2014, DNS and Passwords - Cyber Security Informer

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

Krebs on Security

FEBRUARY 18, 2019

government — along with a number of leading security companies — recently warned about a series of highly complex and widespread attacks that allowed suspected Iranian hackers to siphon huge volumes of email passwords and other sensitive data from multiple governments and private companies. PASSIVE DNS.

DNS

DNS Internet Internet Government

Linksys force password reset to prevent Router hijacking

Security Affairs

APRIL 16, 2020

Linksys has reset passwords for all its customers’ after learning on ongoing DNS hijacking attacks aimed at delivering malware. Hackers compromise D-Link and Linksys routers and change DNS settings to redirect users to bogus sites proposing a fake COVID-19 information app from the World Health Organization.

Passwords

Passwords DNS Malware Advertising

NCSC report warns of DNS Hijacking Attacks

Security Affairs

JULY 14, 2019

The UK’s National Cyber Security Centre (NCSC) issued a security advisory to warn organizations of DNS hijacking attacks and provided recommendations this type of attack. In response to the numerous DNS hijacking attacks the UK’s National Cyber Security Centre (NCSC) issued an alert to warn organizations of this type of attack.

DNS

DNS Social Engineering Accountability Advertising

DHS issues emergency Directive to prevent DNS hijacking attacks

Security Affairs

JANUARY 23, 2019

DHS has issued a notice of a CISA emergency directive urging federal agencies of improving the security of government-managed domains (i.e.gov) to prevent DNS hijacking attacks. The notice was issued by the DHS and links the emergency directive Emergency Directive 19-01 titled “Mitigate DNS Infrastructure Tampering.”.

DNS

DNS Government Telecommunications Advertising

Alleged Iran-linked APT groups behind global DNS Hijacking campaign

Security Affairs

JANUARY 10, 2019

Security expert uncovered a DNS hijacking campaign targeting organizations in various industries worldwide and suspects Iranian APT groups. It is interesting to note that FireEye confirmed that this campaign is different from other operations carried out by Iranian APT groups due to the use of DNS hijacking at scale.

DNS

DNS Telecommunications Government Encryption

Some Zyxel devices can be hacked via DNS requests

Security Affairs

SEPTEMBER 4, 2019

Experts at SEC Consult discovered several security issues in various Zyxel devices that allow to hack them via unauthenticated DNS requests. The first issue is an information disclosure flaw via unauthenticated external DNS requests that affect Zyxel devices from the USG, UAG, ATP, VPN and NXC series. Pierluigi Paganini.

DNS

DNS Hacking Firmware Wireless

Who’s Behind the Botnet-Based Service BHProxies?

Krebs on Security

FEBRUARY 24, 2023

The account didn’t resume posting on the forum until April 2014. Shotliff said he sold his BHProxies account to another Black Hat World forum user from Egypt back in 2014. He also shared a PayPal receipt and snippets of Facebook Messenger logs showing conversations in March 2014 with legendboy2050@yahoo.com. com on Mar.

Accountability

Accountability Advertising Marketing Malware

For nearly a year, Brazilian users have been targeted with router attacks

Security Affairs

JULY 13, 2019

The campaign uncovered by Avast aimed at silently modifying the Brazilian users’ Domain Name System (DNS) settings to redirect victims to malicious websites mimicking legitimate ones. “ Malware then guesses routers’ passwords , which new research from Avast shows are often weak. ” states the analysis published by Avast.

DNS

DNS Passwords Advertising Banking

Hackers hijack D-Link and Linksys routers to point users to coronavirus-themed sites serving malware

Security Affairs

MARCH 26, 2020

Hackers compromiseD -Link and Linksys routers and change DNS settings to redirect users to bogus sites proposing a fake COVID-19 information app from the World Health Organization. Experts from BleepingComputer reported that attackers would change the configured DNS servers to 109 [. 234.35.230 and 94 [. 103.82.249. com winimage.com.

