By ghostadmin
Ferrari, the renowned Italian luxury car manufacturer, suffered a cyber incident that compromised the company’s client data. According…
This is a post from HackRead.com Read the original post: Ferrari Discloses Ransomware Attack; Refuses to Pay Ransom

Ferrari, the renowned Italian luxury car manufacturer, suffered a cyber incident that compromised the company’s client data. According to a statement released by Ferrari, the incident resulted in unauthorized access to certain company systems.

The company has not disclosed the exact nature of the attack, but it has confirmed that it involved a ransomware attack.

“Ferrari N.V. announces that Ferrari S.p.A., its wholly-owned Italian subsidiary, was recently contacted by a threat actor with a ransom demand related to certain client contact details,” the statement said.

**More Context**

1.  Ferrari Subdomain Hacked to Host NFT Scam
2.  Automotive Industry Have Major API Vulnerabilities
3.  Denso ransomware attack – Pandora gang steals data

The cyber incident is a significant blow to Ferrari’s reputation, given the company’s image as a symbol of luxury and exclusivity. The company has always prided itself on its attention to detail and its commitment to excellence, but this incident suggests that it may have been vulnerable to cyber threats.

Ferrari has not disclosed the extent of the data breach, but it has confirmed that some of its data was stolen by hackers. The company has also revealed that it was asked to pay a ransom to the hackers to prevent the stolen data from being made public. However, it made its stance clear in the refusal to pay the ransom. The amount of the ransom demanded has not been disclosed. 

“As a policy, Ferrari will not be held to ransom, as paying such demands funds criminal activity and enables threat actors to perpetuate their attacks,” the company said.

“Instead, we believed the best course of action was to inform our clients and thus we have notified our customers of the potential data exposure and the nature of the incident,” Ferrari said.

The incident underscores the importance of cybersecurity for all businesses, regardless of their industry or size. Even companies as prestigious as Ferrari are not immune to cyber threats, and they must take proactive steps to protect themselves against cyber attacks.

Ferrari has said that it is cooperating with law enforcement agencies to investigate the incident and has also engaged a third-party cybersecurity firm to help bolster its defences against future cyber threats. The company has also pledged to take all necessary measures to protect its customers’ and stakeholders’ data. It further confirmed that the breach did not affect the operational functions of the company.

The incident should serve as a wake-up call for other companies to take cybersecurity seriously and to invest in robust cybersecurity measures. Cyber threats are an ever-present danger in today’s interconnected world, and businesses must remain vigilant and proactive to protect themselves and their customers from cybercriminals.

In conclusion, the cyber incident at Ferrari is a reminder that no company is immune to cyber threats. Ferrari’s response to the incident demonstrates the importance of transparency and accountability in the face of a cyber attack. It also highlights the need for all businesses to prioritize cybersecurity and invest in comprehensive cybersecurity measures to protect themselves and their customers.

1.  PGA Golf Championship hit with Bitcoin ransomware
2.  Hackers show US Police Dept Vehicles can be hacked
3.  LockBit Ransomware Data Breach at SpaceX Contractor

Ferrari Discloses Ransomware Attack; Refuses to Pay Ransom

By Habiba Rashid
Are you wondering why your ChatGPT conversation history has been unavailable since yesterday? Well, here is why!
This is a post from HackRead.com Read the original post: ChatGPT Bug Exposes Conversation History Titles

****A ChatGPT user on Reddit first reported the bug after noticing Chinese language characters in the title of their conversation history.****

Recently, a major bug has been affecting ChatGPT, the language model trained by OpenAI, which resulted in the exposure of conversation histories and caused a temporary outage.

This bug has raised concerns over users’ privacy as some users were able to see other people’s conversation histories. Although the issue was first reported on Reddit by a user who suspected that their account was hacked, it turned out that the bug was responsible for the display of Chinese text in the sidebar.

