In the past month, we have observed additional BGP hijacks of authoritative DNS servers with a technique similar to what was used in April. This time the targets included US payment processing companies. In April 2018, we detailed a brazen BGP hijack of Amazon’s authoritative DNS service in order to redirect users of a crypto currency wallet service to a fraudulent website ready to steal their money.
This week, the start-up said that a wallet being used to ‘upgrade’ smart contracts was compromised. This wallet was then used to withdraw $12.5 million in Ethereum (ETH), alongside $1 million in Pundi X (NPXS) and $10 million in Bancor Network Tokens (BNT). Bancor says that once the compromised wallet was identified the company was able to mitigate the damage by freezing the transfer of BNT, bringing the cost down to roughly $13.5 million.
A jury trial found a former engineer at a Navy contractor guilty of stealing trade secrets regarding Navy projects by uploading the files to his personal Dropbox account. The man, Jared Dylan Sparks, 35, of Ardmore, Oklahoma, worked as an electrical engineer for LBI, Inc., a company authorized to build unmanned underwater vehicles (drones) for the US Navy’s Office of Naval Research, and weather data-gathering buoys for the National Oceanic and Atmospheric Administration (NOAA). Sparks worked for LBI from January 2010 to December 2011, when he left for a similar position at Charles Rivers Analytics (CRA), another Navy contractor.
The following is intended to provide technical details for those with interest in the specifics of the information security incident Timehop has experienced. It is also to be transparent about what has happened, and correct some earlier inaccuracies. There are still some highly specific details we are withholding about an incident that remains the subject of ongoing investigations.
Source: timehop.com
A hacker has gained access to a developer’s npm account and injected malicious code into a popular JavaScript library, code that was designed to steal the npm credentials of users who utilize the poisoned package inside their projects. The JavaScript (npm) package that got compromised is called eslint-scope, a sub-module of the more famous ESLint, a JavaScript code analysis toolkit. The hack took place on the night between July 11 and 12, according to the results of a preliminary investigation posted on GitHub a few hours ago.
We found the full story in what’s called the Sentencing Position document filed by the United States of America in its federal court case against Theresa Tetley, aka the “Bitcoin Maven”. The Bitcoin Maven (a maven, in case you are wondering, is an expert or connoisseur) had already pleaded guilty to money laundering charges relating to bitcoins; this time she was back in court to be sentenced. Simply put, Tetley did indeed buy bitcoins for hard cash, according to the prosecutors.
A team of academics from the University of California, Irvine (UCI), have presented a type of attack that could enable a malefactor to retrieve sensitive information you entered via your keyboard – possibly up to a minute after you typed it. The researchers had 30 users enter 10 different passwords, both strong and weak, on four common external keyboards. Using a thermal imaging camera, the researchers then scanned the residual heat left on the recently-pressed keys.
Cryptocurrencies like Bitcoin can be analysed because every transaction is traceable. This means that they are an attractive system for physicists to study. In a paper published in EPJ B, Leonardo Ermann from the National Commission for Atomic Energy in Buenos Aires, Argentina, and colleagues from the University of Toulouse, France, have examined the structure of the Bitcoin-owner community by looking at the transactions of this cryptocurrency between 2009 and 2013.
NSO Group sells some of the most potent, off-the-shelf malware for remotely breaking into smartphones. Some versions allow a law enforcement or intelligence agency to steal essentially all meaningful data from an iPhone with no interaction from the target. Others just require the victim to click one link in a carefully crafted text message, before giving up their contacts, emails, social media messages, GPS location, and much more.
One board member described the police’s justification for the raids as a ‘tenuous’ link between the privacy group, a blog, and its email address. In the early morning on June 20, German security services raided the homes of several board members of Zwiebelfreunde, a non-profit group that helps to support privacy and anonymity projects. Moritz Bartl in Augsburg, Jens Kubieziel in Jena, and Juris Vetra in Berlin were raided, as was the home of a former board member who still had access to the board’s bank accounts.
Announcing the first excerpt to a literary work consisting of two parts. The excerpt is provided. I wanted to include it as a brief glimpse of history.
Even for those that can’t read the full book, I wanted to make this available to everyone. A short story if you will, with some of the most brought up questions and answers. I wanted the people and the facts to be known.
