Category Archives: Hacker

Experts Warn of New Spyware Threat Targeting Journalists

Hacker

Security experts have warned about the emergence of previously unknown spyware with hacking abilities comparable to NSO Group’s Pegasus that has already been used by clients to target journalists, political opposition figures, and an employee of an NGO, The Guardian reported. 

Researchers at the Citizen Lab at the University of Toronto’s Munk School said the spyware, which is made by an Israeli company called QuaDream, infected some victim’s phones by sending an iCloud calendar invite to mobile users from operators of the spyware, who are likely to be government clients. Victims were not notified of the calendar invitations because they were sent for events logged in the past, making them invisible to the targets of the hacking. Such attacks are known as “zero-click” because users of the mobile phone do not have to click on any malicious link or take any action in order to be infected.

According to the Citizen Lab report, the hacking tool is marketed by QuaDream under the name Reign. The hacking attacks that have been discovered occurred between 2019 and 2021.

The research underscores that, even as NSO Group, the maker of one of the world’s most sophisticated cyber weapons, has faced intense scrutiny and been blacklisted by the Biden administration, probably curtailing its access to new customers, the threat posed by similar and highly sophisticated hacking tools continue to proliferate.

Microsoft posted information titled: “Standing up for democratic values and protecting stability of cyberspace: Principles to limit the threats posed by cyber mercenaries”. From the information:

The explosive growth of private “cyber mercenary” companies poses a threat to democracy and human rights around the world. Cyber mercenaries – private companies dedicated to developing, selling, and supporting offensive cyber capabilities that enable their clients to spy on the networks, computers, phones, or internet-connected devices of their targets – are are real cause for concern. These tools have been used to target elections, journalists, and human rights defenders and are increasingly accessible on the open market, enabling malicious actors to undermine our key democratic institutions.

At Microsoft, we believe that digital technology has incredible potential to improve lives across the world, support democracy, and protect and promote human rights. That is why, at the second Summit for Democracy, we were proud to join the international coalition of over 150 companies that make up the Cybersecurity Tech Accord individually and collectively pushing back on the cyber mercenary market by committing to a set of industry principles. 

Our collective commitment to limiting the threats posed by cyber mercenaries:

  • Take steps to counter cyber mercenaries’ use of products and services to harm people;
  • Identify ways to actively counter the cyber mercenary market;
  • Invest in cybersecurity awareness of customers, users, and the general public;
  • Protect customers and users by maintaining the integrity and security of products and services;
  • Develop processes for handling valid legal request for information.

Personally, I don’t see why cyber mercenaries need to exist at all. These groups do not have the right to hack into other people’s phones. If you haven’t updated your iOS devices in a while – now is a great time to do it.

Biden Restricts Use of Commercial Hacking Tools By U.S. Agencies

Hacker, ,

President Biden restricted the use of commercial hacking tools throughout the federal government as officials believed high-powered spyware had compromised devices belonging to at least 50 U.S. personnel working overseas, The Wall Street Journal reported.

Mr. Biden signed an executive order that imposes rules limiting the acquisition and deployment of hacking tools from vendors who’s products have been linked to human-rights abuses or are deemed to pose counterintelligence or national security risks to the U.S. It also limits the purchasing of tools if they are sold to foreign governments considered to have poor records on human rights, The Wall Street Journal also reported.

The “Executive Order on Prohibition on Use by the United States Government of Commercial Spyware that Poses Risks to National Security” was signed by President Biden on March 27, 2023. Here are some key points from the Executive Order:

…Technology is central to the future of our national security, economy, and democracy. The United States has fundamental national security and foreign policy interests in (1) ensuring that technology is developed, deployed, and governed in accordance with universal human rights; the rule of law; and appropriate legal authorization, safeguards, and oversight, such that it supports, and does not undermine, democracy, civil rights and civil liberties, and public safety; and (2) mitigating, to the greatest extent possible, the risk emerging technologies may pose to the United States Government institutions, personnel, information, and information systems.

