By Waqas
Another day, another popular dark web marketplace bites the dust!
This is a post from HackRead.com Read the original post: International Sting Takes Down Major Dark Web Marketplace “Nemesis Market”

Nemesis Market, a major darknet marketplace for illegal goods, shut down by joint international law enforcement action – Servers seized, €94,000 in crypto confiscated. Global effort disrupts dark web criminal activity.

In a coordinated international effort, German authorities, working alongside law enforcement agencies from the United States and Lithuania, have successfully shut down the global darknet marketplace “Nemesis Market.”

The takedown, announced on March 22nd, 2024, by the Frankfurt am Main Public Prosecutor’s Office and the Federal Criminal Police Office (BKA) of Germany, marks a significant blow to cybercrime operations on the dark web.

Nemesis Market, launched in 2021, had grown rapidly to become a major player in the dark web marketplace scene. Accessible only through the Tor network, the platform offered a haven for illicit activity, facilitating the sale of narcotics, stolen data, and a variety of cybercrime services.

Source: Federal Criminal Police Office

According to the German press release, investigations into the Nemesis Market began in October 2022, culminating in a concerted action on March 20th, 2024. The operation involved seizing server infrastructure located in Germany and Lithuania, effectively shutting down the marketplace. Additionally, German authorities confiscated cryptocurrency assets worth approximately €94,000, believed to be linked to the platform’s operations.

The investigation revealed a large user base for Nemesis Market, with over 150,000 user accounts and over 1,100 seller accounts identified worldwide. Notably, nearly 20% of these sellers were traced back to Germany, highlighting the platform’s reach. The marketplace offered a diverse range of illegal goods and services, including:

*   Narcotics
*   Ransomware
*   Phishing tools
*   DDoS attack services
*   Stolen data and goods

The press release emphasizes that the seized data from the marketplace will be used for further investigations to identify and prosecute the sellers and users involved. This takedown serves as a reminder of the ongoing international efforts to combat cybercrime on the dark web. Collaboration between law enforcement agencies from different countries is proving crucial in disrupting these illicit marketplaces and holding those responsible accountable.

While the takedown of Nemesis Market is a victory for law enforcement, it’s important to acknowledge the persistence of the dark web. New marketplaces are likely to emerge, prompting the need for continued vigilance and international cooperation.

1.  Finnish Dark Web Marketplace PIILOPUOTI Seized
2.  Feds Seize Bulletproof Hosting Service ”Lolek Hosted”
3.  Student-Run Germany’s Largest Dark Web Market DiDW
4.  US Seizes Bitcoin Mixer Sinbad.io Used by Lazarus Group
5.  Genesis Market’s Clearnet domain seized; Dark Web site still online

International Sting Takes Down Major Dark Web Marketplace “Nemesis Market”

By Deeba Ahmed
New Dark Web Tool GEOBOX, sold for $700 on Telegram and underground forums, hijacks Raspberry Pi, allowing cybercriminals to fake locations and evade detection.
This is a post from HackRead.com Read the original post: New GEOBOX Tool Hijacks Raspberry Pi, Lets Hackers Fake Location

Cybercriminals now repurpose devices like Raspberry Pi into ‘plug-and-play’ weapons for digital fraud. With GEOBOX on the Dark Web, their capabilities are even more sophisticated, enabling manipulation of GPS, network simulation, Wi-Fi mimicry, and anti-fraud filter evasion.

Cybercriminals are targeting IoT devices for illicit activities through OPSEC techniques and customizable settings, allowing these devices to operate without logs and ensure anonymity for perpetrators, reveals research from the US-based cybersecurity solutions and services provider, Resecurity. 

According to Resecurity’s Cyber Threat Intelligence team, a significant discovery has been made on the Dark Web: a malicious tool known as GEOBOX. This tool can turn ordinary IoT hardware into powerful weapons for cybercriminals. GEOBOX represents a “paradigm shift in cybercriminal tactics,” highlighting the evolving nature of threats in the digital landscape.

GEOBOX is being sold on Telegram (Screenshot credit: Resecurity)

GEOBOX is a powerful, deceptive tool specifically designed for the Raspberry Pi 4 Model B devices to facilitate cybercriminals in anonymization and fraud. It was first discovered while investigating an online banking theft involving a high-net-worth (HNW) client of a Fortune 100 financial company, prompting researchers to dig deeper into its workings.

The emergence of GEOBOX is not unexpected, appearing shortly after the discovery of another dark web tool known as TMChecker. TMChecker has been arming ransomware gangs, specifically targeting the e-commerce and aviation industries with precision cyberattacks.

The research blog, shared by Resecurity with Hackread.com, ahead of publication on Monday revealed that threat actors have already used multiple internet-connected GEOBOX devices as proxies, each placed at a strategic remote location, enhancing their anonymity.

This complicated the investigation and tracking process, as GEOBOX devices do not store logs by default. Resecurity observed a bad actor using GEOBOX with two LTE-based wireless modems for enhanced anonymization, particularly in remote connections.

