Connect with us
Overview of security incidents for the period from 4 to Overview of security incidents for the period from 4 to

Security

Overview of security incidents for the period from 4 to 10 November 2021

Published

on

A brief overview of the main events in the world of information security for the week.

Unidentified persons stole $ 55 million from the bZx DeFi platform, spies stole data from the Pentagon’s defense contractor, China accused foreign intelligence of hacking its airlines, and ransomware Hive attacked Europe’s largest electronics retailer. Read about these and other high-profile events in the world of information security for the period from 4 to 10 November 2021 in our review.

Cybersecurity researchers at Cisco Talos have uncovered a new malware campaign from Babuk ransomware operators targeting ProxyShell vulnerabilities in Microsoft Exchange servers. Attackers use the China Chopper web shell to initially hack and install Babuk malware. Vulnerabilities (CVE-2021-34473, CVE-2021-34523 and CVE-2021-31207) were fixed in April and May of this year, and technical details were published in August.

MediaMarkt, a large electronics and home appliance retailer, was cyberattacked using ransomware Hive, which shut down its IT systems and prevented stores in Germany and the Netherlands from operating normally. The ransomware demanded $ 240 million from MediaMarkt to recover encrypted files. The attack affected a number of retail stores in Europe, mainly in the Netherlands. Although there were no problems with online sales, cash registers could not accept credit cards or print receipts. In addition, the return of goods did not work due to the inability to view previous purchases.

The Chinese government said that in 2020 some foreign intelligence agency hacked several Chinese airlines and stole passenger data. The malicious campaign was discovered last week by officials from the Department of State Security after one of the affected airlines informed him of a data breach in January 2020. Security researchers have linked the hack to a custom Trojan used by cybercriminals to extract passenger data. Subsequent investigations showed that other airlines were compromised in a similar manner.

An unidentified group of hackers attacked nine organizations, including at least one in the United States, CNN reports. The attackers hacked into the networks of defense, energy and technology companies, as well as health and education institutions. Cybercriminals managed to steal passwords from a number of organizations, which gave them long-term access to the respective networks. This allows hackers to intercept sensitive information sent via email or stored on computer systems. The tactics of the hackers are the same as those of the well-known group of Chinese cybercriminals.

Electronic Warfare Associates (EWA), a US defense company, reported about the hacking of its mail system and the leakage of files containing personal information. The attacker seized control of one of the company’s email accounts on August 2, 2021, according to a statement filed by EWA with the Montana Attorney General’s Office. The hack was discovered when a hacker tried to pull off a fraudulent scheme (the company believes that fraud was its main goal). As shown by the investigation of the incident, the names and surnames, social security numbers and driver’s license data were compromised. Individuals affected by the leak were notified accordingly.

Unknown attackers tried to attack the popular investment and trading platform Robinhood, gained access to the email addresses and full names of its clients, and demanded a ransom. The incident was the result of the attackers using social engineering techniques on one of the customer support staff. Unknown persons convinced the employee that they had the right to access “support systems for a specific client”, and received from him access to the e-mail addresses of about 5 million customers and the full names of about 2 million customers. However, for a smaller number of customers, the leak became much more serious – their names, dates of birth, postal codes were compromised, and for ten users more account data were compromised.

One of the most notorious incidents of the week was the theft of $ 55 million in cryptocurrency from the DeFi platform bZx, which allows users to borrow and lend and speculate on fluctuations in the rate of cryptocurrencies. The platform developer received a phishing email containing a Word document with malicious macros disguised as a legitimate attachment. After opening a malicious attachment, a script was launched on the developer’s computer that compromised the mnemonic phrase for accessing his cryptocurrency wallet. The attacker emptied the developer’s wallet and stole two private keys used to integrate the bZx platform with the Polygon and Binance Smart Chain (BSC) blockchains. Using these keys, the hacker stole bZx funds from Polygon and BSC, along with funds from a small number of users who approved unlimited spending transactions for both tokens in their accounts.

Not without large-scale data leaks during the week. A database of 45.5 million users of mobile VPN services FreeVPN.org and DashVPN.io has leaked to the Internet. The database contains email addresses, encrypted passwords, registration dates, profile updates and last login. All data is dated 2017-2021.

Participants in the Zero Day Initiative’s Pwn2Own Austin 2021 hacking contest have won awards for hacking printers for the first time in the history of the event. On Pwn2Own Austin’s first day of jailbreak, cybersecurity experts earned more than $ 360,000 in total from exploiting vulnerabilities in printers, NAS devices, routers and smart speakers.