To advance these interests, the United States supports the development of an international technology ecosystem that protects the integrity of international standards development; enables and promotes the free flow of data and ideas with trust; protects our security, privacy, and human rights, and enhances our economic competitiveness.

The growing exploitation of Americans’ sensitive data and improper use of surveillance technology, including commercial spyware, threatens the development of this ecosystem. Foreign governments and persons have deployed commercial spyware against United States Government institutions, personnel, information, and information systems, presenting significant counterintelligence and security risks to the United States Government.

…Therefore, I hereby establish as the policy of the United States Government that it shall not make operational use of commercial spyware that poses significant counterintelligence or security risks to the United States Government or significant risks of improper use by a foreign government or foreign person…

The New York Times reported that the tools in question, known as commercial spyware, give governments the power to hack the mobile phones of private citizens, extracting data and tracking their movements. The global market for their use is booming, and some U.S. government agencies have studied or deployed the technology.

According to The New York Times, the executive order prohibits federal government departments and agencies from using commercial spyware that might be abused by foreign governments, could target Americans overseas, or could pose security risks if installed on U.S. government networks. The order covers only spyware developed and sold by commercial entities, not tools built by American intelligence agencies.

I think it is very clear that people don’t want to be spied upon through their phones. It makes sense for President Biden to prohibit the use of government spyware that poses risks.

Hacking Forum Shuts Down After Administrator Gets Arrested

Hacker,

Last week, the FBI arrested a man alleged to be “Pompompurin,” the administrator of the infamous and popular BreachForums, TechCrunch reported. Days after the arrest, the cybercrime website’s new administrator announced that they are shutting down the forum for good.

“Please consider this the final update for Breached,” the new admin, known as “Baphomet,” wrote in the official Telegram channel. “I will be taking down the forum, as I believe we can assume that nothing is safe anymore. I know that everyone wants the forum up, but there is no value in short term gain for what will likely be a long term loss by propping up Breached as it is.”

The new administrator Baphomet did not respond to TechCrunch’s request for comment.

According to TechCrunch, the apparent end of BreachForums comes roughly a year after a coalition of international law enforcement agencies led by the U.S. Department of Justice seized RaidForums, another notorious cybercrime forum where hacked databases would be advertised and sold. BreachForums was born in the aftermath of RaidForums’ demise, and served pretty much the same purpose and audience.

The Record reported that a hacker going by the name “Baphomet” initially said they were working through an emergency plan for the forum after the arrest of 21-year-old Conor Brian Fitzpatrick at his home last Wednesday. In court documents, Fitzpatrick is alleged to be the hacker known as pompompurin – the leading administrator of BreachForums.

The Record also reported an update was posted on Tuesday, the new administrator taking over BreachForums said they now plan to shut down the platform entirely.

Baphomet wrote that someone was able to access the backend of the platform through pompompurin’s account on Sunday afternoon, leading them to believe law enforcement may have access to the site’s source code and information about the forum’s users.

According to The Record, Bahomet wrote: “This will be my final update on Breached, as I’ve decided to shut it down. I’m aware this news will not please anyone, but its the only safe decision now that I’ve confirmed that the glowies likely have access to Poms machine,” the hacker said.

The Record also reported that BreachForums became the go-to site for cybercriminals stolen data and market troves of information leaked during hacks and attacks. The forum was most recently in the news after hackers posted data stolen from Washington, D.C’s healthcare exchange platform on the site, including the sensitive information of Congress members and staff.

CNBC reported on March 21, at least 17 current or former members of Congress had personal information exposed in the hack of the District of Columbia health insurance data system, according to a top Democrat investigating the matter. And that number is expected to rise, he said. According to multiple reports, the breach might have impacted more than 56,000 people.

In my opinion, hackers cause problems for everyone – including themselves. They run the risk of going to jail due to their decision to grab data that does not belong to them. It is good that BreachForums is going down.

