#security
Criminal group Opera1er stole more than $11 million from banks and telecoms
Group-IB experts spoke about the French-speaking group Opera1er, which has existed since 2016. Between 2018 and 2022, these hackers stole at least $11 million from banks and telecommunications providers in Africa, Asia and Latin America, and the actual damage from these attacks is estimated at $30 million.
Criminal group Opera1er stole more than $11 million from banks and telecoms
Group-IB experts spoke about the French-speaking group Opera1er, which has existed since 2016. Between 2018 and 2022, these hackers stole at least $11 million from banks and telecommunications providers in Africa, Asia and Latin America, and the actual damage from these attacks is estimated at $30 million.
#security
Updates for Google Chrome will be released weekly
The developers of the Chrome browser have decided to change the update schedule: now patches will be released not once every two weeks, but once a week. This step should improve the situation with the so-called patch gap, that is, too long a lack of fixes, due to which attackers get additional time to exploit n-day and 0-day vulnerabilities.
Updates for Google Chrome will be released weekly
The developers of the Chrome browser have decided to change the update schedule: now patches will be released not once every two weeks, but once a week. This step should improve the situation with the so-called patch gap, that is, too long a lack of fixes, due to which attackers get additional time to exploit n-day and 0-day vulnerabilities.
#security
Experts from the University of Wisconsin-Madison have discovered that in the Chrome Web Store can be uploaded extensions that can steal website passwords directly from their source code.
The researchers say the problem they discovered is related to the practice of allowing extensions unrestricted access to the DOM tree of the sites on which they are loaded. This allows you to access potentially sensitive elements, including user input fields.
Our comment:
// They "discovered" something that has been used by hackers for 15 years.
1. If you have a crypto wallet like MetaMask, then almost any website or browser extension can connect to it and brute force access.
2. And also almost any browser extension can change in the code your “Withdrawal Address” on the crypto exchange.
3. etc etc etc...
Experts from the University of Wisconsin-Madison have discovered that in the Chrome Web Store can be uploaded extensions that can steal website passwords directly from their source code.
The researchers say the problem they discovered is related to the practice of allowing extensions unrestricted access to the DOM tree of the sites on which they are loaded. This allows you to access potentially sensitive elements, including user input fields.
Our comment:
// They "discovered" something that has been used by hackers for 15 years.
1. If you have a crypto wallet like MetaMask, then almost any website or browser extension can connect to it and brute force access.
2. And also almost any browser extension can change in the code your “Withdrawal Address” on the crypto exchange.
3. etc etc etc...
#security
Apple has released emergency patches for two zero-day vulnerabilities.
Anyone who knew how to exploit CVE-2023-41061 could hack your iPhone and execute arbitrary code on it by simply sending you a picture in iMessage.
And as long as you have an iOS version lower than iOS 16.6.1, you are susceptible to this hack.
Apple is aware of a report that this issue may have been actively exploited.
// But someone had cryptocurrency wallets and exchange applications on the hacked phones...
Apple has released emergency patches for two zero-day vulnerabilities.
Anyone who knew how to exploit CVE-2023-41061 could hack your iPhone and execute arbitrary code on it by simply sending you a picture in iMessage.
And as long as you have an iOS version lower than iOS 16.6.1, you are susceptible to this hack.
Apple is aware of a report that this issue may have been actively exploited.
// But someone had cryptocurrency wallets and exchange applications on the hacked phones...
#security
MetaStealer malware targets macOS users
SentinelOne researchers have warned of the discovery of MetaStealer malware, which steals confidential information from computers running macOS based on Intel processors.
MetaStealer malware targets macOS users
SentinelOne researchers have warned of the discovery of MetaStealer malware, which steals confidential information from computers running macOS based on Intel processors.
#security
People often ask why the blog (mitElena.com) and the wallet itself (mitilena.com) are on different domains.
I answer, the blog operates on a public platform. There are third-party plugins and so on. It is more vulnerable to hacker attacks.
Therefore, to prevent your Cookies from being stolen from your wallet in the event of a possible blog hack, they are separated into different second-level domains.