“I never had these conversations, Reddit user

After the news spread, other users on Twitter also claimed to have seen someone else’s chat histories on their accounts.

Many users criticized ChatGPT for the exposure of conversation histories, calling it a severe violation of user privacy. However, it is important to note that the bug only leaked conversation titles and not the full histories.

Following the incident, ChatGPT temporarily disabled its chat service on Monday to investigate and fix the bug. The chat sidebar now states that the history feature is temporarily unavailable and will be restored as soon as possible.

This ChatGPT bug that exposed conversation histories highlights the need for robust privacy and security measures in online communication platforms. It serves as a reminder of the vulnerability of online communication and the importance of keeping sensitive information secure.

1.  ChatGPT Clone Apps Collecting Data on iOS, Play Store
2.  Hackers Exploiting OpenAI’s ChatGPT to Deploy Malware
3.  Alert: Scammers Pose as ChatGPT in New Phishing Scam
4.  Polymorphic Blackmamba malware created with ChatGPT
5.  Russian Hackers Eager to Bypass Restrictions in ChatGPT

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

ChatGPT Bug Exposes Conversation History Titles

By Waqas
One of the Breach Forums administrators who goes by the alias Baphomet has decided to shut down the forum permanently.
This is a post from HackRead.com Read the original post: Breach Forums to Remain Offline Permanently

****The decision to shut down the Breach Forums came after the admin noticed someone had logged into an old forum CDN server on March 19th, 1:34 EST, 2023, indicating that federal authorities had access to Fitzpatrick’s devices.****

Hackread.com has learned that the infamous hacker and cybercrime forum Breach Forums has been permanently shut down. On March 18th, 2023, it was reported that Conor Brian Fitzpatrick (aka Pompompurin, aka Pom), the owner, founder, and administrator of Breach Forums, was arrested in New York.

The question regarding the forum’s future after Fitzpatrick’s arrest was echoed across different forums, with speculations about whether the forum would be seized by authorities, like its predecessor forum Raid Forums.

The day the news of Fitzpatrick’s arrest surfaced, one of its administrators, who goes by the alias Baphomet, claimed responsibility for taking over the forum to keep it running and protect it from being seized. They also claimed to have cut all of Fitzpatrick’s access to the forum.

However, in a statement made on the official Telegram channel of Breach Forums earlier today, Baphomet has announced the permanent shutdown of the forum. In a statement, Baphomet apologized to forum users for any inconvenience and emphasized that their decision was made for the betterment and safety of everyone.

It is worth noting that Baphomet plans to start a new Breach Forums-like community in the near future. However, for now, all forum domains will be redirected to a website owned by Baphomet.

**Reason for Sudden Shutdown**

The initial plan of administrator Baphomet was to keep Breach Forums online, but what changed their mind? In a statement, the administrator explained that the decision to shut down the forum came after they noticed someone had logged into an old forum CDN server on March 19th at 1:34 EST, 2023, which indicated that federal authorities had access to Fitzpatrick’s devices.

Baphomet stated that running a forum with the fear of law enforcement access would be risky, and the best solution for everyone’s safety was to permanently shut it down. Here’s what Baphomet had to say:

    This will be my final update on Breached, as I've decided to shut it down. I'm aware this news will not please anyone, but it's the only safe decision now that I've confirmed that the glowies likely have access to Pom's machine.
    
    As I said early on in all of this, anything related to production Breached infrastructure was locked down immediately - however I was kind enough to leave a few old, non-essential servers completely unchanged. One of those servers I left unchanged is an old CDN from months ago that no longer hosts any CDN files or configs but rather was used to just download large files from time to time.
    
    Throughout the migration I checked to see if anything was going on that would cause concern during the migration. One of the servers checked was the old CDN server described above. It seems someone logged in on Mar 19, 1:34 EST prior to me logging into the server. 
    
