Fourth Largest South Korean Bitcoin Stock Exchange Bithumb Hacked

Attackers have hacked the fourth largest South Korean bitcoin stock exchange Bithumb and data and money of users stolen. Bithumb is one of the largest exchanges where digital currency bitcoin and ethereum traded. The attackers were able to access the personal information of nearly 32,000 Bithumb users, including names, mobile phone numbers and email addresses, so let know Brave New Coin.

According to the exhibition is about three percent of the customers. Let customers know that converted stolen millions of euros to digital currency, but Bithumb suggests that the attackers had no direct access to client funds. According to the fair, the attackers managed to penetrate through the computer of an employee. The attackers would then use the stolen personal information to calling customers and to steal additional information which transactions could be carried out.

Bithumb discovered the data breach on June 29 and alerted the authorities on 30 June. More than 100 Bithumb users have been reported to the South Korean police. The exchange said the victims of the data breach will pay a fee of the equivalent of 76 euros. Users who have suffered Further damages will be compensated for as soon as the amount is confirmed, so notify South Korean media.

Swiss Government Warns Of Contaminated Ads

The Computer Emergency Response Team (CERT) of the Swiss government has warned Internet users to infected ads that tried to install a Trojan horse. The ads were distributed through a popular Swiss ad network was hacked.

The ads were equipped with malicious code that abuse of known vulnerabilities in Internet Explorer, Firefox, made Java or Adobe Flash Player. In case users this software were not up to date and had a German or French institution, the Gozi Trojan was installed. This is a Trojan specifically designed to steal money from online bank accounts. The version that was spreading through the ads focused on five Swiss and two Thai sofas.

According to the Swiss CERT are potentially hundreds of thousands of Internet users become infected through contaminated ads. Last Friday, the owner of the botnet suddenly decided to remove the malware. All the infected computers were instructed to uninstall the Trojan horse. The reason is unclear, according to the CERT. The government organization thinks the botnet administrator may have earned enough money or that he saw the CERT operation had been discovered and therefore decided to disable the botnet.

Europol Arrests Gang Behind Zeus- And SpyEye Malware

At an international operation is an active group of cyber criminals arrested who is suspected to be behind the development and spread of the Zeus- and SpyEye malware. The malware was used to steal money from online bank accounts, which the gang would have caused damage to 2 million.


The operation, which took place on 18 and 19 June in the Ukraine and was supported by Europol and Euro just were arrested five suspects and eight homes searched. According to Europol, the criminals use malware to attack online banking systems in Europe and beyond. "Every cyber criminal had its own specialty and the group was pretty skirts in making the malware, infecting machines, collecting credentials for online banking and money laundering through straw men," said the European Investigation.


On forums for cyber criminals stolen credentials were compromised account data and malware traded. The group would also their "hacking services" to other parties and cooperation with other cyber criminals have sought. "This was a very active group of criminals who were active in countries on all continents, tens of thousands of users infected with banking Trojans then attacked big banks," said Europol.

Infected Updates Distributed For Puush And FlashFXP

Users of programs Puush and FlashFXP has become the target of an attack in which infected updates were presented and distributed. Puush is a program for sharing screenshots. Via Twitter , the service says that malware was sent in the form of a Puush update for the Windows version. After the discovery Puush advised to close the app and scan the computer.

From unconfirmed investigation would show that the malware was designed to steal passwords from browsers. In our own research Puush saw however that passwords were sent to the attackers. There is now released an update for Puush that the malware removed and lets users know if they are or are not infected. In addition, users are advised to change all their passwords. Through a blog posting late Puush know that the server was hacked.

FlashFXP

A similar incident took place last week, only with the FTP program FlashFXP. At the forum FlashFXP users complained that they were offered an update that was not on the website. Attackers had the DNS of the domain using the automatic updater, liveupdate.flashfxp.com adapted and were able to spread infectious updates. According to the developer of the FTP program impact would be limited because FlashFXP first checks the digital signature updates before being installed.

In case the file does not have a valid signature features will be removed. Last week the developer published an update(5.1.0.3824) that users need better protection against DNS hijackings. So is now requesting updates controlled digitally. If the server does not respond with a valid digital signature, the server's response is ignored. Furthermore performed additional checks to verify that the signatures of downloaded files is really FlashFXP.

Shodan Search Engine Will Find Thousands Of Hacked Websites

Many websites hacked and leave a message of the attacker behind often with "Hacked by" begins. The developer of the search engine Shodan is using this term were found thousands of websites have been hacked recently and were provided with the text "Hacked by."

Shodan is known as search engine that sorts of devices connected to the Internet, such as printers , routers, cameras and even complete industrial SCADA systems can be found. However, the search engine indexes also websites. The research that developer John Matherly conducted revealed that many of the hacked websites were hosted by one provider. A quarter of the "Hacked by" sites was in fact housed in the E commerce Corporation.

