Hacking, Security & Privacy - Page 8

The hacking collective Anonymous has taken to YouTube to announce that its declaring war against the creators of one of the most popular NFT projects, the Bored Ape Yacht Club.

Anonymous released the above video onto its YouTube channel on September 27, and in the almost 9-minute long video, the hacking collective accuses the creators of the Bored Ape Yacht Club NFT project, Yuga Labs, of including "esoteric" Nazi, white supremacist, and pedophilic symbolism throughout its designs. These accusations aren't necessarily surprising, as Yuga Labs has previously denied any intentional inclusion of artistry that represents the aforementioned groups or ideologies.

Futurism reports that the accusations originally began with digital artist Ryder Ripps who published a website that connected symbols within some of the Bored Ape Yacht Club designs with Nazi symbolism. These allegations were seemingly picked up by Anonymous, which the hacking collective states in the above video it has found proof "beyond a shadow of a doubt" that Yuga Labs intentionally includes elusive Nazi symbolism within its digital art projects.

Hackers have infiltrated both Apple News and the business magazine Fast Company to send out an extremely offensive message to Apple News users.

The message, which has been reposted online in a censored and uncensored format, was confirmed to be a result of a hack, which was verified by both Apple News and Fast Company via Twitter. Apple News wrote on Twitter that an "incredibly offensive alert was sent by Fast Company", which was hacked, and that Apple has since disabled their channel. Fast Company wrote on Twitter that its Apple News account became compromised on Tuesday evening and that two "obscene and racist push notifications were sent about a minute apart".

Following up in more tweets, Fast Company clarified that its content management system (CMS) was hacked on Tuesday evening and which gave the hackers access to Fast Company's Apple News push notifications. The business magazine has stated that it launched an investigation into the situation and that its temporarily shut down FastCompany.com until the situation is completely resolved.

As part of the hacking collective Anonymous' operation against the Iranian government, it has claimed it has hacked the National Bank of Iran.

On Tuesday, a hacktivist collective claimed responsibility for the hacking of several Iranian government websites, including the website of the Central Bank of Iran. A member of the Anonymous hacking collective posted on Twitter on the same day as the attack, writing, "We are here with you. The operations against Iran began. Wait for us." Notably, two of the Iranian government websites, along with several other Iranian government-affiliated website, were brought down, coming back online a few hours later.

More specifically, one of the websites that was targeted by Anonymous was responsible for publishing government news and interviews with Iranian officials, and according to a social media account affiliated with the Anonymous hacking collective, "All database has been deleted". The hacking happened amid large-scale anti-government protests erupting in central Tehran, Iran's capital, and many Iranian cities and towns. These protests began on Friday last week when 22-year-old Kurdish woman Mahsa Amini who was wounded and arrested a week ago by the Islamic Republic's hijab police.

TikTok is facing many questions regarding its data security after rumors began circulating about its source code becoming comprised.

Bloomberg reported that several cyber security analysts took to Twitter on Monday to inform the public about a potential security breach in TikTok's source code. This security breach was traced to TikTok's data storage that the analysts claim contained personal account information on users, which led them to deem the purported breach a "high-severity vulnerability". The security breach was found in TikTok's Android application and would have allowed attackers to "comprise users' accounts with a single click".

On September 3 posts surfaced on the Breach Forums message board where a hacker wrote that the server contains 2.05 billion records in a humongous 790GB database. Followed by these rumors was a tweet from hacking group BlueHornet, who has seemingly had their account suspended by Twitter after this story gained traction. The tweet read, "Who would have thought that TikTok would decide to store all their internal backend source code on one Alibaba Cloud instance using a trashy password?".

Reports indicate that several Russian soldiers have been baited by hackers using fake accounts of attractive women.

A new report from the Financial Times delves into a group of hackers called Hackyourmom that was founded by Nikita Knysh, a 30-year-old IT professional from Kharkiv, a northeastern city in Ukraine. Knysh informed the publication that he wanted to assist his country with the invasion and decided to form a group that consists of thirty hackers from various locations across Ukraine.

