By Deeba Ahmed
Optus has denied any inside job or human error as the cause of the hack.
This is a post from HackRead.com Read the original post: Data of millions of users exposed in Australia’s 2nd-largest telecom firm breach

Australia’s second-largest telecommunication firm, Optus, is the latest cyberattack victim, which Sydney-based tech analyst Trevor Long has regarded as the biggest breach of personal data from an Australian firm.

**Optus Hack Details**

On Thursday, Optus confirmed that its customers’ private data could be compromised in this attack since the attackers managed to access the customer identity database and opened it to other systems through the Application Programming Interface (API). The investigation is still ongoing, but Optus believes one of the networks was exposed to a test network with internet access.

According to the official press release, the information potentially exposed includes the following:

*   Names
*   Addresses
*   Dates of birth
*   Phone numbers
*   Email addresses
*   Driver’s license
*   Passport numbers.  

The company suspects intruders scraped the consumer database and possibly copied one-third of it. Optus also stated that its network was accessed from an external source. As soon as it discovered the attack, it shut down the attack before customers could suffer any harm. However, the company did advise its customers to keep tracking their accounts for unusual or fraudulent activities.

1.  Sensitive Data of Australian Navy’s Vessels and Fighter Jets stolen
2.  Hackers stole 738 GB of data from an Australian government agency
3.  Vietnamese man hacked Australian airport computers; stole security data
4.  Scoop: Australian Trading Giant ACY Securities Exposed 60GB of User Data
5.  Anonymous Leak 82GB of Police Emails Against Australia’s Offshore Detention

**Possibility of a Human Error?**

Optus CEO Kelly Bayer Rosmarin was asked if human error was responsible for the breach at a media briefing to which she responded:

> “I know people are hungry for details about the exact specificity of how this attack could occur, but it is the subject of criminal proceedings and so we will not be divulging details about that.”
> 
> Kelly Bayer Rosmarin, Optus CEO.

The CEO added that Optus boasts strong cyber defenses and has invested heavily in this regard, so if it can become a target of a security breach, it should be a wake-up call for all organizations.

However, Optus has denied the involvement of human error in this data breach that impacted millions of customers. The CEO also apologized to the company’s customers and said it was challenging to offer immediate advice unless the investigation was completed.

> “We are devastated to discover that we have been subject to a cyberattack that has resulted in the disclosure of our customer’s personal information to someone who shouldn’t see it.”
> 
> Kelly Bayer Rosmarin, Optus CEO.

Kelly has asked for increased vigilance across companies, governments, and customers of Optus as the Sydney-based telecom giant determines how many customers were affected by the data breach. However, it is confirmed that Optus’s voicemails, texts, payment data, and account passwords weren’t compromised in the hack.

**More TELECOM Security News**

1.  Spanish telecom giant MasMovil hit by Revil ransomware gang
2.  Telecom giant behind routing SMS discloses 5-year-long data breach
3.  Argentina’s largest telecom hacked with hackers demanding $7.5 million
4.  Hacker extracts customer data from Canadian Telecom Firm after rebuttal
5.  Croatian Police arrests minor over A1 Telecom data breach & ransom demand

Data of millions of users exposed in Australia’s 2nd-largest telecom firm breach

By Waqas
Here's everything you want to know about Anonymous and its cyber attacks against the Iranian government for OpIran.
This is a post from HackRead.com Read the original post: OpIran – Anonymous Hits Iranian State Sites, Hacks Over 300 CCTV Cameras

In the wake of the recent Iranian government crackdown on dissent after Mahsa Amini’s death, the international hacktivist group **Anonymous** has launched a new operation against the country’s online infrastructure.

Dubbed **OpIran** (Operation Iran) by Anonymous; the hacktivists have taken down a number of top government websites and hacked over 300 security cameras in different parts of the country.

**What Happened to Mahsa Amini?**

It is worth noting that on September 16th, 2022, a 22-year-old Iranian woman named Mahsa Amini died in Tehran, Iran, under Police custody. Amini was arrested for failure to follow government-mandated forms of the Hijab.

On the other hand, authorities claim Amini died of natural causes after suffering heart failure at the police station. However, Iranians have rejected the official explanation and have taken their protests (Mahsa Amini protests (aka September 2022 Iranian protests) to the streets.

**Anonymous Stands with Protestors in Iran**

On Twitter, YourAnonNews, one of the largest social media representatives of the Anonymous movement, and several other popular Anonymous handles have confirmed their support for Iranian protesters. Thus the recent cyber attacks were carried out under the banner of OpIran.

According to Anonymous, the modus operandi of OpIran involves DDoS attacks (Distributed Denial of Service attacks), data breaches, social engineering attacks, quick tutorials on how to beat state censorship by **using the Tor browser**, and evading arrests by police.