    Unfortunately this likely leads to the conclusion that someone has access to Poms machine. Any servers we use are never shared with anyone else, so someone would have to know the credentials to that server to be able to login. I now feel like I'm put into a position where nothing can be assumed safe, whether it is our configs, source code, or information about our users - the list is endless. This means that I can't confirm the forum is safe, which has been a major goal from the start of this shitshow.
    
    As for what this means now, It's complicated. Unlike when other communities go down and everyone scatters, stupidly I will still be around. I will redirect all the Breached domains to my baph.is domain. The Telegram group and channel will remain up for now, but I will make a new Telegram group for those interested in seeing what I have planned next. I will always be willing to sign a message to prove my identity to the community.
    
    While the community of Breached will die, I'm going to continue conversations with some of the competitor forum admins and various service operators who reached out to me over the past few days. I'm hoping to work with some of those people to build a new community, that will have the best features of Breached while reducing the attack surfaces we never properly addressed. As with things like this, I have no doubt our userbase may be absorbed by another community but if there is patience then I hope to bring something back that will rival any other community that can take our place.
    
    I'll be taking 24 hours from the sharing of this message to just rest and think. I'll be back online to talk with everyone, and we'll go from there. The domains for the time being shouldn't be seized, but I'll let the community know if any of that happens.
    
    For now - see you, space cowboy.
    
    Baphomet

**What’s Next?**

Although the shutdown of Breach Forums is seen as a positive initiative, for investigators, cybersecurity journalists, and researchers, it may become a rabbit hole. With no reliable community to turn to, cybercriminals could move to Russian-language forums to dump stolen databases, which is a bigger and larger-scale threat to unsuspecting users and organizations.

It is worth noting that Russian hacker forums are already forming alliances with Chinese-speaking hacker groups, which could eventually become a perfect recipe for disaster for adversaries on the opposite side.

1.  WT1SHOP Cybercrime Market Seized
2.  SSNDOB Cybercrime Marketplace Seized
3.  World’s largest private torrent site Filelist seized
4.  Hive ransomware disrupted; servers, site Seized
5.  NetWire malware site, server seized, admin arrested

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Breach Forums to Remain Offline Permanently

By Habiba Rashid
The company has disclosed the wallet addresses and three IP addresses used by the attacker in the hack.
This is a post from HackRead.com Read the original post: Crypto ATM Manufacturer General Bytes Suffers $1.5m Bitcoin Theft

****The hacker was able to download usernames, access password hashes, turn off two-factor authentication, and send funds from hot wallets.****

On March 17th, 2023, General Bytes, a major manufacturer of cryptocurrency automated teller machines (ATMs), experienced a security incident that resulted in the theft of over $1.5 million worth of Bitcoin. The incident was first reported by General Bytes on their official Twitter account on March 18th.

On Saturday, the company explained, “We released a statement urging customers to take immediate action to protect their personal information. We urge all our customers to take immediate action to protect their funds and personal information and carefully read the security bulletin.”

According to the company’s security bulletin, an attacker was able to remotely upload a Java application using the master service interface, which allowed access to BATM user privileges, the database, and API keys used to access funds in hot wallets and exchanges.

As a result, the hacker was able to download usernames, access password hashes, turn off two-factor authentication, and send funds from hot wallets.

General Bytes has produced 9,505 ATM machines globally, thousands of which are located in the US. However, following the attack, all US operators using General Bytes machines were shut down, and the servers will have to be rebuilt from scratch.

General Bytes is reportedly transitioning crypto ATM operators to self-hosted servers after discontinuing its cloud service. This process can be time-consuming, and it is likely that some operators will be offline for an extended period.

The hacker was able to steal 56.28 bitcoin, worth around $1.5 million, and liquidated other cryptocurrencies, including ETH, USDT, BUSD, ADA, DAI, DOGE, SHIB, and TRX. The bitcoin address holding the stolen funds has not moved since March 18, and some digital currencies were transferred to different locations, including a decentralized exchange platform.