The founder of the group stated that last month he and his fellow hackers were able to gather the locations of several Russian soldiers in Melitopol by pretending to be attractive women on several social media platforms. The hackers communicated with Russian soldiers for quite some time, eventually convincing them to send photos of them on the front line, which immediately gave the hackers enough information to discern an approximate location.

Hackers have disrupted the flow of traffic in Moscow, Russia, by ordering dozens of taxis to what is originally considered to be a lightly trafficked road.

VICE reports that the ground of hackers infiltrated the ride-hailing app Yandex Taxi to order taxis to Kutuzov Prospect in Moscow on Thursday. The hacking was confirmed by a Yandex spokesperson who said that on the morning of September 1, the ride-hailing service detected a hacking attempt that sent several dozen taxi drivers an order to fill in the Fili district of Moscow. Notably, the Fili district is right outside of Moscow city center and is a typical road used to enter the city center.

Moscow is no stranger to traffic jams, as the city ranks as one of the worst in the world for traffic jams. Additionally, the Yandex spokesperson said that the initial security breach was fixed in less than an hour and that improvements have been made to the system to prevent future attacks. On September 3, the Anonymous TV Twitter account, an account affiliated with the notorious hacking group Anonymous, took to Twitter to "confirm" that Anonymous carried out the attack on the Yandex Taxi in cooperation with the IT Army of Ukraine.

Twitter has been discovered to have a major flaw that has reportedly exposed account data of millions of users, including celebrities and companies.

A cybersecurity expert that goes by the name Zhirinovskiy took to the HackerOne forum in January to report a vulnerability within Twitter's login pipeline. According to the report, the vulnerability was a gaping hole within the platform's cybersecurity, and just within a few days, Zhirinovskiy was able to successfully infiltrate and discover Twitter accounts linked to specific numbers and email addresses. Zhirinovskiy explained that a malicious party could easily find an individual's Twitter account with a phone number or email address.

Zhirinovskiy contacted Twitter support about the security flaw, which was found in Twitter's Android app, and was rewarded a $5,040 bug bounty for the discovery. A patch was rolled out that fixed the major issue, but according to Restore Privacy, it was already too late as a malicious individual that uses the username "devil" had already exploited the flaw and scraped 5,485,636 Twitter accounts. The swath of data was then thrown onto the dark web hacking community forum 'Breached Forums', where the lister claimed that the data included users that "range from Celebrities to Companies, randoms, OGs, etc."

North Korea has stepped up its hacking game as cybersecurity firms drop warning about new never-before-seen malware that infects Gmail accounts.

According to reports, cybersecurity firm Volexity has detected North Korean hackers using simple browser extensions to gain access to individuals' Gmail accounts. The cybersecurity firm has warned that the malware is different from the usual "spear phishing" techniques that would require users to agree to download infected software, as the new malware is capable of downloading itself on an individual's PC without the user even knowing its happening.

Volexity wrote to Ars Technica and said that the malware is called SharpTounge and that it's currently only affecting Windows users. However, the cybersecurity firms President Steven Adair has warned that there is a big possibility of macOS and Linux users also being targeted. Reports indicate that the North Korean state likely backs the hacking group and that it targets users in the US, Europe, and South Korea who are working on topics involving North Korea.

You may have heard about the Vault 7 leaks from WikiLeaks back in 2017, where I was reporting about it back then... a cache of tools and exploits that the US government-funded CIA (Central Intelligence Agency) use to hack into everyone's computers, iPhones and Android devices, Samsung smart TVs and more.

Well, a jury in New York convicted 33-year-old ex-CIA engineer Joshua Schulte on 9 charges, which has now become the single largest leak in CIA history. Schulte worked inside of the Operations Support Branch (OSB) of the CIA, where he reportedly built hacking tools, turning prototypes that he was working on into real exploits that were capable of monitoring, or stealing information from the device that it was on.

Investigators secured evidence against Schulte through his own holes in his personal security, where the ex-CIA engineer stored the passwords for his accounts on his phones, and then investigators used that to access his encrypted storage.

A group of hackers have announced a digital war has begun on anti-abortion states with gigabytes of data already reportedly stolen.

The hacking group is called SiegedSec, and according to reports, in the past, has concentrated on stealing/destroying portions of user data held by private companies. The group announced on its Telegram that it will be launching attacks against government bodies and organizations that don't hold their pro-choice views. Notably, the group declared that they are "pro-choice" and "one shouldn't be denied access to abortion".