Malware

Malware DNS Advertising Cryptocurrency

GhostDNS malware already infected over 100K+ devices and targets 70+ different types of home routers

Security Affairs

OCTOBER 1, 2018

Attackers have already hijacked over 100,000 home routers, the malicious code allows to modify DNS settings to hijack the traffic and redirect users to phishing websites. GhostDNS reminds us of the infamous DNSChanger malware that made the headlines for its ability to change DNS settings on the infected device. Pierluigi Paganini.

DNS

DNS Malware Firmware Phishing

The hacker behind Matrix.org hack offers advice to improve security

Security Affairs

APRIL 12, 2019

On Thursday, Matrix.org warned users of the security breach, a hacker gained unauthorized access to the production databases, including unencrypted message data, access tokens, and also password hashes. As a precaution, if you’re a matrix.org user you should change your password now.” ” continues Matrix.org.

Hacking

Hacking DNS Passwords Data breaches

Iran-linked APT34: Analyzing the webmask project

Security Affairs

APRIL 23, 2019

Security expert Marco Ramilli published the findings of a quick analysis of the webmask project standing behind the DNS attacks implemented by APT34 (aka OilRig and HelixKitten ). Contest: Since at least 2014, an Iranian threat group tracked by FireEye as APT34 has conducted reconnaissance aligned with the strategic interests of Iran.

DNS

DNS Computers and Electronics Penetration Testing Government

French Firms Rocked by Kasbah Hacker?

Krebs on Security

MARCH 2, 2020

HYAS said it quickly notified the French national computer emergency team and the FBI about its findings, which pointed to a dynamic domain name system (DNS) provider on which the purveyors of this attack campaign relied for their various malware servers. In this two-hour Arabic language YouTube tutorial from 2014 , Fatal.001

DNS

DNS Penetration Testing Malware Hacking

Recent Roaming Mantis campaign hit hundreds of users worldwide

Security Affairs

APRIL 8, 2019

Attackers used a new method of phishing with malicious mobile configurations along with previously observed DNS manipulation technique. In late February 2019, experts detected a URL query of a malicious DNS changer that attackers used to compromise router DNS settings. Pierluigi Paganini.

DNS

DNS Mobile Phishing Malware

One of the hackers behind EtherDelta hack also involved in TalkTalk hack

Security Affairs

SEPTEMBER 21, 2019

In December 2017, the popular cryptocurrency exchange EtherDelta was hacked, attackers conducted a DNS attack that allowed to steal at least 308 ETH ($266,789 at the time of the hack) as well as a large number of tokens. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Hacking

Hacking DNS Cryptocurrency Accountability

Lyceum APT made the headlines with attacks in Middle East

Security Affairs

AUGUST 27, 2019

Lyceum was observed using password spraying and brute-force attacks to compromise email accounts of targeted individuals. “LYCEUM initially accesses an organization using account credentials obtained via password spraying or brute-force attacks. The malware uses DNS and HTTP-based communication mechanisms.

DNS

DNS Passwords Penetration Testing Social Engineering

Massive increase in XorDDoS Linux malware in last six months

Malwarebytes

MAY 25, 2022

XorDDoS, a Linux Trojan known for its modularity and stealth, was first discovered in 2014 by the white hat research group, MalwareMustDie (MMD). Microsoft says it’s recorded a massive increase in XorDDoS activity (254 percent) in the last six months. MMD believed the Linux Trojan originated in China.

Malware

Malware IoT DDOS DNS

Some models of Comba and D-Link WiFi routers leak admin credentials

Security Affairs

SEPTEMBER 11, 2019

change DNS settings to hijack the traffic, perform MitM attacks). While analyzing the dual-band D-Link DSL-2875AL wireless router, the expert discovered that a file located at https : //[router ip address ] /romfile.cfg contains the login password of the device in plaintext. ” reads the security advisory. download=true.

DNS

DNS Passwords Authentication Advertising

Backdoored Webmin versions were available for download for over a year

Security Affairs

AUGUST 19, 2019

It allows users using web browsers to set up user accounts, Apache, DNS, file sharing and much more. The flaw affects the procedure for changing expired passwords, the backdoor could be exploited by a remote attacker to execute malicious commands with root privileges on the machine running vulnerable Webmin. .”