Another interesting case is the blocking of the account of the head of Instagram, Adam Mosseri. Someone using the pseudonym Syenrai was able to temporarily block Mosseri’s account, convincing support that he had died. The account was blocked thanks to the ability to assign a memorable status to the Instagram accounts of deceased people. Some scammers even offer paid services to ban Instagram users, Syenrai explained. To assign commemorative status to an unconfirmed page with less than a million subscribers, they simply provide any obituary recently published on the Web as proof of death, and it takes users up to several days to restore access.

The Cybersecurity and Infrastructure Security Agency (CISA) has warned that the PoC code for the BrakTooth vulnerability in Bluetooth is already available on the Web. BrakTooth is the general name for about twenty vulnerabilities in the commercial Bluetooth Classic (BT) stacks. also affecting chips supporting Bluetooth versions 3.0 + HS to Bluetooth 5.2.

Click to comment

Leave a Reply

Your email address will not be published.

Security

Cryptocurrency exchange Binance was robbed of $570 million. Hacker withdrew BNB tokens

Published

on

Cryptocurrency exchange Binance was robbed of 570 million Hacker withdrew

Cryptocurrency exchange Binance has undergone another hacker attack. The attackers managed to withdraw BNB tokens worth about $570 million.

Cryptocurrency exchange Binance was robbed of $570 million.  Hacker withdrew BNB tokens

Somewhat earlier it was reported that the attack allowed the hackers to steal about $110 million, but now it turned out that everything is much worse. At the same time, the specialists of the exchange managed to freeze part of the funds, but we are talking about only 7 million dollars, which is clearly insignificant against the background of 570 million.

The exchange revealed that a cross-chain bridge connected to its BNB chain was attacked, allowing hackers to move BNB tokens off the network. Now the network has been restored, and the clients’ funds, according to Binance, are safe.

The fact of the theft of funds contributed to a sharp drop in the BNB rate by almost 5%, but after a few hours, almost half of the fall was redeemed.

Continue Reading

Security

Hacker who earned $27 million in cyberattacks will spend 20 years in prison and pay $21 million in fines

Published

on

Hacker who earned 27 million in cyberattacks will spend 20

A Florida district court has sentenced 34-year-old IT engineer Sebastien Vashon-Desjardins to 20 years in prison for carrying out at least 90 cyberattacks.

Hacker who earned $27 million in cyberattacks will spend 20 years in prison and pay $21 million in fines

It is noted that for several years of his activity, the hacker, using the NetWalker encryption virus, earned about $ 27 million. A search of Vashon-Desjardins revealed a crypto wallet containing 719 bitcoins, which was about $22 million at the time of the cybercriminal’s arrest in January 2022.

According to investigators, the 34-year-old cybercriminal acted in collusion with other hackers. Vashon-Desjardins himself played the role of an attacker: he infected the corporate networks of various companies with a virus and then demanded a ransom from them. Organizations from the USA, Canada and a number of European countries suffered from the activities of the criminal.

It is noted that, in addition to the prison term, the court also imposed a fine on Vashon-Desjardins in the amount of $ 21 million. Also, the criminal will have to pay compensation to the companies affected by his actions. The amount of damages has not yet been established.

Continue Reading

Components

Unique behavior of Ryzen 7000 processors. The notorious patches from the Specter vulnerability improve the performance of new CPUs

Published

on

Unique behavior of Ryzen 7000 processors The notorious patches from

Recently, various vulnerabilities in processors have been talked about much less often, and users no longer worry about performance degradation due to patches. As it turns out, Ryzen 7000 processors generally benefit from such patches!

Unique behavior of Ryzen 7000 processors. The notorious patches from the Specter vulnerability improve the performance of new CPUs

At least this is true for Linux, since it was in this OS that the author tested the Ryzen 9 7950X and Ryzen 5 7600X. It turned out that when working out of the box, the CPUs show better performance than when loading a special version of Linux with a deactivated patch from the Specter V2 vulnerability.

Unique behavior of Ryzen 7000 processors. The notorious patches from the Specter vulnerability improve the performance of new CPUs

Of course, such results do not appear everywhere, and during normal work they are unlikely to be critical. In particular, in total, according to the results of 190 tests, the difference was only 3%.

Continue Reading

Most Popular