The company has disclosed the wallet addresses and three IP addresses used by the attacker in the hack. However, some sources have indicated that the company’s full node is secure enough to prevent unauthorized access to funds.

If you or someone you know has been affected by this incident, follow the solution detailed in General Bytes’ security bulletin, which can also be found below:

A user on Twitter speculated similar sentiments stating that it is likely that the attack was conducted by an individual familiar with the cryptocurrency ATM industry.

“This was made by somebody that knows the system very well, a crypto ATM company/ rogue employee that owns GB ATMs. Is not like the hacker go with a USB stick and plugs it into the ATM and uploads the attack,” they said.

Nonetheless, the breach highlights the need for increased security measures in the cryptocurrency industry to prevent future attacks.

1.  ATMJackpot Malware Stealing Cash From ATMs
2.  OpenSea flaw allowed crypto theft with malicious NFTs
3.  You can now buy ATM malware on Dark Web for $5000
4.  Access:7 Supply Chain Flaws Impact ATMs, IoT devices
5.  ATM bombing suspect blew himself while filming tutorial

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Crypto ATM Manufacturer General Bytes Suffers $1.5m Bitcoin Theft

By Owais Sultan
Revolutionizing Business Operations with Innovative Software Solutions: How Technology is Reshaping the Business Landscape. Starting a business is…
This is a post from HackRead.com Read the original post: Technology and Software Redefine Business Operations

****Revolutionizing Business Operations with Innovative Software Solutions: How Technology is Reshaping the Business Landscape.****

  
Starting a business is something that can come with certain preconceptions. While these preconceptions may occasionally help you (gut feeling should be considered), they can also blind you to elements, and because you weren’t expecting to encounter them, they can have a serious impact on your new business.

Prejudging the steps of starting a business is the equivalent of taking a lax or half-hearted approach to your business. Instead, you want to incorporate a more widespread and thorough understanding into your business plan, as this can make you as prepared and informed as possible, which can only be positive.

However, there are so many possibilities in the entrepreneurial world that it can be easy to place some of them on the backburner compared to more seemingly pressing priorities. To give a helping hand, make sure not to forget about these 3 things. 

**Compliance**

There will always be standards, usually established by the government, that you will need to be compliant with, and these are going to change how you run your business in often crucial ways. Sometimes, this might be something such as health and safety, which can become a routine concern for those in the hospitality industry.

For businesses that aim to be more technologically focused, though, it might be about SOX compliance, which can lead you to software solutions that can help you to meet it. It’s easy to think when starting out that you have total freedom in how you run your business, but limitations such as this can restrict your movements somewhat.

**Insurance**

  
Additionally, when you’re making your business plan, and you’re thinking about how you’re going to spend the income that you’re predicting to make early on, it’s important that you consider absolutely everything that you need.

Insurance is always frustrating in this regard, as it can feel like preparing for something that might never come. If the event in question does occur, though, you’ll be more than glad to have business insurance, and it’s often a legal requirement besides.

Tallying up unexpected costs can be disheartening and cost a lot more than if you had just paid the insurance fee in the first place. Therefore, thoroughly understand everything you need to pay to make your business plan as comprehensive as possible and prevent you from getting caught off-guard by something you left off the list down the road. 

**Tax**

  
The way that you pay tax as a business is going to function differently from what you’re used to, and that is easy to forget or simply not think about as being a problem. As an individual who registers as self-employed, you might technically be categorized as a business entity and know your way around tax, but the kind of money that you’re dealing with for your business, and the type of business you are, could see you handling more tax tasks than you envisioned.

Business tax in itself could refer to any number of different types of tax, which can make this a slightly overwhelming topic to dive into. Don’t forget about this or ignore it. You might find that they don’t all apply to you right off the bat, but going through it, maybe even with financial assistance, could once again put you in a prepared and informed position for your business. 