Passwords

Passwords System Administration Advertising DNS

FBI warns cyber actors abusing protocols as new DDoS attack vectors

Security Affairs

JULY 27, 2020

According to our estimate, CoAP can reach up to 32 times (32x) amplification factor, which is roughly between the amplification power of DNS and SSDP.”. Change the default username and passwords for all network devices, especially IoT devices. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

DDOS

DDOS IoT Internet Internet

Security firm accidentally exposed an unprotected database with 5 Billion previously leaked records

Security Affairs

MARCH 22, 2020

. “On March 16th I have found an unprotected and thus publicly available Elasticsearch instance which appeared to be managed by a UK-based security company, according to the SSL certificate and reverse DNS records.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Adobe, Last.

Data breaches

Data breaches Advertising DNS Engineering

Russia-linked APT28 has been scanning vulnerable email servers in the last year

Security Affairs

MARCH 20, 2020

Trend Micro investigated waves of the APT28’s targeted credential phishing attacks and collected thousands of email samples sent out by the group since 2014. “Their attacks, which range from compromising DNS set tings and tabnabbing to creating watering holes and taking advantage of zero-days, have been nothing short of sophisticated.

Phishing

Phishing Accountability Advertising DNS

Security Affairs newsletter Round 230

Security Affairs

SEPTEMBER 8, 2019

Some Zyxel devices can be hacked via DNS requests. Over 600k GPS trackers left exposed online with a default password of ‘123456. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. . Pierluigi Paganini.

IoT

IoT Data breaches Advertising DNS

Novidade, a new Exploit Kit is targeting SOHO Routers

Security Affairs

DECEMBER 11, 2018

The Novidade exploit kit leverages cross-site request forgery (CSRF) to change the Domain Name System (DNS) settings of SOHO routers and redirect traffic from the connected devices to the IP address under the control of the attackers. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

DNS

DNS Advertising Firmware Banking

Analyzing the APT34’s Jason project

Security Affairs

JUNE 6, 2019

According to FireEye, APT34 has been active since 2014. Distributed in a ZIP container (a copy is available here ) the interface is quite intuitive: the Microsoft exchange address and its version shall be provided (even if in the code a DNS-domain discovery mode function is available). Original Leak. Edited by Pierluigi Paganini.

Computers and Electronics

Computers and Electronics Penetration Testing DNS Passwords

Keepnet Labs accidentally exposed an unprotected database with 5 Billion previously leaked records

Security Affairs

MARCH 22, 2020

. “On March 16th I have found an unprotected and thus publicly available Elasticsearch instance which appeared to be managed by a UK-based security company, according to the SSL certificate and reverse DNS records.” ” ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Adobe, Last.

Data breaches

Data breaches Advertising DNS Engineering

Security Affairs newsletter Round 192 – News of the week

Security Affairs

DECEMBER 16, 2018

Hackers defaced Linux.org with DNS hijack. Which are the worst passwords for 2018? Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. A new Mac malware combines a backdoor and a crypto-miner. WordPress version 5.0.1

DNS

DNS Advertising DDOS Government

Dozens of Linksys router models leak data useful for hackers

Security Affairs

MAY 18, 2019

The issue discovered by the expert, in fact, could be used by attackers to discover if the vulnerable routers are still using default administrative passwords. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Wireless

Wireless IoT Advertising DNS

Security Affairs newsletter Round 223 – News of the week

Security Affairs

JULY 21, 2019

NCSC report warns of DNS Hijacking Attacks. Slack resetting passwords for roughly 1% of its users. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. The best news of the week with Security Affairs. Kindle Edition.

Small Business

Small Business Media Spyware DNS

Roboto, a new P2P botnet targets Linux Webmin servers

Security Affairs

NOVEMBER 21, 2019

It allows users using web browsers to set up user accounts, Apache, DNS, file sharing and much more. The flaw affects the procedure for changing expired passwords, the backdoor could be exploited by a remote attacker to execute malicious commands with root privileges on the machine running vulnerable Webmin. ” reads the analysis.