**Anonymous Hacks Iran’s Forensic Research Center**

The first major Iranian government institution to suffer a cyberattack from Anonymous hackers is its Forensic Research Center. As seen by Hackread.com, Anonymous managed to successfully deface its domains and leak a database containing 100MB worth of data.

According to Hackread.com’s analysis, the data contains names, email addresses, logs including IP addresses of the Center’s site visitors worldwide.

A Google search for the Center’s website shows it was hacked by Anonymous (1) – The deface page left by Anonymous plays a video containing content that shows a message of support to Iranians (2) – Screenshots 3 and 4 show what is inside the database Forensic center’s database. (Credit: Waqas – Hackread.com)

**Anonymous hacked 300 Iranian CCTV cameras**

Although Anonymous is famous for its large-scale DDoS attacks and data breaches (the group proved its point during **OpRussia** during Ukraine and Russia conflict), lately, they have been going a step further by hitting the vulnerable IoT infrastructure in the targeted country.

In the case of Russia, as **reported by Hackread.com**, Anonymous managed to hack over 400 security cameras across the country while sending almost 10 million texts to Russian citizens to raise awareness about the conflict.

In the latest, Anonymous has claimed to have compromised 300 security camera installations by exploiting a 5.4 severity score vulnerability.

Iranian CCTV cameras apparently controlled by Anonymous

This however is not the first time when hackers have hacked into CCTV cameras in Iran. **In August last year**, hackers from Edaalate Ali (Ali’s Justice or Ali’s Court) group breached the computer system and security cameras at a prison facility in northern Tehran and leaked live footage of grim conditions and grave human rights violations taking place in the prison.

**Anonymous DDoS Attacks on Iranian Sites**

Since launching OpIran, Anonymous has carried out a series of DDoS attacks against Iranian state institutions. Some of these include the following:

*   National Government Portal of Iran (Iran.gov.ir)
*   The official website of the Central Bank of Iran (Cbi.ir)
*   The official website of the Government Spokesman Office (Dolat.ir)
*   The official website of Ali Khamenei, the Supreme Leader of Iran (Khamenei.ir)
*   The official website of the Iranian State media agency IRIB News Agency (Iribnews.ir)

_and the list goes on…_

At the time of writing, all the above-mentioned domains were offline.

For now, it remains to be seen how effective Anonymous’ latest operation will be. However, it is clear that the group is determined to continue its fight against what it sees as an oppressive regime.

1.  Saudi-Iran: Proxy Wars Escalate To Direct Cyber Attacks
2.  Iran’s Largest Steel Producer Hit By Crippling Cyberattack
3.  Israeli Security Camera Systems targeted by Pro-Hezbollah Hackers
4.  Anonymous & its affiliates hacked 90% of Russian exposed databases
5.  Anonymous hacks unsecured printers to send anti-war messages in Russia

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

OpIran – Anonymous Hits Iranian State Sites, Hacks Over 300 CCTV Cameras

By Deeba Ahmed
The malware campaign is ongoing and one of its targets was ICICI bank in India.
This is a post from HackRead.com Read the original post: Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones

Microsoft 365 Defender Research Team has published its findings on a new version of a previously reported info-stealer Android malware, highlighting that threat actors continuously evolve their attack spectrum.

**Research Findings**

According to Microsoft researchers, the malware is delivered in a currently active SMS campaign and masqueraded as a banking rewards app. The campaign’s primary targets are Indian bank customers. It starts with threat actors sending out messages containing a URL that basically lures the recipient into downloading the malware.

Upon user interaction, it displays a splash screen with the bank logo and proceeds to ask the user to enable specific permissions for the app.

The infection chain starts with an SMS message requesting the recipient to claim a reward from an Indian bank. This message contains a malicious link redirecting the user to downloading a fake banking rewards application. This app is detected as: “TrojanSpy:AndroidOS/Banker.O”

The app’s C2 server is linked to 75 different malicious APKs, all of which are based on open-source intelligence. The research team identified many other campaigns targeting Indian bank customers, including:

*   Icici\_points.apk
*   Icici\_rewards.apk
*   SBI\_rewards.apk
*   Axisbank\_rewards.apk

Their research revolved around icici\_rewards.apk, represented as ICICI Rewards. The malicious link inside the SMS message installs the APK on the recipient’s mobile device. After installation, a splash screen displaying the bank logo asks the user to enable specific permissions for the app.

Fake bank SMS with a malicious link – Malicious app asking for permission – Malicious app asking for user data

**Malware Analysis**

According to Microsoft’s blog post, what makes this new version different is the inclusion of additional RAT (remote access trojan) capabilities. Moreover, this malware is highly obfuscated. Its RAT capabilities allow attackers to intercept critical device notifications, for instance, incoming messages, and also try to capture 2FA messages that the user needs to access banking/financial apps.

The malware can steal all SMS messages and other data, such as OTP (one-time-password) PII (personally identifiable information), to help steal sensitive information for email accounts.

