’s not ‘always listening’.
+ Don’t ever connect sensitive accounts to your home assistant, or connect multiple accounts.
+ Clear out old recordings and search history regularly.
+ Be sure you know all your settings and permissions you are granting your home assistant and consider tightening those.

Posted on

Samsung Galaxy Smartphones Vulnerable To Hack

Image courtesy of Janitors. Creative Commons License.
If you own a Samsung Galaxy smartphone you are more than likely vulnerable to the prying eyes and ears of hackers. A security flaw in the Galaxy allows hackers to install malware on your phone and listen in on your phone calls.
Security Firm NowSecure discovered that a bug in the Swift keyboard, which comes pre-installed on 600 million Samsung Galaxy phones, is responsible for the vulnerability. According to ZDNet.com, hackers can gain access to GPS, camera, microphone, photos, and text messages. They can also install malicious apps on the phone, change how the phone works, and eavesdrop on calls.
Little can be done about the flaw because the Swift keyboard cannot be uninstalled. Samsung learned about the flaw in December of 2014 and released a patch in March of 2015 to network operators, according to Mashable. However, it is not known how many of the network operators provided the patch to their users. Even if carriers provide the update, many users don’t bother to install it. NowSecure has yet to find a Samsung Galaxy that has been patched.
NowSecure CEO Andrew Hoog said that his company “had some heartburn” about the delay in releasing a patch, according to The Wall Street Journal. He worried that if his researchers found the bug, hackers would too. Right now, it doesn’t appear as if the vulnerability has been exploited in the wild but it is only a matter of time before hackers take advantage of this.
Any Samsung Galaxy that contains the Swift keyboard is affected including the S6, S5, S4, and S4 mini. Users should install the update if it is available. If not, users should avoid unsecured Wi-Fi connections or use a different phone temporarily.
Update: On Thursday, June 18th, Samsung announced that it would supply an update to fix the vulnerability. The update will roll out over the next few days and will be available to Samsung Galaxy S4’s and later models, according to PC World. These models have the Knox security platform and can receive automatic updates so be sure to turn automatic updating on if it isn’t already. For earlier models, such as the S3, a fix is in the works and will be available soon,
Posted on

How To Spot An SMS Phishing Attack

SMiShing: SMS phishing. We’ve all heard of email phishing scams where an attacker sends a false email and “fishes” for financial information, login credentials, or other sensitive data. These phishing scams can also happen over text messages.

Criminals will send you an SMS or text message that leads you to a website that will ask you to put in your login credentials or other sensitive information, therefore stealing it. Or clicking on a link in the text will install malware on your device. This malware can basically hijack your phone, log your keystrokes, and perform a number of malicious attacks.

It sounds like an obvious plan that would be easy to detect, right? Who would fall for that? SMS phishing attacks can be tricky, especially to those that are uninformed of the dangers. Because of  the personal nature of text messages, when a criminal sends a text directly to your phone, you will open it usually within 15 minutes of receiving it.

It might appear as if the text came from a friend, a retailer, your bank, and other trusted sources. Often the texts will say that you have won something or, according to AboutTech.com, they will play on your fears such as fear of someone stealing your money, fear of being accused of a crime, or fear of harm to a loved one.

Last September, the occurrence of SMS phishing attacks more than tripled in the U.S, according to Cloudmark, a security firm. The U.S. region most prone to SMS phishing attacks is Odessa and West Texas, with 16.1% of the population being attacked at some time. This might be due to the rural, less tech-savvy population.

Here’s how you can avoid falling for a SmiShing scam. Avoid clicking links in text messages, no matter who the text came from. Ignore texts that ask you to “respond quickly” or respond with your sensitive, personal information. If a text appears to have come from a trusted source like your bank or a retailer, call that business directly. Be suspicious of strange numbers that don’t look like phone numbers. This could be criminals covering up their identity with email-to-text services. Turn on the “block texts from the internet” feature on your phone. Most of all, always be on your guard and think about what you are doing. It only takes half a second to click on a malicious link.