1.  Businesses Need to Focus More on Cybersecurity
2.  How to choose secure software for your business
3.  Find Trustworthy Tools and Software for Business
4.  Top learning management system (LMS) software
5.  What are the benefits of having ‘pandemic’ software

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Technology and Software Redefine Business Operations

By Deeba Ahmed
Researchers suspect that the malware may be operated by Russian-speaking groups, given the references to the language in its code.
This is a post from HackRead.com Read the original post: DotRunpeX: The Malware That Infects Systems with Multiple Families

****Currently, **DotRunpeX malware**** **appears to be primarily distributed through phishing emails and malicious Google Ads, presenting a significant threat to users’ systems.****

A new malware that distributes multiple known malware families, including Agent Tesla, FormBook, Ave Maria, NetWire, LokiBot, Raccoon Stealer, Remcos, RedLine Stealer, Vidar, and Rhadamanthys, has been discovered by Checkpoint researchers.

Dubbed DotRunpeX, the malware is a new injector written in .NET, created using the Process Hollowing technique, and used to infect systems with different malware families.

The researchers noted that DotRunpeX is being actively developed. Its infection chain invades the system as a second-stage malware, usually deployed via a downloader or loader delivered via malicious attachments in phishing emails.

Additionally, it can leverage malicious Google Ads that appear in search results to direct unsuspecting users when they search for commonly used software such as LastPass and AnyDesk and send them to copycat sites delivering trojanized installers.

A malicious Google Ad and phishing email that drop the malware (Image: Check Point)

Though the injector is fairly new, there are several similarities it shares with its previous versions. For example, the injector’s name is derived from its version information, which is the same for both versions across all samples the researchers analyzed. They also noted that it contained ProductName – RunpeX.Stub.Framework.

Their analysis revealed that each malware sample had an embedded payload of a specific malware family to be injected, which becomes possible by abusing the vulnerable procexp.sys process explorer driver incorporated into the malware for obtaining kernel mode execution.

They analyzed publicly shared data by independent researchers regarding DotRunpeX but learned that the malware was misattributed to a well-known malware family. Furthermore, they learned that the first-stage loader and the second-stage loader had no connection.

The most recent activity of DotRunpeX was detected in October 2022. It was noticed that using the KoiVM virtualizing protector adds an extra obfuscation layer. These findings were somewhat similar to a malvertising campaign discovered by SentinelOne in February 2023. In that instance, the loader and injector components were referred to as MalVirt.

Researchers suspect that the malware may be operated by Russian-speaking groups, given the references to the language in its code.

1.  New YTStealer Malware is Hijacking YouTube Channels
2.  YouTube Tutorial Videos Spread Vidar, Raccoon Malware
3.  Adsense abused: 11,000 sites hacked in a backdoor attack
4.  Google Drive behind most malicious Office doc downloads
5.  Google Ads drop FatalRAT in fake messenger, browser apps

DotRunpeX: The Malware That Infects Systems with Multiple Families

By Deeba Ahmed
HinataBot can launch Distributed Denial of Service (DDoS) attacks reaching 3.3 TBPS. 
This is a post from HackRead.com Read the original post: Threat Actors Using Go-based HinataBot to launch DDoS Attacks

****The botnet is based on the Mirai botnet, and since it is actively updated, the new versions have additional features like functional improvements and anti-analysis.****

Akamai’s Security Intelligence Response Team (SIRT) cybersecurity researchers have discovered a brand-new botnet, dubbed HinataBot. This botnet can launch DDoS attacks of up to several terabytes in volume. Its distribution started earlier in 2023 and is still ongoing.

**New Botnet can Launch DDoS Attacks of 3.3 TBPS**

Akamai’s research report read that HinataBot can launch Distributed Denial of Service (DDoS) attacks reaching 3.3 TBPS. It is a Go-based botnet named after a character from the famous anime series, Naruto. While researching, Akamai’s honeypots detected this botnet as it tried to exploit old vulnerabilities, including CVE-2017-17215 and CVE-2014-8361.