The malware runs in the background, using MainActivity, AutoStartService, and RestartBroadCastReceiverAndroid features to carry out its routines and ensures these keep running to maintain persistence on the mobile device.

The MainActivity (launcher activity) is launched first to display the splash screen and then calls OnCreate() method for checking the device’s internet connection. It also records the malware installation timestamp. Permission\_Activity launched permission requests and later called AutoStartService, the malware’s main handler, and login\_kotak.

SMS campaign attack flow

> This malware’s continuing evolution highlights the need to protect mobile devices. Its wider SMS stealing capabilities might allow attackers to the stolen data to further steal from a user’s other banking apps. Its ability to intercept one-time passwords (OTPs) sent over SMS thwarts the protections provided by banks’ two-factor authentication mechanisms, which users and institutions rely on to keep their transactions safe.
> 
> Microsoft 365 Defender Research Team

To mitigate the threat, Android device users should disable the Unknown Sources option to prevent app installation from unverified sources. And they must rely on credible mobile security solutions to detect malicious apps.

1.  SpyNote Trojan (RAT); Yet Another Bad News for Android Users
2.  BRATA Android malware factory resets phones after stealing funds
3.  New MaliBot Android Malware Found Stealing Personal, Banking Data
4.  Fake Netflix, WhatsApp, Facebook Android Apps Contain SpyNote RAT
5.  New Russian Android Malware Tracks GPS Location and Spies on Victims

Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones

By Owais Sultan
Whenever a coin, stock, or market goes down you’ll have a lot of people blurting “I knew it…
This is a post from HackRead.com Read the original post: Is This The Crypto Winter or a Huge Discount?

Whenever a coin, stock, or market goes down you’ll have a lot of people blurting “I knew it was a bubble” or “I told you so.” This is human nature, this is something skeptical people do and have been doing forever. In contrast, fresh new investors then jump in blindly, while not doing research or educating themselves on the matter.

**What is even Crypto Winter?**

As the name implies, crypto winter is a period of time when the cryptocurrency market takes a significant downturn. This can be caused by various factors, such as regulatory uncertainty or a lack of mainstream adoption. During these times, investors may lose confidence in the market and sell off their assets, leading to further declines.

Crypto winter can be a difficult time for those involved in the market, but it can also present opportunities. For example, during periods of decline, new investors may be able to buy assets at lower prices. Additionally, companies may be more willing to accept crypto as payment during these times.

Overall, crypto winter can be seen as a natural part of the market cycle. While it can be challenging, it can also offer opportunities for those who are willing to weather the storm.

**What’s Next?**

But are we actually in an accumulation phase or is the market going to zero? Firstly, it is important to look at the data. Bitcoin or the crypto market has been annually going up every single year ever since it came into existence back in 2009.

Something the regular stock is not able to do. So does it look like the market or Bitcoin is going to zero? No, not really. However, that said, this might be the first time that we see the market close after a year with a mild loss.

This is something Bitcoin or the market have never done before – dropping below all the support lines or predictions of everyone, showing that what investors are dealing with is new.

The blockchain and the crypto market is still quite new despite their age saying otherwise.

So, with everyone’s predictions being wrong, does this make them question if it’s all, indeed, a bubble or rug pull? While a project like a blockchain is not a rug pull, coins on the blockchain market may as well be.

That’s why educating yourself on the matter is so vital to ever make it as an investor. Educating yourself on secure wallets and cryptocurrency is important to make sure your funds remain secure from malicious threat actors. Education is, in fact, something that separates a good user/investor from a great one.

**Should I pour my life savings into crypto now?**

Well, doing things like pouring your life savings into a crypto investment or any investment, for that matter, is not a smart move. Everyone knows that a market or an investment can go up and down regularly depending on the market or assets’ performance.

So, nothing in the finance world is ever certain. Since crypto investments are still unregulated, security risks are quite real. Of course, blockchain technology itself cannot be tampered with yet, but that doesn’t mean that someone can’t hack your e-wallet.

Rather than risking it all, educating yourself about crypto security and investment strategies might be more suited for you if you would ever consider something like using your life savings as investment capital.

It’s one thing to make a bad call and lose your investment but it’s something entirely different to have your investment stolen by hackers and having no authorities to complain to. That’s why every experienced investor protects their investment by using diversification and proper cybersecurity measures in case of crypto investments.

Featured/Top Image Via: Flickr

1.  The Lessons to Learn from Nomad Crypto Hack
2.  The Benefits Of Blockchain In The Travel Industry
3.  The Advantages of a More Secure and Safer Blockchain
4.  How Will Blockchain Technology Revolutionize Logistics?
5.  Naoris Protocol Will Use Blockchain To Plug Web3 Security Gaps

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Is This The Crypto Winter or a Huge Discount?

