security – Page 135

A Hacker Just Pwned Over 150,000 Printers Exposed Online

Last year an attacker forced thousands of unsecured printers to spew racist and anti-semitic messages. But this year’s attack is even bigger. An anonymous reader writes: A grey-hat hacker going by the name of Stackoverflowin has pwned over 150, 000 printers that have been left accessible online. For the past 24 hours, Stackoverflowin has been running an automated script that searches for open printer ports and sends a rogue print job to the target’s device. The script targets IPP (Internet Printing Protocol) ports, LPD (Line Printer Daemon) ports, and port 9100 left open to external connections. From high-end multi-functional printers at corporate headquarters to lowly receipt printers in small town restaurants, all have been affected. The list includes brands such as Afico, Brother, Canon, Epson, HP, Lexmark, Konica Minolta, Oki, and Samsung. The printed out message included recommendations for printer owners to secure their device. The hacker said that people who reached out were very nice and thanked him. The printers apparently spew out an ASCII drawing of a robot, along with the words “stackoverflowin the hacker god has returned. your printer is part of a flaming botnet… For the love of God, please close this port.” The messages sometimes also include a link to a Twitter feed named LMAOstack. Read more of this story at Slashdot.

Taken from:
A Hacker Just Pwned Over 150,000 Printers Exposed Online

Russia Arrests Top Kaspersky Hacking Investigator for Treason

Under mysterious circumstances, Russia has arrested Ruslan Stoyanov, head of computer incidents investigations unit at the huge cybersecurity firm at Kaspersky. He’s been charged with treason. Read more…

Original post:
Russia Arrests Top Kaspersky Hacking Investigator for Treason

Ransomware Infects All St Louis Public Library Computers

An anonymous reader quotes a report from The Guardian: Libraries in St Louis have been bought to a standstill after computers in all the city’s libraries were infected with ransomware, a particularly virulent form of computer virus used to extort money from victims. Hackers are demanding $35, 000 (£28, 000) to restore the system after the cyberattack, which affected 700 computers across the Missouri city’s 16 public libraries. The hackers demanded the money in electronic currency bitcoin, but, as CNN reports, the authority has refused to pay for a code that would unlock the machines. As a result, the library authority has said it will wipe its entire computer system and rebuild it from scratch, a solution that may take weeks. On Friday, St Louis public library announced it had managed to regain control of its servers, with tech staff continuing to work to restore borrowing services. The 16 libraries have all remained open, but computers continue to be off limits to the public. Spokeswoman Jen Hatton told CNN that the attack had hit the city’s schoolchildren and its poor worst, as many do not have access to the internet at home. “For many we’re their only access to the internet, ” she said. “Some of them have a smartphone, but they don’t have a data plan. They come in and use the wifi.” As well as causing the loans system to seize up, preventing borrowers from checking out or returning books, the attack froze all computers, leaving no one able to access the four million items that should be available through the service. The system is believed to have been infected through a centralized computer server, and staff emails have also been frozen by the virus. The FBI has been called in to investigate. Read more of this story at Slashdot.

Continue reading here:
Ransomware Infects All St Louis Public Library Computers

Virulent Android malware returns, gets >2 million downloads on Google Play

Enlarge (credit: portal gda ) A virulent family of malware that infected more than 10 million Android devices last year has made a comeback, this time hiding inside Google Play apps that have been downloaded by as many as 12 million unsuspecting users. HummingWhale, as the professionally developed malware has been dubbed, is a variant of HummingBad, the name given to a family of malicious apps researchers documented in July invading non-Google app markets . HummingBad attempted to override security protections by exploiting unpatched vulnerabilities that gave the malware root privileges in older versions of Android. Before Google shut it down, it installed more than 50,000 fraudulent apps each day, displayed 20 million malicious advertisements, and generated more than $300,000 per month in revenue. Of the 10 million people who downloaded HummingBad-contaminated apps, an estimated 286,000 of them were located in the US. HummingWhale, by contrast, managed to sneak its way into about 20 Google Play apps that were downloaded from 2 million to 12 million times, according to researchers from Check Point, the security company that has been closely following the malware family for almost a year. Rather than rooting devices, the latest variant includes new virtual machine techniques that allow the malware to perform ad fraud better than ever, company researchers said in a blog post published Monday . Read 6 remaining paragraphs | Comments

Visit link:
Virulent Android malware returns, gets >2 million downloads on Google Play

Australia to Replace Passports With Biometric Tech

In a move that sounds convenient and a little terrifying, international travelers to Australia may not need a passport by 2020. Officials say that the country is implementing a system to replace the standard paper ID with biometric technology that recognizes faces, irises and/or fingerprints. Read more…