The package can be rented for a lifetime fee of $700 or a monthly rate of $80, payable in cryptocurrency and advertised on major underground forums and Telegram. The user manual provides clear instructions on the download and installation of the Raspberry Pi OS using Raspberry Pi Imager, how to obtain the GEOBOX Software Image and work with the GEOBOX software.

It is a feature-rich tool, including WebRTC IP for discreet online communication, GPS spoofing for geolocation manipulation, and the ability to mask Wi-Fi MAC addresses. The device requires at least 4 GB of RAM, but an 8 GB version is also available offering superior performance. 

Further, it connects to the internet via Ethernet or USB modem and offers various tabs like INTERNETBOX, MIDDLEBOX, Proxy, VPN, and Wi-Fi, each providing specific functionalities. Users can configure various internet connection types, including VPN protocols like L2TP, PPTP, L2TP-IPsec, Wireguard, SSTP, Zerotier, and OpenVPN, and even create a VPN tunnel within another VPN tunnel. 

GEOBOX can help threat actors in cyberattack coordination, dark web market operations, sophisticated financial frauds, circumvention of government censorship, anonymous malware distribution, credential stuffing campaigns, disinformation campaigns, surveillance evasion in authoritarian regimes, content piracy and geo-restriction bypassing, and network security testing.

That’s not all. Cybercriminals can also use GEOBOX to fake their geographical location using a GPS-like driver, bypassing location verification checks on websites like Whoer.net and browserleaks.com, and creating customized accounts on popular platforms like Google and Amazon.

The emergence of GEOBOX necessitates robust digital risk monitoring and endpoint protection strategies, making collaboration between law enforcement agencies, deployment of proactive measures, and continuous innovation in cybersecurity strategies fundamental to counter such threats effectively.

1.  Kaspersky’s iShutdown Tool Detects Pegasus Spyware
2.  New Dark Web Market Styx: Focuses on Money Laundering
3.  USB Wormable Raspberry Robin Malware Hits Windows PCs
4.  Building Your Defense Toolbox: Tools to Combat Cyber Threats
5.  Following WormGPT, FraudGPT Emerges for AI-Driven Cyber Crime

New GEOBOX Tool Hijacks Raspberry Pi, Lets Hackers Fake Location

By Owais Sultan
Entering the dynamic world of cryptocurrencies is pretty exciting. But one can easily get overwhelmed with the amount…
This is a post from HackRead.com Read the original post: Step-by-Step Guide to Creating Your First Crypto Wallet

Entering the dynamic world of cryptocurrencies is pretty exciting. But one can easily get overwhelmed with the amount of information that floods you once you dip your toes. 

Since you’re looking to create a crypto wallet, this guide was designed to help you as a newbie complete this process without a hassle. It will highlight the distinction between custodial and non-custodial wallets, emphasizing the benefits of each, and walk you through the setup process. 

****Two Types of Crypto Wallets****

There are two main types of wallets: custodial and non-custodial. Understanding the difference between these two is detrimental to making the right decision. 

****Custodial Wallets****

Custodial wallets are managed by a third-party entity, such as a cryptocurrency exchange or a specialized wallet service. When you use a custodial wallet, the private keys to your cryptocurrencies are held by the service provider.

****Advantages:****

*   Custodial wallets often offer a user-friendly interface, making them accessible to beginners. 
*   Users don’t need to worry about managing their private keys, as the service provider takes care of security.
*   If you forget your password or lose access to your account, you can recover your funds through the service provider’s customer support.

****Disadvantages:****

*   By entrusting your private keys to a third party, you’re exposed to the risk of the service being hacked. 
*   Since the service provider controls the wallet’s private keys, they have the ultimate authority over your funds. This control includes the ability to freeze accounts or delay transactions, which might be concerning for some users.

****Non-Custodial Wallets: Security and Autonomy****

Non-custodial wallets give you full control over your cryptocurrency by allowing you to manage your wallet’s private keys. This means that only you have access to your funds and the authority to make transactions.

****Advantages:****

*   Since you’re the sole holder of the private keys, the risk of external breaches is significantly reduced. 
*   You have complete autonomy over your funds, without any intermediary having the power to freeze or manage your assets. 

****Disadvantages:****

*   Managing your private keys means you must be vigilant in securing them. Losing your keys without a backup can result in the irreversible loss of your assets.
*   Non-custodial wallets can be more complex to use, especially for those new to cryptocurrency. 

Your choice between a custodial and non-custodial wallet will depend on what you value more: convenience or control. For those who prioritize ease of use and are just getting their feet wet in the crypto world, a custodial solution might be the way to go.

On the other hand, if you’re keen on having full control over your assets, a non-custodial wallet is your best bet. But then you must learn how to safely store and manage your keys, which might be tough for a beginner.

****Setting Up Your Wallet****

Regardless of the type of wallet you choose, the setup process is generally straightforward. Here’s how you can get started:

****Research****

Look for a reputable wallet provider. For non-custodial options, consider security features and compatibility with different cryptocurrencies. For custodial wallets, assess the platform’s reliability and customer service.

****Download and Install****

Once you’ve chosen your provider, download the wallet application on your smartphone or computer. Follow the installation instructions.

****Create Your Wallet****

Open the application and select the option to create a new wallet. You’ll likely be prompted to set up a password or PIN for additional security.