DDOS

DDOS System Administration Advertising DNS

Hacking the Twinkly IoT Christmas lights

Security Affairs

DECEMBER 24, 2018

The communications are not encrypted, however the WiFi password is sent encrypted during set up (albeit trivial to decrypt).” The experts demonstrated the remote management of the Twinkly lights carrying out the DNS rebinding attack technique. ’ ~ Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

IoT

IoT Hacking DNS Authentication

Security Affairs newsletter Round 209 – News of the week

Security Affairs

APRIL 14, 2019

DNS hijacking campaigns target Gmail, Netflix, and PayPal users. WPA3 attacks allow hackers to hack Wi-Fi password. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. The best news of the week with Security Affairs.

Data breaches

Data breaches Advertising DNS Surveillance

Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

Krebs on Security

JANUARY 8, 2024

As detailed in my 2014 book, Spam Nation , Spamdot was home to crooks controlling some of the world’s nastiest botnets, global malware contagions that went by exotic names like Rustock , Cutwail , Mega-D , Festi , Waledac , and Grum. I can not provide DNS for u, only domains.

Cybercrime

Cybercrime Banking Computers and Electronics DDOS

Why Malware Crypting Services Deserve More Scrutiny

Krebs on Security

JUNE 21, 2023

guru’s registration records also are hidden, yet passive domain name system (DNS) records for both cryptor[.]biz ” DomainTools shows this website was registered in 2008 to a Yuri Churnov from Sevastpol, Crimea (prior to Russia’s annexation of Crimea in 2014, the peninsula was part of Ukraine). ” Crypt[.]guru’s

Malware

Malware Antivirus Cybercrime Hacking

Winnti APT group uses skip-2.0 malware to control Microsoft SQL Servers

Security Affairs

OCTOBER 21, 2019

malware was used by threat actors to establish a backdoor in MSSQL Server 11 and 12 servers, allowing them to access to any account on the server using a “magic password.” Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Malware

Malware Passwords Advertising DNS

Security Affairs newsletter Round 210 – News of the week

Security Affairs

APRIL 21, 2019

Analyzing OilRigs malware that uses DNS Tunneling. Facebook admitted to have stored millions of Instagram users passwords in plaintext. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini.

Computers and Electronics

Computers and Electronics Data breaches Spyware Advertising

A month later Gamaredon is still active in Eastern Europe

Security Affairs

JUNE 4, 2019

The infection chain is composed by different stages of password protected SFX (self extracting archive), each containing vbs or batch scripts. Execution of “ winupd.exe ” (SFX) and relative password (uyjqystgblfhs). Information about C2 and relative DNS. This time using the string “ gblfhs ” as password. Malicious e-mail.

Passwords

Passwords DNS Engineering Malware

5 Common Phishing Attacks and How to Avoid Them?

Security Affairs

AUGUST 19, 2019

People fell prey for these manipulative emails and provide confidential details like passwords and bank information in their negligence. They ask you to make certain changes in your account by entering your login password or ask for some reconfirmation. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->.

Phishing

Phishing Accountability Authentication Passwords

Apple removed the popular app Adware Doctor because steals user browsing history

Security Affairs

SEPTEMBER 8, 2018

The expert discovered also that the gathered info was first stored in a password protected zip file named “history.zip”, then it would be uploaded to a remote server. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. — Privacy 1st (@privacyis1st) August 20, 2018. Pierluigi Paganini.

Adware

Adware DNS Malware Advertising

Security Affairs newsletter Round 175 – News of the week

Security Affairs

AUGUST 12, 2018

Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->. Pierluigi Paganini. Security Affairs – Newsletter ). The post Security Affairs newsletter Round 175 – News of the week appeared first on Security Affairs.

Advertising

Advertising DNS Firmware Surveillance

Chalubo, a new IoT botnet emerges in the threat landscape

Security Affairs

OCTOBER 23, 2018

Researchers noticed that the majority of code in bot is new, the authors focused on their own Lua handling for launching DoS attacks with DNS, UDP, and SYN flavours. To mitigate the threat, experts recommend that sysadmins of SSH servers, including IoT devices, change any default passwords on those systems. Pierluigi Paganini.