By Owais Sultan
In this article, we’ll be exploring the landscape of DeFi, demonstrating how the recent DeFiChain developments are set to innovate the industry as a whole and drive the usability of DeFi.
This is a post from HackRead.com Read the original post: How DeFiChain gives DeFi a major boost with innovative decentralized assets

Decentralized finance (DeFi) is an industry that provides a range of benefits to investors. From permissionless access to the complete transparency of blockchain, these systems allow users a new way to trade, buy, sell, and exchange.

With a total value of $40 billion (as of Feb 2021) locked in different protocols, the popularity of DeFi has become incredibly visible over recent months.

Processing from a small financial system into a global movement, DeFi has now reached every corner of our world. However, there are some apparent limitations of DeFi. As it’s a decentralized system, it cannot interact with centralized assets, meaning that stock options, commodities, and indices were off the table.

DeFiChain, a blockchain system, is set to change that, with its introduction of decentralized assets bridging the gap. In this article, we’ll be exploring the landscape of DeFi, demonstrating how the recent DeFiChain developments are set to innovate the industry as a whole and drive the usability of DeFi.

**How has the DeFi Landscape changed?**

Decentralized finance began with the creation of Bitcoin, with the creator intending it to be a digital currency that could be used without having to rely on centralized intermediaries. What started with a rejection of centralized banking and governance has grown into an incredibly rich and comprehensive ecosystem.

Currently, there are over 18,000 cryptocurrencies alongside Bitcoin as of July 2022. The second-largest cryptocurrency is Ethereum, which has a total market cap of over $140 billion, accounting for 15.3% of the total crypto market cap. One of the main reasons that Ethereum has grown to be so popular is the ease of creating decentralized applications on this system.

Ethereum has a fantastic level of documentation, comprehensive unit test frameworks, debuggers, critical developer tools, and a range of tutorials and other learning materials. Quite simply, it has absolutely everything that a developer would need when creating a decentralized application.

The dApp industry has steadily grown over recent years, spanning across financial, healthcare, education, and even property inventions. The versatility of the system, and the benefits of bringing blockchain to different industries, have made the creation of dApps a useful way of expanding the utility of this ecosystem.

DeFi has become all-encompassing, spanning across different industries and weaving its way onto the world’s stage. Yet, while decentralized finance does have a range of benefits, there are also areas in which it falls short. One of these main roadblocks is the fact that, as a decentralized system, it currently has no way of allowing investors to trade stocks on its platforms.

This is due to the fact that stocks are a centralized unit, making them incompatible with DeFi. While this was an issue that seemed insurmountable, the arrival of decentralized assets on the DeFiChain blockchain is set to change the industry forever. 

Let’s take a look at how DeFiChain is combating this issue for DeFi. 

**How DeFiChain’s Decentralized Assets boost the utility of DeFi**

While investors in DeFi can put money into their favorite cryptocurrencies and dApps, they have always fallen short at accessing actual stocks. However, with DeFiChain’s development of decentralized assets, this is all set to change.

A decentralized asset, also known as dAsset or dToken, is a token on the DeFiChain blockchain that gives you price exposure (not ownership) to real-world stocks. For the stocks, TSLA, APPL, FB, there exist dTSLA, dAPPL, dFB, each of which attempts to mirror the price of the real stock. Anyone can mint new dTokens by depositing BTC, DFI, USDT, USDC, or DUSD as collateral in the DeFiChain Vault.

These creations essentially mean that users of DeFiChain can buy a decentralized asset that aims to reflect the real asset, providing them with a method of trading stocks on a decentralized system. They seamlessly allow investors to diversify their portfolios without leaving the DeFi ecosystem.

Any user on the platform is able to mint tokens, with interest rates being based on the amount of collateral provided. These dAssets are then tradable on decentralized exchanges, meaning that users are able to trade their dTokens just like they would with real stocks. People who couldn’t buy US stocks due to geographical restrictions or other limitations can get price exposure to their favorite assets from anywhere in the world.

Just like that, DeFiChain bridges the impossible gap between centralized and decentralized systems without compromising their DeFi platform with centralism. With DeFiChain, what was once thought impossible has become a working reality. 

**Moving towards passive income**

One central aspect that is rarely achieved within centralized systems is passive income. While there are some elements to stock trading that could be considered passive income streams, like dividend payments, they are typically only around 5%, which is far less than one would need to see any substantial returns.

DeFi has a solution for this, found within any proof-of-stake system. Typically, users can put their proof-of-stake cryptocurrencies into a liquidity pool. These liquidity pools allow the proof-of-stake coins to validate transactions more quickly, allowing for scalability and rapid transaction processing.

The development of POS cryptocurrencies has solved the central problem that was impacting Ethereum, which has notoriously high ‘gas fees’ for completing transactions. As this network can only process around 30 transactions per second, with a potential demand seeking upwards of 100,000 transactions per second, there is a massive queue for processing on this blockchain.

To push transactions to the front of the queue and make sure that they are safely recorded into the next block, Ethereum asks users to pay a gas fee. This has made development within dApplications costly, as users that want instant transactions will always have to pay a fee. POS cryptocurrencies allow users to process many more transactions per second.