The Trezor team says ‘signs point toward DNS poisoning or BGP hijacking’ as the means attackers hijacked legitimate traffic meant for the official wallet.trezor.io domain but redirected these users to a malicious server hosting a fake website. An investigation is still underway to determine the exact cause. The incident came to light after users complained that they encountered an invalid HTTPS certificate when landing on Trezor’s web wallet portal.
In late 2016, Google’s security team scrambled to fix a critical vulnerability that allowed attackers to gain unfettered root access to Android devices by using a relatively new class of exploit that manipulates data stored in memory chips. Now, 21 months later, many of the same researchers behind the attack, dubbed Drammer, are back to say that a large number of Android phones and tablets remain vulnerable to the rooting attacks because the patches Google deployed weren’t adequate. The original Rowhammer attack against PCs made it possible for an untrusted computer application to gain nearly unfettered system privileges or to bypass security sandboxes designed to keep malicious code from accessing sensitive operating system resources.
Bad news for Samsung phone owners: some devices are randomly sending your camera roll photos to your contacts without permission. As first spotted by Gizmodo, users are complaining about the issue on Reddit and the company’s official forums. One user says his phone sent all his photos to his girlfriend.
The messages are being sent through Samsung’s default texting app Samsung Messages. According to reports, the Messages app does not even show users that files have been sent; many just find out after they get a response from the recipient of the random photos sent to them. A Samsung spokesperson tells The Verge it’s “aware of the reports” and that its technical teams are “looking into it.”
European law enforcement agencies dismantled a Darknet drug trafficking network, seizing almost 800,000 doses of LSD and over $5 million in Bitcoin, IOTA, and Lumens. Ulbricht, better known by his deep web pseudonym, “Dread Pirate Roberts,” was charged with narcotics trafficking, computer hacking, and money laundering after his arrest at the Glen Park Branch Library in San Francisco on October 1, 2013. The FBI seized 144,336 Bitcoins during the Silk Road bust, which they auctioned for a meager $48 million.
In a novel investigative strategy, rather than just following the money, investigators went undercover as someone converting Bitcoin into cash, exploiting a financial bottleneck faced by dark web criminals. Law enforcement agencies are always looking for new ways to identify suspects on the dark web, whether that means using malware to unmask people, executing wide ranging attacks on the Tor anonymity network, or tracking a drug dealer’s physically mailed packages. But on Wednesday, the Department of Justice announced dozens of dark web arrests thanks to a relatively novel technique.
The lifting of the ban – put in place in January amidfears that ads were used for fraud –was welcomed by industry figures, with some saying that itindicated the firm’s recognition of the potential of bitcoin and other cryptocurrencies. But perhaps more significant than the immediate implications for cryptocurrency firms is what the movesignals about Facebook’s own ambitions. Last month, the social network announced its biggest ever management reshuffle, which included the launch of an exploratory blockchain group that reports directly to the company’s CTO, Mike Schroepfer.
Ticketmaster has warned customers that their personal information may have been compromised, after malicious code was discovered running on its website. Up to 40,000 UK customers who purchased, or attempted to purchase, tickets between February and June 23, 2018 are thought to be affected. In addition, international customers who purchased, or attempted to purchase, tickets between September 2017 and June 23, 2018 may also be at risk.
In 2016, a group of self-described hackers started releasing a steady stream of code stolen from the NSA. As well as dumping some hacking tools publicly, such as exploits that were later incorporated into the crippling WannaCry ransomware attack, the so-called Shadow Brokers also listed more tools on a dedicated online shop and a “monthly dump service” to access additional code. A team of University College London (UCL) researchers recently found likely evidence of payments for those alleged exploits by examining transactions in Zcash, a privacy-focused cryptocurrency that the Shadow Brokers asked potential customers to use, and traced the movement of some of the coins to a specific cryptocurrency exchange.
California lawmakers unanimously passed a new privacy bill on Thursday that would give residents of the state more control over the information businesses collect on them and impose new penalties on businesses that don’t comply. It is the first law of its kind in the United States. The so-called California Consumer Privacy Act of 2018 (AB 375) was introduced late last week by state assemblymember Ed Chau and state senator Robert Hertzberg, in a rush to defeat a stricter privacy-focused ballot initiative that had garnered more than 600,000 signatures from Californians.