****Backup Your Wallet****

If you’re using a non-custodial wallet, you’ll be given a recovery phrase. It’s crucial to write this down and store it in a safe place. This phrase is your lifeline if you ever lose access to your device.

****Deposit Cryptocurrency****

You can now transfer crypto into your new wallet. You can do this by purchasing cryptocurrency through an exchange and sending it to your wallet’s address or receiving it from someone else.

****Introducing Nonbank: The Best of Both Worlds****

Now, let’s talk about Nonbank (PDF). It’s a new player but their concept is intriguing. Nonbank offers the convenience of a custodial wallet with the security and control of a non-custodial option. The upcoming Tron Wallet feature is especially noteworthy for those interested in managing both digital and traditional financial assets seamlessly. 

Setting up a wallet with Nonbank is a breeze. Their user interface is intuitive, making it easy for beginners to navigate. With Nonbank, you’re not just getting a wallet; you’re getting a comprehensive platform that supports your journey through the crypto space.

****To Sum Up****

Choosing the right wallet is a critical step for anyone venturing into the cryptocurrency world. Whether opting for a custodial or non-custodial wallet, the primary considerations should be convenience, security, and control. Nonbank can be a great tool to simplify the management of your digital and traditional assets, which makes it an excellent choice for you as a newcomer. 

1.  5 Types of Crypto You Didn’t Know Existed
2.  The Future of MATIC and What to Expect in 2024
3.  Navigating the new frontier of cryptocurrency futures
4.  What the Bitcoin ETF Approval Mean for the Crypto Market
5.  Enhancing Blockchain Randomness To Eliminate Trust Issues
6.  Exploring the Phenomenal Rise of Ethereum as a Digital Asset

Step-by-Step Guide to Creating Your First Crypto Wallet

By Waqas
Using a Wordpress website? Lookout for Sign1 malware!
This is a post from HackRead.com Read the original post: Thousands of WordPress Websites Hacked with New Sign1 Malware

Sign1 malware targets WordPress websites, injecting malicious code that redirects visitors to scams or bombards them with ads – Sucuri researchers discovered this evasive malware, urging website owners to update software and implement security measures to protect their sites.

Cybersecurity researchers at Sucuri have uncovered a concerning new malware campaign targeting **WordPress** websites. Dubbed “Sign1,” the malware injects malicious code into vulnerable websites, ultimately redirecting visitors to scam sites or bombarding them with unwanted pop-up ads.

The new malware discovery emerged shortly after Check Point Software Technologies Ltd. disclosed a malicious campaign named **FakeUpdates**, which specifically targeted WordPress websites with malware.

Sign1 malware’s stealthy tactics make it a significant threat. The malware leverages time-based **randomization** to generate dynamic URLs, making it difficult for security software to identify and block them. Additionally, the code itself is obfuscated, further hindering detection.

Perhaps most concerning is Sign1’s ability to target visitors from specific websites, such as popular search engines and social media platforms. This suggests a level of sophistication, potentially allowing attackers to focus on users they deem more susceptible to scams.

Sucuri’s **report** estimates that over 39,000 WordPress websites have been infected with Sign1 thus far. Website owners are urged to take immediate action to protect their sites and visitors.

****How to Protect Your WordPress Website from Sign1****

If you are using WordPress as your website’s content management system (CMS), here are some simple yet vital steps to protect the website from Sign1 and other similar malware:

*   Update WordPress core, themes, and plugins regularly. Outdated software often contains vulnerabilities that attackers exploit.
*   Implement strong security practices. This includes using secure passwords, enabling two-factor authentication, and keeping backups of your website data.
*   Use a reputable website security scanner. Regularly scan your website for malware and vulnerabilities.
*   Be cautious when installing plugins. Only install plugins from trusted sources and with good reviews.

Website owners who suspect their site may be infected with Sign1 malware should:

*   Contact a security professional or your **WordPress hosting company.** They can help identify and remove the malware.
*   Change all website passwords. This includes the WordPress admin password, FTP password, and database password.

Nevertheless, the discovery of Sign1 malware goes on to show the vulnerable state of websites. With more than 835 million sites using WordPress even a small threat could end up compromising a staggering number of sites.

It’s crucial to **stay informed** about the latest security vulnerabilities and take proactive steps to protect your website. Security researchers like Sucuri play a vital role in identifying and mitigating these threats.

1.  Hackers Hit WordPress Sites with Balada Malware
2.  Tips for Using Uploader Widgets on WordPress Blogs
3.  Zero-Day Exploit Threatens 200,000 WordPress Sites
4.  Database Malware Strikes Vulnerable WordPress Sites
5.  5 Signs your WordPress Site is Hacked (And How to Fix It)

Thousands of WordPress Websites Hacked with New Sign1 Malware

By Uzair Amir
With the massive adoption of Microsoft 365, encountering complex environments involving multiple tenants is becoming increasingly common.
This is a post from HackRead.com Read the original post: Cross Tenant Microsoft 365 Migration

What is a Cross Tenant migration, and why and when do you need it? Cross-tenant migration refers to the process of moving data, applications, and services from one Microsoft 365 tenant (or organization) to another. Whether due to mergers, acquisitions, restructuring, or strategic decisions, businesses often find themselves in situations where they need to consolidate or reorganize their tenant structures.