For example, Solana can produce 50,000 transactions each second, meaning there is never really a queue to process your transaction, there is almost no gas fee. This is achieved by creating large liquidity pools, with these pools filled with users’ cryptocurrency being used to validate transactions quickly.

In return for putting their POS crypto into these liquidity pools, users are given a reward in terms of passive income. Over time, you’ll be rewarded with interest in the cryptocurrency that you’ve put in. Whole industries have arisen from this ‘staking’ model, with people seeking to maximize their yields in a practice that’s known as yield farming.

People who stake crypto can expect to get anywhere from 10% – 100% annualized returns on their investment, making this an incredible opportunity for DeFi users. 

**How DeFiChain Takes This Further**

DeFiChain builds upon typical staking protocols and offers even further utility for its investors. While a traditional investor, after buying a stock, will only make money once they sell it at a profit, DeFiChain is changing the game. Once a user buys one of their dToken assets, they’re able to then put that into a liquidity mining pool.

Not only do they gain a profit from their dToken going up in value, but they are also able to get a passive income from putting their dAssets into these liquidity pools. This dual income strategy takes what’s phenomenal about yields within DeFi systems and brings it to dAssets.

With this integration, DeFiChain essentially innovates the field of DeFi, providing a whole new way to make money when taking on decentralized ecosystems. 

**Final Thoughts**

With the introduction of dAssets, DeFiChain has created a new investment pathway for DeFi that radically shifts what is possible within these ecosystems. What’s more, considering that these dTokens can then be entered into liquidity mining pools for additional rewards, this system also creates a new way of earning passive income.

The benefits of DeFiChain for investors are impressive, creating new systems and then pushing that system as far as possible for user benefit. With future plans to bring the actual stock price and the dAsset price closer than ever, through their DeFiChain Improvement Proposal (DFIP), this system will be incredibly advantageous to users.

While still only a young blockchain, with innovative features, exciting updates, and future foresight, DeFiChain is shaping up to be an industry-changing blockchain ecosystem.

1.  The Benefits Of Blockchain In The Travel Industry
2.  This AI Can Generate Unique and Free Bored Ape NFTs
3.  If Bitcoiners Want Bitcoin To Make It Big, They Need DeFi
4.  If the Ethereum Merge Fails, L2s Will Be More Vital Than Ever
5.  Naoris Protocol Will Use Blockchain To Plug Web3 Security Gaps

How DeFiChain gives DeFi a major boost with innovative decentralized assets

By Deeba Ahmed
Dubbed AttachMe by researchers; the vulnerability was a severe one since it targeted all OIC customers.
This is a post from HackRead.com Read the original post: AttachMe – Oracle Patches  “Severe” Vulnerability in its Cloud Infrastructure

Wiz security researcher Elad Gabay reported that they discovered a critical vulnerability in the Oracle Cloud Infrastructure (OCI), which a customer may have exploited to read/write another customer’s data on the same platform without permission.

This means the vulnerability could allow any Oracle customer unauthorized access to the Cloud storage data of another customer.

The good news is that when Wiz researchers notified Oracle about the bug, the IT firm fixed it within 24 hours. The even better news is that customers don’t need to do anything regarding the fix.

**Vulnerability Analysis**

Dubbed AttachMe by researchers, the vulnerability is one of the best examples of cloud isolation vulnerabilities and how threat actors can exploit the flaws to gain unauthorized access to someone else’s data.

The vulnerability, according to Wiz’s blog post, was discovered by Wiz in June 2022 and was regarded as one of the severest cloud vulnerabilities that could impact all OCI customers and violate cloud storage’s most significant pledge of customer data safety.

> AttachMe is one of the most severe cloud vulnerabilities reported since it could have impacted all OCI customers. Cloud isolation vulnerabilities usually impact a specific cloud service. However, in this case, the impact is related to a core cloud service. 
> 
> Elad Gabay – Wix

1.  Attackers Exploit Oracle WebLogic Flaw to Mine $266K in Monero
2.  Oracle, Google, and Microsoft generated most vulnerabilities in 2021
3.  Oracle’s Point-of-service Division MICROS Suffers Massive Data Breach
4.  Hackers Use Malware To Steal Cisco, IBM and Oracle Certification Manager

**Exploiting the Vulnerability**

Gabay said the flaw was exploitable if the threat actor knew the Oracle Cloud Identifier for a customer’s storage volume. Since this identified isn’t confidential data, it was possible to attach that volume to the actor’s virtual machine in Oracle’s cloud if the volume was not attached already or supported multiple attachments.

Therefore, all the attacker needed was the identifier to attach a volume and access the storage volume, including the target user’s sensitive data. Perhaps the flaw emerged because Oracle Infrastructure didn’t verify permission for linking the storage, which caused the issue.