The flaws impact Realtek SDS, Hadoop Yarn servers, and Huawei routers. To exploit these flaws, attackers use brute force, RCE payloads, and infection scripts. HinataBot evidence was found in Akamai’s SSH and HTTP honeypots, but researchers believe malware authors are actively updating it.

**What Makes Hinata Different?**

The researchers imitated the attackers’ C2 server with a range of reverse engineering techniques and simulated attacks to get a deeper understanding of the malware functionalities and its unique attributes. They learned that previously DDoS flooding attacks were launched over multiple protocols.

But, the recently discovered HinataBot uses only HTTP and UDP flooding techniques. Attackers exploit the miniigd SOAP service on Realtek SDK with CVE-2014-8361, exposed Hadoop YARN servers with an unspecified flaw, and Huawei HG532 routers with CVE-2017-17215.

**Attack Volume**

Akami noted that HinataBot’s DDoS attack’s packet size for HTTP reached 484 to 589 bytes whereas, for UDP packets, the size was considerably large at 65,549 bytes. It may seem low but could cause sufficient digital destruction for the targets.

Akamai, however, noted that the malware could generate over 20,000 requests and reach 3.4 MB whereas, with a thousand nodes, the attack data volume may reach 3.3 TBPS.

**Threat Actors Distributing Mirai Binaries**

Further probe revealed that the threat actors operating HinataBot distributed Mirai binaries. There are several nods to the open-source, Go-based botnet.

“HinataBot is the newest in the ever-growing list of emerging Go-based threats that includes botnets such as GoBruteForcer and the recently discovered (by SIRT) kmsdbot,” Akamai researchers noted.

The malware is based on the Mirai botnet, and since it is actively updated, the new versions have additional features like functional improvements and anti-analysis. Its previous versions supported UDP, HTTP, TCP, and ICMP floods, but the new version only supports UDP and HTTP.

1.  Akamai Mitigated Record-Breaking DDoS Attack
2.  RapperBot hits gaming servers with DDoS attacks
3.  Tor Network Hit By a Series of Ongoing DDoS Attacks

Threat Actors Using Go-based HinataBot to launch DDoS Attacks

By Owais Sultan
The cryptocurrency market is extremely volatile. The unpredictable nature is both good and bad for traders and investors.…
This is a post from HackRead.com Read the original post: Analysis of the recent volatility in the cryptocurrency market

The cryptocurrency market is extremely volatile. The unpredictable nature is both good and bad for traders and investors. Regardless of that, it gives you countless opportunities to make profits, but losses too are real. If you’re investing in Ether or any other crypto, there are multiple ways you can earn passive crypto income.

Discover effective strategies to manage your investment in ETH during market downturns while ensuring the security of your digital assets.

**Staking**

Blocking one’s funds on Ethereum or any other PoS blockchain helps validate transactions. Plus, you get the opportunity to earn rewards. On staking ETH, the buyers are putting their souls in the game to secure the network. In return, they earn considerable rewards in the form of tokens or ETH.

If you are a newbie, stalking may turn out to be expensive. As an alternative method, you can use ETH stalking service providers which will cost you less in terms of fees.

**HODL**

Referred to as “hold on for dear life”, HODL is a practice to hold cryptocurrency for a long-time with the aim of profitable investment. Holding ETH is a way to ensure that its price will elevate in the future and they will sell it on getting a profitable deal.

Since crypto prices are volatile, you can expect them to fluctuate rapidly. Having said that, it means you must prepare yourself for losses and invest only a limited amount you can afford to lose.

**Lending**

As the name signifies, lending is another significant way that enables investors to generate a steady passive income stream. The investors lend crypto to borrowers at a high-interest rate using centralized or decentralized platforms. Keep in mind, centralized platforms are vulnerable to hacking attempts.

It’s worth mentioning that decentralized platforms ensure top-notch security and transparency. Amateur investors can use these exchanges to maximize their profits.