****The different actors****

When it comes to tenant-to-tenant migration within Microsoft 365, several key actors play crucial roles in ensuring a successful transition. Let’s explore them:

**Microsoft Consulting Services (MCS)**: Organizations often collaborate with MCS to plan and execute tenant migrations. Their expertise ensures a smooth transition, addressing complexities and minimizing disruptions1.

**Microsoft Partners**: These skilled professionals specialize in tenant migrations. They work closely with organizations, offering tailored solutions and leveraging third-party tools for content migration1.

**IT Administrators**: Within the organization, IT administrators take charge of technical aspects. They oversee user accounts, data integrity, and configuration adjustments during the migration process.

**Identity Architects**: These architects design the identity framework for the new tenant. They handle user authentication, access permissions, and identity synchronization across tenants.

**Data Migration Specialists**: These experts focus on moving data—emails, files, SharePoint sites—from the source to the target tenant. They ensure data fidelity and minimal downtime.

**Change Management Teams**: Communication is key. Change management teams inform stakeholders about the migration, manage expectations, and guide users through the transition.

**The different solutions**: When it comes to cross-tenant Microsoft 365 migrations, several vendors and solutions can assist you in smoothly transitioning your users’ data. Here are some options:

**Microsoft 365 Native Tools:** Microsoft provides native tools and interfaces for cross-tenant mailbox and OneDrive migrations. 

**Third-Party Migration Solutions:** Several third-party vendors offer specialized migration tools for Microsoft 365 cross-tenant scenarios. These solutions provide additional features, flexibility, and support. 

Some popular vendors include:

****Cloudiway:****

Cloudiway specializes in cloud migration services, including Microsoft 365. Their platform is one of the most complete solutions and supports **Microsoft cross-tenant migrations** for mailboxes, OneDrive, Microsoft Teams, SharePoint, Intune and devices. Cloudiway emphasizes ease of use and efficient migration processes.

****AvePoint:****

**AvePoint** offers migration solutions for Microsoft 365, including cross-tenant scenarios. Their tools provide features like Mailbox, OneDrive, Microsoft Teams and SharePoint migrations. AvePoint’s solutions are known for their reliability and comprehensive support.

****BitTitan:** **

**BitTitan** is known for its MigrationWiz tool, which supports cross-tenant migrations for mailboxes, OneDrive, and Microsoft Teams.

****Quest:** **

Offers solutions like **Quest** On Demand Migration and Quest On Demand Migration for Email.

****SkyKick:** **

**SkyKick** provides automated migration tools for Microsoft 365, including cross-tenant scenarios.

****ShareGate:** **

Known for its **ShareGate Desktop** and ShareGate Migrate tools, which support SharePoint, Teams and OneDrive migrations. They have recently integrated mailbox migration.

****CodeTwo:****

**CodeTwo** offers migration solutions for Microsoft 365, including cross-tenant mailbox migrations.

****Table of comparison:****

**AvePoint**

**Cloudiway**

**Microsoft**

**BitTitan**

**Quest**

**Skykick**

**Avepoint**

**ShareGate**

**CodeTwo**

SAAS

Yes

Yes

Yes

Yes

Yes

Yes

No

No

MailsMaturity

Yes \* 2012

Yes 2022

Yes  \*2010

Yes 2012

Yes 2010

Yes 2021

Yes Beta

Yes 2012

Drives

Yes \*

Yes

Yes\*

Yes

No

Yes

Yes

No

Maturity

2012

2022

2015

2015

**AvePoint**

2020

SharePoint

Yes

Partial SPMT (On-premises)

No (librairies seulement)

Yes \*

No

Yes \*

Yes\*

No

Microsoft Teams

Yes\*2018 

No

Yes2020

Yes

No

Yes\*2018

Yes2021-22

No

Teams Private messages

Yes

No

No

No

No

No

No

No

Slack

Yes\*

No

No

No

No

Yes

No

No

Slack Direct Messages

Yes

No

No

No

No

No

No

No

Google Chat

Yes

No

No

No

No

No

No

No

Laptops

Yes

No

No

Yes

No

No

No

No

Intune

Yes

No

No

No

No

No

No

No

FreeBusy & Galsync

Yes

No

No

No

No

No

No

No

**\*** **leader**

****Conclusion:****

In the ever-evolving landscape of cloud collaboration, **cross-tenant migrations** have become a critical undertaking for organizations. Whether due to mergers, acquisitions, or strategic realignments, the need to seamlessly transition data between Microsoft 365 tenants is more prevalent than ever.

**Vendor Selection Matters:** Choosing the right migration solution is paramount. Evaluate vendors based on factors such as scope of migration, reliability, scalability, support, and ease of use. Consider both native Microsoft tools and third-party offerings.

**Preparation Is Key:** Properly prepare your source and target tenants. Establish trust relationships, configure identity mapping, and ensure that users are set up correctly in the destination tenant.