Uber Investigating Breach Of Its Computer Systems

Hacker

Uber discovered its computer network had been breached on Thursday, leading the company to take several of its internal communications and engineering systems offline as it investigated the extent of the hack, The New York Times reported.

The breach appeared to have compromised many of Uber’s internal systems, and a person claiming responsibility for the hack sent images of email, cloud storage and code repositories to cybersecurity researchers and The New York Times.

According to The New York Times, an Uber spokesman said the company was investigating the breach and contacting law enforcement officials. Uber employees were instructed not to use the company’s internal messaging service, Slack, and found that other internal systems were inaccessible, said two employees, who were not authorized to speak publicly.

Shortly before the Slack system was taken offline on Thursday afternoon, Uber employees received a message that read, “I announce I am a hacker and Uber has suffered a data breach.” The message went on to list several internal databases that the hacker claimed had been compromised.

Uber tweeted on September 15, 2022: “We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available.”

The Verge reported that the alleged hacker, who claims to be an 18-year-old, says they have administrator access to company tools including Amazon Web Services and Google Cloud Platform.

When contacted by The Verge for comment, a spokesperson for Uber declined to answer additional questions, and pointed to its statement on Twitter.

The Washington Post reported that after the hacker posted a message on Uber’s Slack, it was followed by a flurry of reaction emoji, including several dozen showing what appeared to be a siren symbols. Because of the hack, people said, some systems including Slack and internal tools had been temporarily disabled.

The Washington Post obtained internal screenshots that showed the hacker claiming to have wide-ranging access inside Uber’s corporate networks and appeared to indicate the hacker was motivated by the company’s treatment of its drivers. The person claimed to have taken data from common software used by Uber employees to write new programs.

According to The Washington Post, the hacker’s ominous posts were met with reactions apparently depicting the SpongeBob character Mr. Krabs, the popular “It’s Happening” GIF and queries as to whether the situation was a prank.

The Wall Street Journal reported that a hacker, identified only by the Telegram handle Tea Pot, gained control of Uber’s account with HackerOne, a firm that helps companies work with security researchers, according to the company and researchers on their platform. The hacker provided security researchers with screenshots that appeared to show widespread access to a range of administrative accounts that manage Uber’s technology systems, including the Amazon Web Services and Google clouds, as well as VMware systems, the researchers said.

Other than the HackerOne account compromise, The Wall Street Journal couldn’t verify Tea Pot’s other claims.

At the time I am writing this post, Uber has not provided any updates on their Twitter account. Perhaps they will later today. That said, if you were planning to go somewhere via Uber today – there’s a good chance that you won’t be able to obtain a ride from the company’s drivers. Consider Lyft or the local bus service wherever you are.

Europol Announced the Arrest of Two Ransomware Hackers

Hacker,

Eurpol announced in a press release that a coordinated strike between several law enforcement agencies resulted in the arrest in Ukraine of “two prolific ransomware operators known for their extortionate demands (between €5 and €70 million)”.

The law enforcement groups involved included the French National Gendarmerie, the Ukranian National Police Force, and the United States Federal Bureau of Investigation, with the coordination of Europol and INTERPOL.

According to Europol, the results of this included: 2 arrests and 7 property searches; seizure of US $375,000 in cash; seizure of two luxury vehicles worth €217,000 and asset freezing of $1.3 million in cryptocurrencies.

From the Europol press release:

The organized crime group is suspected of having committed a string of targeted attacks against very large industrial groups in Europe and North America from April 2020 onwards. The criminals would deploy malware and steal sensitive data from these companies, before encrypting they files.

They would then proceed to offer a decryption key in return for a ransom payment of several millions of euros, threatening to leak the stolen data on the dark web should their demands not be met.

The Record reported the arrests of the two members of a ransomware gang took place on September 28, in Kyiv, Ukraine’s capital. Of the two suspects who were arrested, one is a 25-year-old believed to be a crucial member of a large ransomware operation.