IoT

IoT DDOS Malware Architecture

Nigerian Tesla: 419 scammer gone malware distributor unmasked

Malwarebytes

MAY 5, 2022

Agent Tesla is a well-known data stealer written in.NET that has been active since 2014 and is perhaps one of the most popular payloads observed in malspam campaigns. Based on these profiles, we can see this threat actor has an extensive criminal record starting at least from 2014. hackforums.net exploit.in titan.email (.pw

Malware

Malware Scams Phishing Accountability

New XBash malware combines features from ransomware, cryptocurrency miners, botnets, and worms

Security Affairs

SEPTEMBER 17, 2018

The scanner component also scans the Internet for servers that run services that have been left online exposed without a password or are using weak credentials. Copyright (C) 2014-2015 Media.net Advertising FZ-LLC All Rights Reserved -->. Copyright (C) 2014 Media.net Advertising FZ-LLC All Rights Reserved -->.

Cryptocurrency

Cryptocurrency Malware Ransomware Cybercrime

The Hacker Mind: Shellshock

ForAllSecure

MARCH 24, 2021

Anyway I was testing this suite when I happened to randomly strike two keys -- I think it was control and B -- and up popped the password manager, displaying all my test passwords in the clear. Thing was, the manager required its own password, which I had not entered; remember, I had hit only two keys. This was a software flaw.

Software

Software Passwords Internet Internet

A Deep Dive on the Recent Widespread DNS Hijacking Attacks

Linksys force password reset to prevent Router hijacking

Trending Sources

NCSC report warns of DNS Hijacking Attacks

DHS issues emergency Directive to prevent DNS hijacking attacks

Alleged Iran-linked APT groups behind global DNS Hijacking campaign

Some Zyxel devices can be hacked via DNS requests

Who’s Behind the Botnet-Based Service BHProxies?

For nearly a year, Brazilian users have been targeted with router attacks

Hackers hijack D-Link and Linksys routers to point users to coronavirus-themed sites serving malware

GhostDNS malware already infected over 100K+ devices and targets 70+ different types of home routers

The hacker behind Matrix.org hack offers advice to improve security

Iran-linked APT34: Analyzing the webmask project

French Firms Rocked by Kasbah Hacker?

Recent Roaming Mantis campaign hit hundreds of users worldwide

One of the hackers behind EtherDelta hack also involved in TalkTalk hack

Lyceum APT made the headlines with attacks in Middle East

Massive increase in XorDDoS Linux malware in last six months

Some models of Comba and D-Link WiFi routers leak admin credentials

Backdoored Webmin versions were available for download for over a year

FBI warns cyber actors abusing protocols as new DDoS attack vectors

Security firm accidentally exposed an unprotected database with 5 Billion previously leaked records

Russia-linked APT28 has been scanning vulnerable email servers in the last year

Security Affairs newsletter Round 230

Novidade, a new Exploit Kit is targeting SOHO Routers

Analyzing the APT34’s Jason project

Keepnet Labs accidentally exposed an unprotected database with 5 Billion previously leaked records

Security Affairs newsletter Round 192 – News of the week

Dozens of Linksys router models leak data useful for hackers

Security Affairs newsletter Round 223 – News of the week

Roboto, a new P2P botnet targets Linux Webmin servers

Hacking the Twinkly IoT Christmas lights

Security Affairs newsletter Round 209 – News of the week

Meet Ika & Sal: The Bulletproof Hosting Duo from Hell

Why Malware Crypting Services Deserve More Scrutiny

Winnti APT group uses skip-2.0 malware to control Microsoft SQL Servers

Security Affairs newsletter Round 210 – News of the week

A month later Gamaredon is still active in Eastern Europe

5 Common Phishing Attacks and How to Avoid Them?

Apple removed the popular app Adware Doctor because steals user browsing history

Security Affairs newsletter Round 175 – News of the week

Chalubo, a new IoT botnet emerges in the threat landscape

Nigerian Tesla: 419 scammer gone malware distributor unmasked

New XBash malware combines features from ransomware, cryptocurrency miners, botnets, and worms

The Hacker Mind: Shellshock

Stay Connected