Almost all servers of this hosting company running on Apache and PHP, although not all have the same versions. Continue turning the most hacked websites not entirely surprised on port 80 (HTTP). Matherly also wanted to know what attackers had most websites and so could create a Top 10, where "GHoST61" 57 defacement's ends on the first place. The investigation of the Shodan developer late unfortunately not see how the sites were compromised.

Digital Newspaper NRC Hit By Hacking By Publisher

Hack the digital publisher Twipe Mobile made ​​yesterday the digital newspaper NRC Handelsblad and NRC Next several Belgian newspapers were not available, so let Twipe. Twipe is a Belgian start-up that has developed a digital platform that issue digital newspapers can be offered.

According to the Belgian newspaper De Standaard knew vandals on the digital infrastructure of the publisher to break into. In addition, the virtual servers from the publisher were irreparably damaged. Twipe say they have no evidence that there are copied. The systems were Mailings containing login and passwords of digitally enabled subscribers.

Meanwhile, the Regional Computer Crime Unit of Leuven has begun an investigation into the burglary. Microsoft would also participate in the research, analyzing the log data of its own cloud service. In Belgium Twipe provides digital publishing newspapers Mediahuis (De Standaard, Het Nieuwsblad, De Gazet Van Antwerpen and Limburg The Importance) and of L'Avenir. Twipe Mobile also allows for the distribution of some French newspapers.

In the Netherlands Twipe care through apps for Android and Windows digital newspaper NRC. The website speaks NRC a "technical malfunction" that caused the digital editions for Android and Windows users yesterday were not available.Meanwhile, the problem would be largely solved. "TVNZ Today is now available. Earlier numbers are downloading the next few hours. We expect nrc.next Friday continued in the apps available. Earlier numbers are accessible again in the coming hours," the newspaper

Domain Lenovo.com Hijacked Through DNS Adjustment

Attackers there yesterday managed to Lenovo.com hijack the DNS of the domain name to suit . Earlier this week, the attackers used the same technique in the Vietnamese Google website. In both cases Lizard Squad behind the DNS changes, as reported OpenDNS.

The Domain Name System (DNS) is similar to the directory and translates among other domain names into IP addresses. The DNS servers Lenovo.com and Google.com.vn change the attackers could then specify the IP addresses where the domain was pointing to. The IP address of the mail server could be modified so that emails for Lenovo.com found themselves at the attackers. In the case of Google.com.vn be the site for a Dutch IP address. Meanwhile, both websites are accessible again and the DNS changes undone.

On Twitter was the Malaysian Registrar WebNIC where both domain names are registered, then with the DNS adjustments in connection brought . IT journalist Brian Krebs reports that Webnic.cc via a command injection vulnerability has been hacked, leaving a rootkit could be uploaded. This rootkit would already have been removed. The website of WebNIC is still unreachable.

Hacked Insurer Fined For Missing Patches

A British insurance company has been fined 175,000 pounds (239,000 euros) because the security updates forgot to install which customer data could be stolen. During the attack on Stay Sure attackers had access data from more than 100,000 credit cards, as well as medical data. The security of the credit cards, which is the back of the card, was also accessible.

However, this is in violation of industry rules, which state that they may not be saved. Eventually tampered with the credit cards of more than 5,000 people. It emerged that the company had no policies or procedures for checking and updating of IT security systems. In addition, the insurer password twice to update the database, so the intruder could have been prevented.

"It is inconceivable that a company with three million customer data had no procedures in place to protect that information,"says Steve Eckersley, head of enforcement at the UK Information Commissioner's Office. Eckersley hopes that the penalty as a warning to other companies will need to keep their IT security in order.

250,000 routers discovered with same SSH key

A researcher who wrote a program to include the "fingerprints" of collecting SSH keys watched curiously when he found one fingerprint on over 250,000 devices. It turned out to routers of the Spanish telecommunications provider Telefonica de Espana.

Some network would default SSH feature, which the manufacturer decides to roll out the same operating system image on all devices. Researcher John Matherly , founder of the Shodan search engine, also found two keys that 200,000 and 150,000 times were used, respectively.

"By analyzing these cases it is easy to get a picture of the systemic problems both hardware manufacturers and ISPs pests," said Matherly. He has a list of unique fingerprints collected offers now via Github to. "It would not surprise me if you find interesting security problems by analyzing why these things are configured incorrectly," he notes.

Security company claims that Sony hackers are Russian

The hackers who knew at Sony Pictures Entertainment to break his Russian and not Korean, says the American security firm Taia Global. Linguists of the company performed several analyzes of twenty messages that were left by the attackers.

Rather let the FBI still know that North Korea was behind the attack. According Taia Global is the technical evidence supplied by the FBI, however vague and unconvincing. The company therefore decided to look at the written evidence that the attackers left behind. Through Native Language Identification (NLI) and "L1 interference" was to see whether the attackers Korean, Chinese, are Russian or German.