**Data Integrity and Security:** During migration, prioritize data integrity and security. Test thoroughly, monitor progress, and address any issues promptly.

**Communication and Change Management:** Keep stakeholders informed throughout the process. Effective communication minimizes disruption and ensures a smooth transition for end-users.

**Post-Migration Validation:** Validate data integrity, permissions, and functionality post-migration. Address any discrepancies promptly.

Remember, cross-tenant migrations are not just about moving data; they impact user productivity, collaboration, and overall business continuity. By following best practices and leveraging the right tools, organizations can navigate this complex journey successfully.

1.  Advantages of a Cloud VPS Server
2.  4 Benefits of Cloud VPN to your Business
3.  How To Safeguard Your Data With Cloud MRP System
4.  Managed Cloud Hosting vs. Unmanaged Cloud Hosting
5.  Insights on Google Cloud Backup, Disaster Recovery Service

Cross Tenant Microsoft 365 Migration

By Waqas
Is your organisation using Zephyr OS? Patch and update it to the latest version now!
This is a post from HackRead.com Read the original post: Unpatched Zephyr OS Expose Devices to DoS Attacks via IP Spoofing

Discover how cybersecurity researchers uncover vulnerabilities in Zephyr OS, a real-time operating system used in IoT and embedded devices — Learn about the risks of IP address spoofing and denial-of-service attacks and the importance of maintaining strong security measures in connected device environments.

Cybersecurity researchers at the Synopsys Cybersecurity Research Center (CyRC) have uncovered vulnerabilities within the Zephyr OS network stack, potentially leaving connected devices susceptible to IP spoofing (or IP address spoofing) attacks.

Zephyr OS, a widely used real-time operating system prevalent in the Internet of Things (**IoT**) and embedded devices, boasts extensive customizability and broad compatibility with multiple architectures and boards, catering to diverse applications.

One of Zephyr OS’s key features is its built-in network stack, which supports various networking protocols, including IPv4 and IPv6. This flexibility enables developers to create connected devices capable of seamless communication across different networks.

However, the CyRC identified a flaw in the Zephyr OS implementation, particularly concerning its handling of **IP address spoofing attacks**. IP address spoofing involves the creation of IP packets with falsified source IP addresses, often with malicious intent to deceive recipients into believing they are from legitimate sources.

The vulnerability originates from Zephyr OS’s failure to drop IP packets arriving from an external interface with a source address equal to the local host or the destination address, contrary to recommended security practices. Therefore, responses sent back to the fake source IP address bypass host-side IP address–based access control, potentially leading to unauthorized access or data manipulation.

Furthermore, the flaw exposes devices to denial-of-service attacks (DoS attacks), as responses handled by loopback interfaces can overwhelm the system, resulting in instability or crashes. The vulnerability shares a similar modus operandi with a recently identified attack known as **Loop DoS**, where IP spoofing is exploited, leaving devices susceptible to denial-of-service (DoS) attacks.

The affected versions include Zephyr OS v.3.5, v.3.4, and 2.7 (LTS v2), as well as other releases supporting IPv6 or IPv4. However, patches have been integrated into the main branch and specific release branches to mitigate these vulnerabilities.

According to CyRC’s **blog post**, the discovery credit for these vulnerabilities goes to the company’s Senior Software Engineer **Kari Hulkko**, who utilized the Defensics® fuzz testing tool with IPv4 and IPv6 protocol test suites. In response to the disclosure, Synopsys acknowledges the collaboration and responsiveness of the Zephyr OS team in addressing these vulnerabilities.

The timeline of events surrounding the disclosure and resolution of the vulnerabilities highlights the collaborative efforts of cybersecurity researchers and software maintainers to ensure the security and integrity of connected devices powered by Zephyr OS.

As IoT and embedded devices continue to grow in number, it’s essential to prioritize strong security measures to defend against threats and vulnerabilities found in operating systems like Zephyr OS.

Unpatched Zephyr OS Expose Devices to DoS Attacks via IP Spoofing

By Deeba Ahmed
Pwn2Own is back!
This is a post from HackRead.com Read the original post: Pwn2Own 2024 Awards $700k as Hackers Pwn Tesla, Browsers, and More

The Pwn2Own 2024 hacking contest saw a record-breaking first day as participants exposed critical vulnerabilities in Tesla vehicles, popular browsers, and operating systems – This highlights the ongoing challenge of securing our technology and the importance of bug bounty programs.

The Pwn2Own 2024, a hacking contest organized by Trend Micro’s Zero Day Initiative in Vancouver, saw participants earn over $700,000 on the first day through successful exploits against Tesla cars, browsers, and Linux and Windows systems. 

French cybersecurity firm Synacktiv’s hackers earned $200,000 for an integer overflow exploit targeting the Tesla ECU with CAN bus control and also won a new Tesla Model 3. It is worth noting that this was the only scheduled hacking attempt for Tesla cars for this contest. 

However, this isn’t the first time Synacktiv has dominated Pwn2Own – they previously won a car in Pwn2Own Automotive 2024. 