People often ask why the blog (mitElena.com) and the wallet itself (mitilena.com) are on different domains.
I answer, the blog operates on a public platform. There are third-party plugins and so on. It is more vulnerable to hacker attacks.
Therefore, to prevent your Cookies from being stolen from your wallet in the event of a possible blog hack, they are separated into different second-level domains.
Two people in the United Kingdom created their own GSM antenna, which they used to send thousands of SMS messages on behalf of banks and financial institutions.
In what is thought to be the first of its kind in the UK, an illegitimate telephone mast is believed to have been used as an “SMS blaster” to send messages that bypass mobile phone networks’ systems in place to block suspicious text messages.
Huayong Xu, 32, of Alton Road, Croydon was charged on 23 May with possession of articles for use in fraud and was remanded in custody. He will appear at Inner London Crown Court on 26 June. The other arrested person was bailed.
#security
In what is thought to be the first of its kind in the UK, an illegitimate telephone mast is believed to have been used as an “SMS blaster” to send messages that bypass mobile phone networks’ systems in place to block suspicious text messages.
Huayong Xu, 32, of Alton Road, Croydon was charged on 23 May with possession of articles for use in fraud and was remanded in custody. He will appear at Inner London Crown Court on 26 June. The other arrested person was bailed.
#security
Dozens of vulnerabilities were found in ZKTeco biometric terminals (for access by face, QR code, and so on).
These biometric readers are widely used in a wide variety of industries around the world, from nuclear power plants and manufacturing to offices and healthcare organizations.
- Attackers can gain physical access to restricted areas
- A potential attacker can access any file on the system and extract it
- Attackers can upload their own data (for example, photos) to the database and add themselves to the list of authorized users
- Other groups of vulnerabilities allow arbitrary code to be executed on the device, giving attackers full control
#security
These biometric readers are widely used in a wide variety of industries around the world, from nuclear power plants and manufacturing to offices and healthcare organizations.
- Attackers can gain physical access to restricted areas
- A potential attacker can access any file on the system and extract it
- Attackers can upload their own data (for example, photos) to the database and add themselves to the list of authorized users
- Other groups of vulnerabilities allow arbitrary code to be executed on the device, giving attackers full control
#security
#security_on_the_network_is_never_existent
Microsoft has fixed a vulnerability for Windows that allowed any code to be executed on a victim's computer without the victim's knowledge. All versions with ipv6 enabled (which everyone has) since Windows Vista were vulnerable.
All a hacker had to do was simply send certain packets to the target computer and hack into it. The difficulty of using this hack was low.
In simple words: whatever antivirus you have had for the last 15 years, whatever the latest Windows updates have been installed. Anyone who knew about this hack could hack you remotely over the internet.
It's a fiasco.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063
Microsoft has fixed a vulnerability for Windows that allowed any code to be executed on a victim's computer without the victim's knowledge. All versions with ipv6 enabled (which everyone has) since Windows Vista were vulnerable.
All a hacker had to do was simply send certain packets to the target computer and hack into it. The difficulty of using this hack was low.
In simple words: whatever antivirus you have had for the last 15 years, whatever the latest Windows updates have been installed. Anyone who knew about this hack could hack you remotely over the internet.
It's a fiasco.
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063
#security
GitHub Enterprise have found a vulnerability that allows access to companies' account and private source code
‘In GitHub Enterprise Server instances using SAML SSO authentication with specific identity providers that apply publicly available signed federated XML metadata, an attacker could spoof a SAML response to grant or gain access to a user account with administrator privileges,’ GitHub reports.
https://www.cve.org/cverecord?id=CVE-2024-6800
GitHub Enterprise have found a vulnerability that allows access to companies' account and private source code
‘In GitHub Enterprise Server instances using SAML SSO authentication with specific identity providers that apply publicly available signed federated XML metadata, an attacker could spoof a SAML response to grant or gain access to a user account with administrator privileges,’ GitHub reports.
https://www.cve.org/cverecord?id=CVE-2024-6800