Adding to the announcement, the group said that it has already hacked government servers in Arkansas and Kentucky, claiming that they have already stolen approximately 8 gigabytes of data that contains government workers' personal information. Taking to Telegram, SiegedSec declared that the attacks will continue and that their targets are any "pro-life entities", which will include any government servers within states that have anti-abortion laws.

Virginia Beach Police Department (VBPD) officers have apprehended two men responsible for illegally accessing gas pumps and selling the gasoline for cheap.

Officers responded to suspicious activity at a closed Citgo gas station, where several vehicles and people had gathered and were pumping gasoline. Their investigation revealed that individuals used devices to allow them to pump gas of their own accord and sell it to others at a discounted rate.

The suspects responsible, by the names of Rashane Griffith and Devon Drumgoole, both from Norfolk, were charged with Grand Larceny, Conspiracy, and Possession of Burglary Tools. They advertised their operation on social media to potential customers, allowing them to come and purchase gas through a smartphone application.

US researcher Christopher Balding has said that he has evidence that China is siphoning data from Americans' smart coffee machines.

IoT home appliances have absolutely ballooned in popularity and use over the last few years, with Balding's new report at New Kite Data Labs adding that China spying on Americans through smart coffee machines isn't the worst of it -- it's the issue with the always-connected, connect-everything, Internet of Things future we're living in.

The data collection from coffee machines is part of a larger effort of China, and I'm sure many other countries -- all behind the US and its alphabet agencies of course -- with low security and data policies that aren't clear to most people. Balding said: "China is really collecting data on really just anything and everything. As a manufacturing hub of the world, they can put this capability in all kinds of devices that go out all over the world".

A paper on the Bluetooth signal tracking titled "Evaluating Physical-Layer BLE Location Tracking Attacks on Mobile Devices" was recently presented at the IEEE Security & Privacy conference in Oakland, California, on May 24th, 2022.

Researchers from the University of California San Diego have found Bluetooth Low Energy (BLE) signals are constantly emitted by mobile devices, generating a unique fingerprint that attackers can use to track an individual's movements. This covers smartphones, smartwatches, and fitness trackers, all of which transmit roughly 500 "Bluetooth beacons" per minute.

The unique fingerprint results from minute manufacturing imperfections in device hardware, which uniquely distorts the Bluetooth signal, allowing attackers to bypass anti-tracking techniques like constantly changing network addresses. Across their experiments, they found that 40%-47% of devices were uniquely identifiable and could track a volunteer as they left their residence.

A hacking group has created a robot that's purpose is to troll the Russian government by making as many calls as possible.

The hacking group called Obfuscated Dreams of Scheherazade is behind the hilarious robocaller, and explains on its website that it has collected the phone numbers of thousands of Duma employees, Ministry of War officials, high-ranking politicians, administrators, and more. The website, called Waste Russian Time, allows users to initiate a call which then activates the robocaller to make a call between two different random branches of Russia's government or officials within those branches.

The best part is the robocaller allows users to listen in on the conversation. It would definitely be helpful to know Russian, but I think all humans can tell when there is frustration or anger in someone's voice. The hacking group has written on its website that "If youʼre on the phone, you canʼt drop bombs or coordinate soldiers." At the time of writing, there have been 5204 calls made, and the group behind it all calls for a "peaceful intervention", and is described as "a form of civil resistance" against the war in Ukraine.

A study on the hack titled "Metasurface-in-the-Middle Attack: From Theory to Experiment" will be presented at the Proceedings of the 15th ACM Conference on Security and Privacy in Wireless and Mobile Networks (2022).

Researchers from Rice University have created a tool to eavesdrop on 6G wireless signals (which range from 110 to 170 gigahertz, or GHz), dubbed the "Metasurface-in-the-Middle." Metasurfaces are thin sheets of material with particular designs that allow them to manipulate light or other electromagnetic waves, while a "Man-in-the-middle" attack is a type of hack where an eavesdropper secretly intercepts communications between two parties.