Tesla pwned (Screenshot: ZDI)

****About the Vulnerability****

While the specific details of the exploit remain undisclosed, as per Pwn2Own rules to allow for vendor patching, the competition organizers confirmed that a single integer overflow flaw was used. This vulnerability allowed the team to gain control of the Tesla’s CAN BUS, a crucial communication system within the car. Synacktiv exploited a Tesla ECU with Vehicle (VEH) CAN BUS Control using a single integer overflow flaw to secure their second victory in Pwn2Own competitions. 

****Day One Highlights****

On day one of the Pwn2Own contest, participants were awarded $732,500 by ZDI for reporting 19 unique zero-day vulnerabilities. Here’s the breakdown of the rewards.

Independent white-hat hacker Manfred Paul received $102,500 for remote code execution on Apple Safari using an integer underflow bug, and a PAC bypass exploiting a flaw in the same browser. Paul also executed a double-tap exploit on Chrome and Edge browsers using a rare CWE-1284 vulnerability in round two of the competition.

South Korean team Theori earned $130,000 by combining an uninitialized variable bug, a use-after-free (UAF) vulnerability, and heap-based buffer overflow to escape a VMware Workstation and execute code as system on Windows OS.

Oracle VirtualBox was targeted by REverse Tactics researchers, earning $90,000 and two researchers received $20,000 for their respective Oracle VirtualBox exploits. 

Other Pwn2Own participants earned rewards for Chrome and Edge, Safari, Adobe Reader, Windows 11 local privilege escalation, and two Ubuntu local privilege escalation exploits. 

Seunghyun Lee, AbdulAziz Hariri, and the Devcore Research team successfully exploited Google Chrome, Adobe Reader, and Windows 11 bugs, earning them $60,000, $50,000, and $30,000 respectively. Lee successfully executed an exploit on Google Chrome, Hariri completed a code execution attack, and the Devcore Research team successfully executed a local privilege escalation (LPE) attack.

Chrome browser pwned (Screenshot: ZDI)

Participants will attempt to hack various software on the second day, including VMware Workstation, Oracle VirtualBox, Firefox, Chrome, Edge, Ubuntu, Windows 11, and Docker Desktop. The three-day event is offering a total of $1.3m in cash and prizes.

1.  Whitehat hacker bypasses SQL injection filter for Cloudflare
2.  Hackers Crack Tesla Twice, Rake in $1.3 Million at Pwn2Own
3.  White hat hackers infect Canon DSLR camera with ransomware
4.  Whitehat hacker shows how to detect hidden cameras in hotels
5.  White hat hacker infects smart coffee machine with ransomware

Pwn2Own 2024 Awards $700k as Hackers Pwn Tesla, Browsers, and More

By Uzair Amir
Your web browser serves as the gateway to the internet, but it also acts as a potential entry point for cybercriminals to access your computer and smartphone.
This is a post from HackRead.com Read the original post: Why Browser Security Matters More Than You Think

In today’s interconnected world, where our lives revolve around the internet, it’s imperative to understand the importance of browser security. Whether it’s for personal use or professional purposes, web browsers function as our primary gateway to the online world.

Consequently, they also serve as a potential entry point for cyber threats and attacks. In this article, we’ll highlight why browser security matters more than you might think and discuss some essential steps to enhance your online safety.

**The Growing Cybersecurity Threat:**

It’s no secret that cyber threats have become increasingly sophisticated over the years. Cybercriminals are constantly finding new ways to exploit vulnerabilities in browsers, leaving users vulnerable to privacy breaches, data thefts, and financial frauds.

According to cybersecurity experts, one of the most common tactics used by hackers is cross-site scripting (XSS) attacks. These malicious scripts injected into web pages can compromise users’ sensitive information.

****Major Web Browsers Remain At Risk:****

While modern web browsers work diligently to enhance their security features, they are not completely immune from threats. Some developers argue that certain browsers are more secure than others due to their built-in security mechanisms. However, critics believe that no browser is entirely invincible. Over time, vulnerabilities may emerge for even the most popular browsers for Windows as hackers adapt and discover new methods of attack.

****The Need for Vigilance and Proactive Measures:****

Considering the persistent threat surrounding web browsers, users like us must remain proactive with our online safety measures:

****1\. Keep Your Browser Up-to-Date:****

Vendors frequently release security patches and updates for their web browsers as vulnerabilities are discovered and fixed. By regularly updating your browser software, you stay protected against known threats.

****2\. Enable Automatic Updates:****

Enabling automatic updates ensures that you receive critical security updates immediately upon release without any manual intervention.

****3\. Utilize Browser Extensions with Caution:****

Browser extensions can add extra functionality and enhance your browsing experience. However, they may also act as potential gateways for hackers. It’s important to research and use trustworthy extensions from reputable sources.

****4\. Enable Two-Factor Authentication (2FA):****

Activating 2FA adds a layer of security to your user account by requiring you to provide a second form of verification, such as a unique code sent to your mobile device or email.

****5\. Implement Strong and Unique Passwords:****

We’ve heard it countless times, but it bears repeating: strong, complex, and unique passwords are essential. Avoid using easily guessable passwords like consecutive numbers or common phrases. Consider utilizing a password manager to store and generate unique passwords securely.