After hijacking someone’s cloud storage, a threat actor could perform several destructive acts, such as leaking sensitive data, altering code, and gaining privilege escalation. Nevertheless, since the vulnerability has been fixed, users should not be worried.

**More Vulnerability News**

1.  Critical WordPress plugin vulnerability allowed wiping databases
2.  Attackers exploiting Windows Installer vulnerability despite patching
3.  Critical Amazon Ring Vulnerability Could Expose Camera Recordings
4.  Attackers can Exploit Dirty Pipe Linux Vulnerability to Overwrite Data
5.  Rarible NFT Market Vulnerability Let Attackers to Transfer Crypto Assets

AttachMe – Oracle Patches  “Severe” Vulnerability in its Cloud Infrastructure

By Deeba Ahmed
According to Certik blockchain cybersecurity firm, a vulnerable private key generated by the Profanity vanity address generator is responsible for this attack.
This is a post from HackRead.com Read the original post: Crypto Market Maker Wintermute Hacked, $160 Million Stolen

The London, England-based cryptocurrency market maker Wintermute announced becoming the target of a cyberattack and hackers stole $160 million from its DeFi (decentralized finance) operation. 

On Tuesday, the company confirmed that the hack was restricted to its DeFi operations, and OTC (over the counter), lending, and Cefi services remained unaffected. However, its service may be disrupted for a day.

The algorithmic trading firm, Wintermute, was founded in 2017. Currently, it trades billions of dollars in both decentralized and centralized cryptocurrency trading platforms. 

**Hack Details**

According to Certik blockchain cybersecurity firm, a vulnerable private key generated by the Profanity vanity address generator is responsible for this attack. As per Certik’s analysis, the vulnerability exploited by the attackers has been known since January.

The attacker (s) used the leaked or brute-forced private key instead of leveraging a smart contract vulnerability and obtained a privilege escalation feature to specify that the “swap contract was the attacker-controlled contract.” 

The Profanity vulnerability was disclosed and disclosed by 1inch Network in its blog post published on September 13th and also warned about it on Twitter.

> Profanity is one of the most popular tools due to its high efficiency. Sadly, that could only mean that most of the Profanity wallets were secretly hacked.
> 
> 1inch Network

**Over $200 Million in DeFi Debt**

The company reportedly has more than $200 million in outstanding DeFi debt. The largest debt loosed by TrueFi is around $92 million Tether (USDT) and it is due to mature on 15 October 2022. Another lender is Maple Finance whom Wintermute owes $75 million in USDC and wrapped ether. The company owes $22.4 million to Clearpool.

In one of the tweets, the company’s creator and CEO Evgeny Gaevoy said:

>  “If you are a lender to Wintermute, again, we are solvent, but if you feel safer to recall the loan, we can absolutely do that We are solvent with twice over that amount in equity left.”

Most of the debt issued is in stablecoins but it is unclear if the company’s mention of Equity covers digital assets too.

**Targeted Assets**

Garvey explained that around 90 assets were targeted in the hack. Two of them have been notional for more than $1 million and none of them were notional for over $2.5 million. Furthermore, Gaevoy insisted that Wintermute market maker customers having agreements with the company should not worry about it.

> “If you have a MM agreement with Wintermute, your funds are safe. There will be a disruption in our services today and potentially for the next few days and will get back to normal after.”
> 
> Evgeny Gaevoy

It is worth noting that the company is considering it as a white hat event and has requested the attacker to contact them.

> Out of 90 assets that has been hacked only two have been for notional over $1 million (and none more than $2.5M), so there shouldn’t be a major selloff of any sort. We will communicate with both affected teams asap
> 
> — wishful cynic (@EvgenyGaevoy) September 20, 2022

Wintermute is just one of the many high-profile cryptocurrency firms that have become targets of hackers in 2022. Previously, blockchain bridge Wormhole suffered $320 million in losses, and Ronin Network suffered a whopping $600 million in losses.

1.  BitMart Exchange hacked as hackers steal $150 million
2.  N Korean hackers stole $1.7 billion from cryptocurrency exchanges
3.  8,000 Solana Wallets Drained Millions Worth of Crypto in Cyberattack
4.  Hackers Used Fake LinkedIn Job Offer to Hack $625M from Axie Infinity
5.  $182 Million From Ethereum-based Beanstalk Stablecoin Protocol Stolen

Crypto Market Maker Wintermute Hacked, $160 Million Stolen

By Owais Sultan
Phishing scams are sneaky and often difficult to detect. These types of cyber attacks involve cybercriminals sending emails,…
This is a post from HackRead.com Read the original post: The Types of Phishing Attacks and How to Dodge All of Them

Phishing scams are sneaky and often difficult to detect. These types of cyber attacks involve cybercriminals sending emails, texts, or websites that appear to be from a trusted source but are not. The goal of this type of social engineering tactic is to trick unsuspecting users into giving up sensitive information.

In fact, phishing is one of the most common and successful hacker attacks. One of the contributing factors is that 97% of people are unable to recognize this type of scam. 