Analysts looked for phrases not normally used in English. Then the sentences were translated into the selected language. Of the twenty sentences were found fifteen directly from Russian are translated, nine were found to be Korean, and none was from German or Chinese origin. In a second test looked at the misuse of English grammar and sentence structures or the wrong or were valid in any of the tested languages. Three of the five were correct in Russian, while one corresponded to Korean, said one of the analysts across from the New York Times .

"Our preliminary results show that the attackers Sony probably were Russian, possible but not probable Korean and certainly not Chinese or German," as the company wrote in a blog posting . Many experts doubt whether North Korea really behind the Sony hack is, as alleged by the United States. Another American security company this week suggested that even an ex-employee of Sony was probably involved in the attacks.

"IP addresses are insufficient evidence against North Korea"

The evidence that the United States against North Korea when it comes to the hack of Sony is weak, says a security expert who analyzed the IP addresses used in the attack. Last week, the FBI said in an official statement that the Asian country was responsible for the intrusion on the network of Sony Pictures Entertainment, the theft of all data and sabotage of thousands of computers.

However, the FBI is careful in the words chosen, says security expert and blogger " krypt3ia ". He sees in the choice of words that the investigative unsure. Initially the attack was linked not to North Korea by the FBI, and is now said that the country is the culprit. "Something that makes people like me crazy," he notes. The expert therefore decided to look at the IP addresses used by the malware and introduced himself, the question of whether the resources are to be used or used only by North Korea.

IP Addresses

The IP addresses that the attackers used are from Thailand, Poland, Italy, Bolivia, Singapore, Cyprus and the United States.These include for which proxies and servers can be used by anyone. For one of the servers Krypt3ia found the credentials on a Chinese forum. The IP addresses appeared more frequently used for other cybercrime activities such as sending spam and controlling compromised computers.

"If all IP addresses are used by the US as evidence that North Korea has carried out this attack, I think the evidence is weak," said the expert. Most of these systems are in fact well-known compromised machines that are used for all kinds of cyber crime purposes. Also, many of these types of compromised servers are shared by attackers with each other.

North Korea has used such tactics in the past, according to the expert circumstantial evidence that is inadmissible in court.However, Obama announced that the US will take appropriate action against North Korea. The expert then also questions whether the US base their theoretical response on circumstantial evidence, which he makes reference to the so-called weapons of mass destruction in Iraq. Further, according to the expert whether there because of a break-in at a single entertainment company in Hollywood should be acted upon at the state level. "When I go to Twitter and the news I see is marketing hype and unjustified award ... and it will lead to our mutual destruction," concluded the blogger.

SONY - Malware Analysis

The malware was used recently against Sony is the same " destructive "malware that the FBI this week warned. Reported that the Japanese anti-virus company Trend Micro that a copy of the malware got hold. The main part of the malware is a collection of user names and passwords to be logged on shared network drives.

Once active users remove the malware files and files connected network drives and stops the Microsoft Exchange Information Store service. Then the malware two hour idle and then restart the system. Another part of the malware puts a .bmp file on the computer that contains the message "Hacked by #GOP". This is the same image that would have appeared on the computers from Sony. Trend Micro therefore proposes that the malware that was used against Sony.

Here is Deep Analysis of Destructive Malware By Some Security Research Companies:

Trend Mirco
Kaspersky
Symantec
BlueCoat

VirusTotal Link:
https://www.virustotal.com/en/file/4d4b17ddbcf4ce397f76cf0a2e230c9d513b23065f746a5ee2de74f447be39b9/analysis/1417763962/

Access and location Tesla only protected by password of 6 characters

The only thing standing between a hacker and a $ 100,000 Tesla is a password of 6 characters, says Nitesh Dhanjani , author of several books on hacking and own a Tesla, at the Black Hat security conference in Singapore Asia. Dhanjani found several design flaws in the security system of the Tesla Model S sedan.
He found no vulnerabilities in the main system and its findings forwarded to Tesla.

Dhanjani states that if your password is stolen or hacked be. Thus easily traced the location of the car.
The car can be opened and belongings in the car to be stolen. To actually start the car does need a key.
When the car is ordered, the user creates an account which is only protected by a password of 6 characters. This password is used for the mobile app and the Tesla online account. The freely available app can determine the location of the car but also certain features of the car monitor and manage. The password is vulnerable to attack the usual methods that are used to gain access. To a computer or online account Thus, it is possible to guess the password, for example, via the website Tesla, as it permits an unlimited number of log-in attempts. "It is quite something when a car of $ 100,000 is only protected by a password of 6 characters" says Dhanjani.

Tesla would not comment on the findings of Dhanjani but spokesman Patrick Jones gave an e-mail to the findings of security researchers to observe and investigate further. Extremely seriously "Together with our team of top-notch security professionals protect our products and systems against vulnerabilities. We also work together with the community of security researchers and encourage them to communicate with us."