****6\. Regularly Clear Browser Cache and Cookies:****

Clearing your browser cache and cookies can help protect your privacy and prevent unauthorized access to your online activities.

****7\. Use Privacy-Focused Browsing Modes:****

Most popular web browsers offer private browsing modes that do not retain any browsing history or save cookies upon session closure. Utilize these specialized modes when accessing sensitive information or using public networks.

****8\. Be Cautious with Downloads:****

Exercise caution when downloading files from the internet, particularly those sent by unknown sources. Malware can be disguised within seemingly harmless files, leading to potential security breaches.

****Common Mistakes to Avoid:****

Despite the importance of browser security, many users make common mistakes that can leave them vulnerable to cyber threats. By avoiding these pitfalls, you can significantly enhance your online safety.

****1\. Ignoring Updates:****

One of the most common mistakes people make is neglecting to update their web browsers. Developers continuously release updates to patch security vulnerabilities and improve overall performance. If you ignore these updates, your browser remains susceptible to attacks targeting known vulnerabilities.

****2\. Clicking on Suspicious Links:****

Clicking on suspicious links in emails or on unfamiliar websites can lead to malware infection or phishing attempts. Always be cautious and verify the authenticity of links before clicking on them.

****3\. Using Weak Passwords Across Multiple Websites:****

Using weak passwords that are easy to guess or reusing passwords across multiple websites places all your accounts at risk if one becomes compromised. Implement strong and unique passwords for each online service you use, and consider using a password manager to manage them securely.

****Conclusion:****

Your browser is more than just a tool for internet navigation; it serves as the gateway between you and the digital world around you – a world teeming with cyber threats desperately seeking gaps in security measures to infiltrate unknowing users’ devices.

By prioritizing browser security, remaining vigilant against emerging threats, and implementing the tips mentioned above, we can significantly reduce our vulnerability to cyber-attacks.

Remember: taking proactive steps towards enhancing browser security today means safeguarding yourself against tomorrow’s evolving risks—a small price for maintaining online safety in an ever-connected world.

1.  Apple Safari Safest, Google Chrome Riskiest Browser
2.  Mullvad VPN and Tor Project Release Mullvad Browser
3.  Brave Browser enters dark web with its own Tor Onion service
4.  Google Incognito Mode: New Disclaimer Reveals Data Tracking
5.  DuckDuckGo Allows Microsoft Trackers Despite No Tracking Policy

Why Browser Security Matters More Than You Think

By Waqas
About to pay your taxes? Watch out for tax return phishing and malware campaigns targeting individual taxpayers and businesses.
This is a post from HackRead.com Read the original post: Microsoft Warns of New Tax Returns Phishing Scams Targeting You

New and sophisticated tax phishing scams are targeting taxpayers, warns Microsoft. These scams impersonate trusted sources and use urgency tactics to steal personal and financial data.

Taxpayers beware! Phishing scams are on the rise again as tax season heats up. Microsoft Threat Intelligence has issued warnings about new and innovative tactics cybercriminals are using to steal your personal information and financial data.

These scams don’t discriminate, but they do target specific groups more heavily. New taxpayers, recent immigrants with green cards, small business owners who file themselves, and older adults are all prime targets because they might be less familiar with tax procedures.

It is also worth noting that these threat actors are getting more sophisticated too. They’re impersonating trusted sources like employers, tax agencies, and even payment processors. They might send emails with blurry or incomplete tax documents to create a sense of urgency and trick you into clicking on a malicious attachment.

These attachments, as per Microsoft Threat Intelligence’s blog post, contain malware that steals your login credentials, or they might redirect you to a fake website that looks like a legitimate tax platform designed to capture your information.

One example scam identified in January involved emails that appeared to be from employers sending tax documents. Clicking on the attached HTML file led to a fake landing page designed to steal the user’s login credentials.

Screenshot via Microsoft Threat Intelligence

****Tycoon and NakedPages – PhaaS****

In addition to their blog post, Microsoft Threat Intelligence has also sent out a series of tweets addressing the increasing prevalence of phishing campaigns during the tax season in the United States.

These campaigns, including those associated with notorious phishing-as-a-service (PhaaS) platforms like Tycoon and NakedPages, are leveraging tax-related themes for social engineering tactics, putting individuals and organizations at risk of financial fraud and data theft.

One notable campaign tied to the Tycoon PhaaS platform involved deceptive emails posing as official tax forms such as W-2 and W-9 notifications, alongside other payroll tax documents.

These emails featured HTML attachments that initiated a Cloudflare captcha check, ultimately leading victims to a phishing page designed to harvest sensitive information. When recipients opened these attachments, JavaScript scripts were executed, facilitating the installation of info-stealing malware.

Additionally, Microsoft observed phishing efforts linked to the AiTM phishing kit NakedPages, where fraudulent emails disguised as DocuSign-shared documents about tax adjustments were circulated. Clicking on embedded images within these emails triggered redirections culminating in phishing pages, demonstrating the sophisticated nature of these attacks.

This malicious software is designed to harvest sensitive data, including cryptocurrency wallet information, login credentials for PuTTY and WinSCP, as well as credentials stored in web browsers and email clients. Such comprehensive data theft poses significant risks to individuals and organizations, potentially resulting in financial losses and compromised digital identities.