Krebs pinpoints the likely author of the Mirai botnet

The Mirai botnet caused serious trouble last fall, first hijacking numerous IoT devices to make a historically massive Distributed Denial-Of-Service (DDoS) attack on KrebsOnSecurity’s site in September before taking down a big chunk of the internet a month later. But who’s responsible for making the malware? After his site went dark, security researcher Brian Krebs went on a mission to identify its creator, and he thinks he has the answer : Several sources and corroborating evidence point to Paras Jha, a Rutgers University student and owner of DDoS protection provider Protraf Solutions. About a week after attacking the security site, the individual who supposedly launched the attack, going by the username Anna Senpai, released the source code for the Mirai botnet, which spurred other copycat assaults. But it also gave Krebs the first clue in their long road to uncover Anna Senpai’s real-life identity — an investigation so exhaustive, the Krebs made a glossary of cross-referenced names and terms along with an incomplete relational map . The full story is admittedly lengthy, clocking in at over 8000 words, but worth the time to understand how botnet wranglers make money siccing their zombie device armies on unsuspecting targets. The sources that pointed Krebs to Anna Senpai’s identity were involved in using botnets on behalf of shadowy clients, unleashing them on security companies protecting lucrative Minecraft servers that host thousands of players. When their online gaming is obstructed — say, by repeated and annoying DDoS attacks — players leave, giving servers an incentive to jump ship to whichever security provider can ensure protection…in this case, providers that arranged for the botnet attacks in the first place. According to Krebs’ source, his security site was looped into the botnet war after it revealed information in early September leading to the arrest of the two hackers behind the Israeli ‘vDos’ attack service. Anna Senpai was allegedly paid to unleash Mirai on the KrebsOnSecurity site by vengeful clients who’d used the now-defunct vDos, cementing the security firm’s interest. Source: KrebsOnSecurity

See original article:
Krebs pinpoints the likely author of the Mirai botnet

It’s shockingly easy to hijack a Samsung SmartCam camera

Enlarge Smart cameras marketed under the Samsung brand name are vulnerable to attacks that allow hackers to gain full control, a status that allows the viewing of what are supposed to be private video feeds, researchers said. The remote code-execution vulnerability has been confirmed in the Samsung SmartCam SNH-1011, but the researchers said they suspect other models in the same product line are also susceptible. The flaw allows attackers to inject commands into a Web interface built into the devices. The bug resides in PHP code responsible for updating a video monitoring system known as iWatch. It stems from the failure to properly filter malicious input included in the name of uploaded files. As a result, attackers who know the IP address of a vulnerable camera can exploit the vulnerability to inject commands that are executed with unfettered root privileges. “The iWatch Install.php vulnerability can be exploited by crafting a special filename which is then stored within a tar command passed to a php system() call,” the researchers wrote in a blog post published to the Exploitee.rs website. “Because the webserver runs as root, the filename is user supplied, and the input is used without sanitization, we are able to inject our own commands within the achieve root remote command execution.” Read 5 remaining paragraphs | Comments

Hackers Corrupt Data For Cloud-Based Medical Marijuana System

Long-time Slashdot reader t0qer writes: I’m the IT director at a medical marijuana dispensary. Last week the point of sales system we were using was hacked… What scares me about this breach is, I have about 30, 000 patients in my database alone. If this company has 1, 000 more customers like me, even half of that is still 15 million people on a list of people that “Smoke pot”… ” No patient, consumer, or client data was ever extracted or viewed, ” the company’s data directory has said. “The forensic analysis proves that. The data was encrypted — so it couldn’t have been viewed — and it was never extracted, so nobody has it and could attempt decryption.” They’re saying it was a “targeted” attack meant to corrupt the data rather than retrieve it, and they’re “reconstructing historical data” from backups, though their web site adds that their backup sites were also targeted. “In response to this attack, all client sites have been migrated to a new, more secure environment, ” the company’s CEO announced on YouTube Saturday, adding that “Keeping our client’s data secure has always been our top priority.” Last week one industry publication had reported that the outage “has sent 1, 000 marijuana retailers in 23 states scrambling to handle everything from sales and inventory management to regulatory compliance issues.” Read more of this story at Slashdot.

Read the original:
Hackers Corrupt Data For Cloud-Based Medical Marijuana System

Hacker Steals 900 GB of Cellebrite Data

An anonymous reader shares a Motherboard report: Motherboard has obtained 900 GB of data related to Cellebrite, one of the most popular companies in the mobile phone hacking industry. The cache includes customer information, databases, and a vast amount of technical data regarding Cellebrite’s products. The breach is the latest chapter in a growing trend of hackers taking matters into their own hands, and stealing information from companies that specialize in surveillance or hacking technologies. Cellebrite is an Israeli company whose main product, a typically laptop-sized device called the Universal Forensic Extraction Device (UFED), can rip data from thousands of different models of mobile phones. That data can include SMS messages, emails, call logs, and much more, as long as the UFED user is in physical possession of the phone. Read more of this story at Slashdot.

Read this article:
Hacker Steals 900 GB of Cellebrite Data

FDA warns that certain pacemakers are vulnerable to hacking

According to a cybersecurity notice from the Food and Drug Administration, certain pacemakers and cardiac devices are currently vulnerable to hacking. Although security researchers have warned about the security risks to medical devices for years now , this is the first time we’ve seen the government publicly acknowledge a specific threat. The vulnerable devices included under the FDA’s warning are not the pacemakers themselves, but rather the Merlin@home Transmitters made by St. Jude Medical. The transmitters are part of a home monitor that connects to pacemakers and other implanted cardiac devices using a wireless RF signal. The Merlin is designed to read the data stored on a pacemaker and then upload that data to its own cloud on the Merlin.net Patient Care Network, where a physician can access and monitor the device and the patient’s health. Although it doesn’t mention specifics of the threat, the government acknowledges that Merlin monitors could be hacked to send modified commands to a patient’s pacemaker or other device. With the right access, a hacker could do anything from deplete a pacemaker’s battery to shocking a patient or throwing off their heartbeat. On the bright side, the FDA says there have been no reported hacks and no patients have been harmed so far. To fix the problem, a software patch will be automatically applied over-the-air to affected Merlin@home devices starting today. Patients or their caregivers only need to ensure the devices are online and connected to get the fix. Source: FDA , St. Jude Medical

Original post:
FDA warns that certain pacemakers are vulnerable to hacking

Ken May

Tag: security