Posted on

Hacker Group Anonymous Declares War

The infamous hacker group Anonymous has declared war on jihadists over the Charlie Hedbo attack. Anonymous stated in a video posted on YouTube that the Islamic extremists are the “enemy of the freedom of speech” and that they will be shutting down social media sites and websites related to the terrorists, according to CNN.

The group stated in the video, “Freedom of speech and opinion is a non-negotiable thing, to tackle it is to attack democracy. Expect a massive frontal reaction from us because the struggle for the defense of those freedoms is the foundation of our movement.”

Some believe, however, that taking down the social media sites of the jihadists could make monitoring the terrorists more difficult, according to the BBC.

Anonymous is usually an enemy of authority and government. They have shut down sites related to policies they disapprove of. This includes government sites, child pornography sites, and the sites of large corporations likes PayPal, Sony, Visa, and Mastercard, according to Daily Mail. Support for the hacker group is divided. Some see the group as “hacktivists,” doing good for the world while others see the group as cyber terrorists.

Anonymous is based world-wide. Over the years, dozens have been arrested in the US, UK, Australia, the Netherlands, Spain, and Turkey.

Anonymous shows us that the wars of today, and of the future, will not only be fought with guns and bombs, they will be fought in cyberspace. It is becoming increasingly important to protect yourself online.

Posted on

Zeus Banking Trojan Uses Steganography To Hide Crucial Data In A Photo


CNBC Prime – YouTube

Zeus is known for being one of the most effective tools for stealing a person’s banking information as it hacks login details and even masks secret transactions taking place in the background. Zeus VM is the newest variant that downloads a users configuration file that contains the domains of the bank. Then the malware is instructed to intervene during the transaction.

This was first noticed by a French researcher who writes under the name Xylitol. Jerome Segura, security researcher for Malwarebytes wrote “The malware was retrieving a JPG image hosted on the same server as were other malware components.”

Steganography has been used by malicious code writers for quite some time and is nothing new. The embedded code in the file format looks legitimate and is sometimes overlooked by security software. Most webmasters would assume an image that can just be viewed would be harmless. In bitmap mode the suspect image appears to be much larger and the malicious data that has been added and encrypted using Base64 encoding and RC4 and XOR encryption algorithms.

Even Wells Fargo data has been shown to be captured by this malware.

 

Posted on

NSA Has Planted Bugging Hardware & Software Into 100,000 Computers Tracking Users Offline

Photo Via – YouTube Screenshot

It has now been released that the NSA has planted bugging hardware and software into 100,000 computers worldwide, not the 50,000 originally claimed. Offline or “air-gapped” computers can now be tracked and surveillance can be gathered according to leaker Edward Snowden.

Tiny radio receivers are planted inside the computer before it is shipped or during a covert operation called “a black bag job.” The devices look just like a normal USB port and infiltrate/exfiltrate data to an NSA relay station (about the size of a suitcase) up to eight miles from the location of the receiver.

“Air-gapping” a computer (unplugging it from any internet network connection) was thought to be a safe way for people to utilize their computers with no worry of someone monitoring their activity. But, the NSA uses radio waves, which can access computers when they are completely offline. No longer is disconnecting a computer from the internet a foolproof way to keep the agency from gathering surveillance.

Code named “Quantum”, the NSA has used this technology ot spy on Chinese hackers, Russian military, South American drug cartels, Middle East interests, and even the European Union. “Quantam” was even used in recent cyber attacks against Iranian nuclear facilities. This would be the first documented report of the NSA participating in cyber attacks. This attack crippled Iranian centrifuges causing them to spin out of control. This is not the first time that details of the “Quantam” project have been exposed.

A leaked powerpoint slide showed that receivers had been inserted into 50,000 computers worldwide and that report has now been increased to 100,000. Jacob Applebaum, known security researcher also mentioned the “Quantam” receivers in the hacking conference Chaos Communication Congress.

https://youtu.be/vILAlhwUgIU