In this blog post, we will look at different types of phishing and how you can avoid being a victim of this kind of cybercrime.

**Email Phishing**

The most common form of phishing is email phishing, which has been around since the 1990s. In fact, a phishing assault occurs in one out of every 99 emails, according to an examination of more than 55 million emails. These scam emails are sent by hackers to any address they can find. Typically, the email service provider warns you about potential phishing scams and requests that you respond quickly.

In some cases, an email may ask you to click on a link and verify your account. Legitimate companies will never ask you to provide sensitive information via email. If you get a message that seems suspicious, don’t open the email or click on any links. Instead, contact the company through a different channel, such as their customer service number or website.

If you want some extra protection, try using a program that can help you detect phishing emails. Some email security solutions are designed to protect you against phishing attacks. These tools can scan your emails for suspicious links, domain names, and other indicators that the email might be a phishing scam. It’s a great way to prevent cybercriminals from getting what they want.

**Search Engine Phishing**

In search engine phishing, commonly referred to as SEO poisoning or SEO Trojans (and lately ransomware), hackers attempt to rank highly in a search engine. Your visit to the hacker’s website is facilitated by clicking on the link that is presented within the search engine.

In this type of situation, you need to trust your cyber instincts. Always pay attention if the website URL is incorrect or sounds suspicious. If you have any doubts, _don’t_ visit it.

Another solution here would be to block suspicious domains with an extension.

Anti-phishing extensions are beneficial as they can warn you if you’re visiting a suspicious website. 

Some of the well-known anti-phishing services that are available to protect your privacy from online phishing attempts include extensions like Netcraft and Cryptonite.

A hacked website used in delivered Gootloader malware through Google

**Vishing **

Vishing, often known as voice phishing, is the use of telephones to carry out phishing attacks. A vishing phone call aims to trick you (it recently tricked one of Cisco employees) into disclosing financial and personal information, including account numbers and passwords.

The fraudster may assert that your account has been compromised, represent your bank or law enforcement, or offer to assist you in installing software. 

The best way to protect yourself from vishing is through knowledge, as even password managers can’t help to avoid human mistakes. Hang up if a person or a recording calls you and asks for personal information. Call the company directly to confirm the request if the call appears to be from a reliable source.

**Smishing**

Smishing is a type of phishing attack where SMS is used. Due to the fact that people are more inclined to believe a message received through a messaging app on their phone than one sent via email, it is really popular.

Smishing attack via WhatsApp

Your name and location could be used by the smishing criminal to address you specifically. The message may sound more authentic because of that. Usually, a smishing message will contain a link to the website. The link could take you to a site that steals login credentials or malware that can infect your phone directly.

The malware can then be used to discreetly communicate private information to a server under the attacker’s control or to spy on your smartphone activity. To avoid that, you should keep in mind a few things to better defend yourself from these threats. Firstly:

*   Don’t respond.
*   Call your bank or merchant if doubtful.
*   Avoid opening links sent via text message. 
*   Make sure to check the number of the message, as unknown numbers are usually fake.

**Conclusion**

Information is power, and knowledge is the key to preventing yourself from becoming a victim of phishing attacks. The more you know about these cyber-based threats, like phishing, vishing, and smishing, and how they affect your online life, the less likely you are to fall victim to one. 

1.  How to detect phishing images in emails
2.  Phishing Scams: 5 Excellent Tips That Will Protect You
3.  Scammers Leveraging Microsoft Team GIFs in Phishing Attacks
4.  Hoxhunt Primed to Spread Gamified Phishing Awareness in the Enterprise
5.  ‘Important Notification’ Phishing Scam Targeting American Express Customers

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

The Types of Phishing Attacks and How to Dodge All of Them

By Waqas
According to Kiwi Farms' creator Joshua Moon, the site has become a victim of a data breach leading to hijacking his administrator account and possibly users' accounts.
This is a post from HackRead.com Read the original post: Kiwi Farms Website Hacked! Admin Warns of Data Leak

Kiwi Farms is a website that hosts user-generated content and discussion forums. The site has been accused of doxing, harassment, and cyberbullying. Last month Hackread.com reported about Kiwi Farms and Cloudflare issues and now, reports are that the website has been hit by a cyber attack.

According to Kiwi Farms’ creator Joshua Moon, the site has become a victim of a data breach leading to hijacking his administrator account and possibly users’ accounts.

**Data Breach Details**

Cybersecurity researcher Kevin Beaumont says that someone hacked Kiwi Farms website and proxy service after which all avatars were replaced with the logo of another “free speech” forum, and deleted every node on the forum index one at a time.

However, since Kiwi Farms had backups, none of the data was deleted permanently but the personal information of users could have been compromised.

**How The Hack Occurred?**

According to Joshua Moon, the site’s offshore hosting provider was compromised, and the hacker(s) accessed an unknown number of user accounts and his admin account using the session hijacking technique.