The team designed the metasurface to exact specifications to diffract the 6G (150 GHz) signal how they wanted and printed it on regular office paper using a standard laser printer. Using a common hot stamping technique used in crafting, they placed metal foil atop the printed paper and fed it through a laminator.

An unhappy IT worker that was employed by a real estate firm has hacked his company's database servers that contain sensitive financial information.

According to a recent report by Chinese news outlet Bejing Roar, former database administrator Han Bing had previously warned his employer, Lianjia, about a selection of holes in the company's online security for its databases. Failing to gain any traction on any of his requests, Bing decided to launch a full-scale attack on four of the company's servers, specifically targeting servers containing financial information. The attack worked, and Bing wiped out four severs and prevented Lianjia from being able to access its own financial system.

As you can probably imagine, an investigation was immediately launched into the online attack, which ended up being boiled down to five potential individuals with the appropriate administrator credentials. Investigators then cross-referenced server logs, MAC addresses, and IP addresses with CCTV footage and were able to determine that Bing was the culprit. After facing an appeal rejection in court, Bing has been sentenced to seven years in prison and a restitution bill of $30,000, or approximately 200,000 yuan.

A US college has announced its closure after experiencing the COVID-19 pandemic and a grim cyberattack, ending 157 years of education.

Lincoln College has issued a goodbye note on its website that states the college has contacted the Illinois Department of Higher Education and Higher Learning Commission to inform them of the college's "permanent closure" that will become effective on May 13, 2022. The announcement states that the Board of Trustees has voted to stop all academic programming at the end of the spring semester following financial difficulties caused by the COVID-19 pandemic and a cyberattack that happened in December 2021.

The college explains that the COVID-19 pandemic forced large investments into "technology and campus safety measures", which coincided with a drop in enrollment. The cyberattack in December of last year prevented administrators from accessing institutional data, which stopped the college from being able to create clear projections for Fall 2022.

Hackers have taken aim at Russia once again, but this time they have targeted many of the nation's online platforms with a clear message.

On Monday, May 9, hackers infiltrated many Russian smart TVs by changing the channel names and descriptions to show a stark message. Notably, smart TVs weren't the only online platforms that were targeted, as reports indicate that Russian platforms such as Rutube, Russia's clone of YouTube, and even large internet companies such as Yandex. Rutube described the hack in its Telegram channel as a "powerful cyberattack" that caused the platform to not be accessible.

The message that was displayed on Russian smart TVs was, "The blood of thousands of Ukrainians and hundreds of murdered children is on your hands." These cyber attacks are hardly surprising as Russia has undergone many hacking attacks since it began its invasion of Ukraine on February 24. Notably, the Anonymous hacking collective has already performed many successful cyber attacks against Russia, claiming it has previously infiltrated the Russian space agency, Russia's Central Bank, and more.

The Department of Justice has announced its charged three individuals for acting as an illegal agents of the Russian government within the United States.

Russian business man Aleksandr Mikhaylovich and Russian President Vladimir Putin.

The news was announced via a press release found on the Department of Justice website and states that a Russian legislator Aleksandr Mikhaylovich Babakov and two staff members, Aleksandr Nikolayevich Vorobev and Mikhail Alekseyevich Plisyuk, have been charged for running a multi-year propaganda network designed to "influence and gain access to U.S. elected officials" and "advance Russia's malevolent political designs against Ukraine and other countries, including the United States", said U.S. Attorney Damian Williams for the Southern District of New York.

A hacking group affiliated with the Anonymous hacking collective claimed that it had infiltrated Russia's space agency systems and seized control.

The hacking group called Network Battalion 65 (NB65) took to its Twitter account to post screenshots of server information that they then claimed was displaying the group had infiltrated the Russian space agency "Roscosmos" control system. The head of Roscosmos refuted the claims by NB65, Dmitry Rogozin, who called NB65 "scammers and petty swindlers", and said that "All our space activity control centers are operating normally."

Now reports are surfacing that state a file containing the source of the hack has been analyzed, revealing that the hacking group used 66% of the same code as Conti, a Russian crime hacking group that used ransomware to steal millions from Western companies. As NB65 used the majority of Conti's ransomware to hack Roscosmos systems, it seems that NB65 has changed Russia's own ransomware code and used it to attack the Kremlin.