The names of the two suspects who were arrested have not been released. The Record reported that officials declined to name the suspect’s affiliation to any particular ransomware gang, citing an ongoing investigation. That information came from a Europol spokesperson.

It seems to me that this investigation is just beginning, and that Europol (and the rest of the assisting law enforcement agencies) are intending to continue their efforts. If the agencies are able to determine who else was involved in these crimes, I hope that those people face whatever legal consequences are appropriate.

Syniverse Was Hacked in 2016

Hacker,

Have you heard of Syniverse? In short, it provides a service that works in the background and enables people to use their smartphones to call or text their friends and families. That’s exactly why it is a very big deal that Syniverse got hacked.

According to Vice, Syniverse is a critical part of the global telecommunication infrastructure used by AT&T-Movile, Verizon, Vodafone, China Mobile and others.

In a Filings Report with the U.S. Security and Exchange Commission, Syniverse pointed out that it had been hacked in 2016. Here is a small portion of that section of the report:

…For example, in May of 2021, Syniverse became aware of unauthorized access to its operational and information technology servers by an unknown individual or organization… Promptly, upon Syniverse’s detection of the unauthorized access, Syniverse launched an internal investigation, notified law enforcement, commenced remedial actions and engaged the services of specialized legal counsel and other incident response professionals. Syniverse has conducted a thorough investigation of the incident.

The results of the investigation revealed that the unauthorized access began on May 2016. Syniverse’s investigation revealed that the individual or organization gained unauthorized access to databases within its network on several occasions, and that login information allowing access to or from its Electronic Data Transfer (EDT) environment was compromised for approximately 235 of its customers…

Daring Fireball pointed out that 235 customers doesn’t sound like a lot. But then realized that Syniverse’s “customers” are carriers, not people. Another problem pointed out on Daring Fireball was that Syniverse discovered the data breach in May of 2021, but the hack began in May of 2016.

It seems to me that it is possible that a lot of people’s data and information could have been stolen and used for nefarious purposes. This is really bad. I think Syniverse should have publicly mentioned the data breach years ago, instead of attempting to quietly let their investors know about it in 2021.

“Gigabites of Data” Accessed from Web Host Epik

Hacker, ,

You may have heard of Epik (the web host – not Epic the gaming company). According to Gizmodo, Epik the web host and domain registrar provides services to Gab, Parler, and Bitchute (which Gizmodo described as “conspiracy-theory-laden YouTube wannabe), and The Donald (a President Trump fansite).

Epik also recently hosted the Texas whistleblower website – which was intended to allow people to “snitch on Texas residents who want abortions.” Gizmodo reported that Epic forcibly removed the Texas site from the platform after determining it had violated Epik’s terms by non-consensually collecting third-party information.

Those sites seem to end up on Epik after breaking the terms of services of whatever mainstream hosting company they started with.

TechCrunch reported that hackers associated with the hacktivist collective Anonymous say they have leaked gigabytes of data from Epik. The hackers did not say how they obtained the breached data or when the hack took place. TechCrunch says that, according to time stamps, the most recent files suggest the hack “most likely” happened in late February.

It appears that the hackers have now released the information that was in the Epik data breach. TechCrunch reported what was in the data breach, based on a statement from the hackers.

What kind of information was in the data breach? TechCrunch reported that a statement was sent to a torrent file of the dumped data this week. It included a “decades worth” of company data, including “all that’s needed to trace actual ownership and management” of the company. The hackers claimed to have customer payment histories, domain purchases and transfers, passwords, credentials and employee mailboxes.

According to TechCrunch, Epik initially told reporters it was unaware of a breach but an email set out by founder and chief executive Robert Monster on Wednesday altered users to an “alleged security incident.” To me, it sounds like the damage had already been done before users were alerted to it by email.

This is a really good example of why you need to be absolutely certain that the web host that is hosting your content is a reliable one.