In this method, the attacker obtains authentication cookies set by the site after an account holder logs in successfully by entering valid authentication credentials and completing 2FA verification.

The attacker could perform this technique after uploading malicious content on a site XenForo, which Kiwi Farms uses to run its user forums. 

Per Moon, the attacker uploaded a webpage disguised as a ‘.opus’ audio file on XenForo and elsewhere may be through an inline frame. This caused random users to generate automated requests and send their authentication cookies outside of the site. The attacker then used them to access their accounts.

The same mechanism was used to hack Moon’s admin account. Once there, the attacker issued a command for XenForo to send data of all users, but the system logs couldn’t fulfill this command.

Homepage of Kiwi Farms at the time of publishing this article

**What Data was Leaked?**

Moon stated that he was unsure if user information was leaked. Analysis of his access logs revealed that the attackers tried to download all user records in one go, which caused an error, and the attempt remained fruitless.

Moon assured users of Kiwi Farms that their emails, posts, usernames, recent activity, and other sensitive data were safe. However, the possibility that the attacker issued other commands or scripts that were successfully executed cannot be ruled out at this point, Moon noted.

Launched in 2013, Kiwi Farms has remained in hot waters lately. The forum has been accused of cyberbullying and frequently targeting non-binary, transgender people, LGBTQ community members, and females.

Cybersecurity experts had long anticipated hackers would eventually target the site because of its involvement in swatting and doxing activities. Eventually, on Monday, the forum’s creator posted a notice on the site to alert users about the hack, claiming that user passwords, IP addresses, and emails may have been stolen.

1.  New tool lets teens report, remove their nude photos online
2.  Firm calls cops on researcher for responsibly disclosing data leak
3.  4chan hackers tried changing voting results of NASA student challenge
4.  WT1SHOP Cybercrime Market Seized by US and Portuguese Authorities
5.  FBI Seizes RaidForums and Arrests Alleged Founder Diogo Santos Coelho

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Kiwi Farms Website Hacked! Admin Warns of Data Leak

By Deeba Ahmed
LockerGoga ransomware has been targeting industrial organizations since around 2019.
This is a post from HackRead.com Read the original post: No More Ransom Offers Free Decryptor to LockerGoga Ransomware Victims

There is good news for victims of LockerGoga ransomware. They can recover their files for free with a new decryption tool. The decryption tool is available through the No More Ransom project.

The decryptor was published by cybersecurity firm Bitdefender on Friday, in collaboration with the Zürich Public Prosecutor’s Office, Europol, and the Zürich Cantonal Police.

**LockerGoga ransomware**

LockerGoga ransomware has been targeting users since around 2019. It was mainly used in cyberattacks against industrial organizations. Its key targets include the Norway-based energy and metal firm Norsk Hydro, French engineering consulting firm Altran, and American chemical manufacturer Momentive and Hexion.

LockerGoga ransomware operator is supposedly associated with a cybercrime gang, which also used MegaCortex ransomware and Dharma malware strain. It is worth noting that decryptor for MegaCortex ransomware victims will also be released soon.

According to researchers, LockerGoga ransomware gang hasn’t been too active since October 2021. By the same time, Europol had started working with law enforcement authorities from the US, the Netherlands, Norway, France, Germany, Ukraine, the USA, and Switzerland to arrest the 12 alleged members of the LockerGoga ransomware gang.

According to the Zürich Public Prosecutor’s Office, the investigation teams spent months analyzing the data gained during the Oct 2021 raid. They discovered private keys to help unlock the data from numerous ransomware attacks. Working with partner organizations, the prosecutors created a universal decryption tool using the master decryption key.

The attackers are accused of launching ransomware attacks on over 1,800 people/entities across 71 countries. Bitdefender’s director of threat research and reporting, Bogdan Botezatu, stated that the LockerGoga ransomware attacks caused damages of around $104 million.

LockerGoga ransowmare’s ransom note

The decryption keys were obtained from a specific actor already detained in Zürich and will be facing money laundering and hacking charges. Affected individuals are urged to file criminal complaints against the hackers if they haven’t already done that.

Cybersecurity experts believe that this gang is a third-tier ransomware group and has successfully launched large-scale attacks without having a force multiplier of a RaaS offering.

> Indicators of a LockerGoga infection are the presence of files with a ‘.locked’ Iextension. If you or your company have been affected by LockerGoga, you can now use the tool below to recover your files for free. 
> 
> Bitdefender

The direct download of the decryptor is available here or you can visit No More Ransom Project’s website for more information.

1.  Universal decryptor key for Sodinokibi, REvil ransomware released
2.  How to decrypt your data from Hakbit & Jigsaw ransomware for free
3.  First Ransomware to Exploit Telegram Cracked and Decryptor Published
4.  GoodWill Ransomware demands food for the poor to decrypt locked files
5.  Programmer hacks attacker; releases decryption Mushtik ransomware keys