Screenshot via Microsoft Threat Intelligence

Both Tycoon and NakedPages are recognized for their automation capabilities in executing phishing activities, as well as their ability to bypass multi-factor authentication (MFA) through adversary-in-the-middle (AiTM) techniques, strengthening the threat posed by these campaigns.

Microsoft recommends staying alert throughout tax season. Don’t click on suspicious links or attachments in emails, even if they seem to come from a familiar source. If you’re unsure about the legitimacy of an email, contact the sender directly through a verified phone number or website.

You can find more resources and tips for staying safe from tax season scams by searching for the “Microsoft Threat Intelligence tax season report.”

1.  IRS tax forms W-9 email scam drops Emotet malware
2.  New Ransomware Email Scam Using FBI and IRS as Bait
3.  Security Breach Rattles IRS, 334,000 Tax Payers Data Stolen
4.  US Citizens Hit by Ransomware via Fake IRS Tax Return Emails
5.  Thanks IRS for poor security: Data On 100,000 Taxpayers Stolen

Microsoft Warns of New Tax Returns Phishing Scams Targeting You

By Waqas
Ukraine used Clearview AI, now it is up for grabs by US Defense agencies!
This is a post from HackRead.com Read the original post: Controversial Clearview AI Added to US Government’s Tech Marketplace

Clearview AI, a facial recognition company mixed up in privacy debates, is now listed on the US government’s Tradewinds Solutions Marketplace – This move puts their technology in the running for potential use by national defence agencies, sparking renewed concerns about facial recognition and its role in security. Will Clearview AI be a valuable tool or an erosion of privacy?

On March 19, 2024, the controversial facial recognition technology company, **Clearview AI**, announced its inclusion in the Tradewinds Solutions Marketplace. This move grants Clearview AI “Awardable” status, making its facial recognition platform a potential candidate for use in national defence contracts across the United States.

It is worth mentioning that in March 2022, Clearview AI’s facial recognition solution was also **used by Ukraine**, which the country claimed was utilized to monitor ‘People of Interest.’

The **Tradewinds Solutions Marketplace**, managed by the Chief Digital and Artificial Intelligence Office (CDAO), functions as a repository of digital tools that have been pre-approved for consideration by US federal agencies.

This streamlined process allows agencies, particularly the Department of Defense, to efficiently identify and procure vetted technologies that meet the requirements of federal acquisition regulations.

Clearview AI’s facial recognition system boasts an extensive **database of over 40 billion images** culled from publicly available sources across the internet. This vast collection of data allows the platform to identify individuals with a high degree of accuracy, according to the company.

Clearview AI emphasizes the potential benefits of its technology for national security. The company argues that its platform can be a powerful tool for intelligence and defence agencies, enabling them to identify unknown individuals and enhance national security efforts through the use of open-source intelligence (**OSINT**).

****Clearview AI and privacy and cybersecurity issues****

However, Clearview AI’s data collection practices have raised privacy concerns in the past. Critics argue that the company’s unrestricted scraping of publicly available images constitutes a privacy intrusion, raising questions about the potential for misuse of the technology.

**In March 2020**, Apple suspended the Clearview AI app from the App Store for breaching the company’s Developer Enterprise Program terms and services. Before the suspension, in February 2020, unknown hackers **claimed** a data breach at Clearview AI which the company denied.

The New York Times originally uncovered Clearview AI’s privacy breaches, revealing that the company shares data with law enforcement to identify suspects by comparing their images with online photos. Clearview AI retains deleted photos in its database.

Following these revelations, Twitter, Facebook, and Google issued cease-and-desist notices to Clearview AI. Additionally, lawmakers in New Jersey prohibited law enforcement agencies from utilizing its software or services.

In response to the allegations, the company’s founder and CEO, Hoan Ton-That, stated that he aims to establish a prominent American enterprise by providing life-saving technology for detecting criminals. He emphasized that the company’s practices are not maliciously intended, as the software is never sold to other countries.

However, in the **press release** published on March 19, 2924, in response to the inclusion, the CEO called it a matter of pride for the company and its “cutting-edge” technology.

> _“We are proud to be approved to offer our cutting-edge technology on the Tradewinds Marketplace. National Security and Military organizations will get immediate access to a secure facial recognition search engine that can help to identify unknown individuals, and enhance national security efforts using Open Source Intelligence (OSINT).”_
> 
> — Hoan Ton-That, Co-Founder & CEO of Clearview AI

Nevertheless, the addition of Clearview AI to the Tradewinds Solutions Marketplace will set off the debate surrounding **facial recognition technology** and its role in national security. While some see it as a valuable tool for law enforcement and defence, others worry about the potential for government overreach and the erosion of individual privacy.

1.  Deepfakes Used in Bypass Facial Recognition Systems
2.  Fawkes privacy tool blocks images from facial recognition
3.  Meet IRpair & Phantom; powerful anti-facial recognition glasses
4.  Chinese facial recognition database tracking Muslims left exposed
5.  Police locate suspect from a crowd of 60K using Facial Recognition