**Automated Trading**

Investors also use bots for automated trading of Ethereum. These bots are software applications that utilized specialized algorithms for selling and purchasing crypto. Using these software apps, the trades are set up automatically based on certain market conditions.

Successful automated trading can ensure stable passive income. However, you must keep in mind the risks that come complimentary.

**Liquidity Mining**

Also known as yield farming, liquidity mining is one of the most feasible ways to earn passive income from cryptocurrency. In this technique, traders lend their ETH to liquidity pools, particularly on decentralized platforms, and earn rewards.

When trading cryptocurrency, you need to pay a certain amount of fee which is later divided among the farmers.

Hope learning these ways in detail will help you to earn passive income through cryptocurrency.

1.  Could Bitcoin Be The Future Of DeFi?
2.  6 of the Best Crypto Bug Bounty Programs
3.  Is This The Crypto Winter or a Huge Discount?
4.  Smarter Smart Contracts To Prevent DeFi Hacks

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Analysis of the recent volatility in the cryptocurrency market

By Deeba Ahmed
In addition to Google Pixel and Samsung devices, Vivo devices were also vulnerable to this attack.
This is a post from HackRead.com Read the original post: Hackers can hijack Samsung and Pixel phones by knowing phone number

****The cybersecurity researchers at Google identified eighteen zero-day vulnerabilities, four of which allowed Hackers to remotely compromise smartphone devices using just the victim’s phone number.****

Google Pixel and Samsung phone owners should be cautious, as Google’s bug-hunting team, Project Zero, has discovered as many as 18 security vulnerabilities impacting Exynos modems.

Reportedly, these vulnerabilities, if combined, can allow an adversary to gain complete control over a smartphone without alerting the user. The devices vulnerable to these vulnerabilities include the following:

*   Google Pixel 6 and Pixel 7 series
*   Vivo S16, S15, S6, X70, X60, and X30 series
*   Samsung S22, M33, M13, M12, A71, A53, A33, A21, A13, A12, and A04 series.

In addition, wearable devices using the Exynos W20 chipset, such as Galaxy Watch 4 and 5, and vehicles using the Exynos Auto T5123 chipset are also vulnerable.

According to Project Zero head Tim Willis, these zero-day vulnerabilities were found in late 2022 and early 2023. Out of the 18 security flaws, four allow attackers to compromise the phone remotely using just the victim’s phone number.

In addition, skilled threat actors can create an operational exploit quickly to “silently and remotely” compromise impacted devices. These four flaws are the most crucial of all.

> Tests conducted by Project Zero confirm that those four vulnerabilities allow an attacker to remotely compromise a phone at the baseband level with no user interaction, and require only that the attacker knows the victim’s phone number.
> 
> Google Project Zero

One of the exploits has been assigned a CVE (Common Vulnerabilities and Exposures) number, CVE-2023-24033, and Google has withheld it, which is a rare instance considering its previous bug disclosures. In this flaw, the impacted baseband model chipsets don’t check the format types that the SDP module specifies, leading to a denial of service attack.

Hence, an attacker can remotely lock the phone and bar the user from using it. It was fixed in Google’s March 2023 security update and has already been implemented in Pixel 7 series phones. However, Pixel 6 series, including Pixel 6 Pro, and Pixel 6a, do not yet have it.

The other 14 vulnerabilities aren’t as critical. Some have been assigned CVEs, including CVE-2023-26072, CVE-2023-26073, CVE-2023-26074, CVE-2023-26075, and CVE-2023-26076, while 9 are still awaiting CVEs.

It is worth noting that attackers would need a malicious mobile network operator or local access to the device to exploit them. Although it may sound impossible, a report from June 2022 shows that ISPs have been assisting malicious threat actors in installing malware on victim devices.

The good news, according to Google’s blog post, for Samsung Galaxy S22 owners in the US is that their phones don’t have a Samsung Exynos chipset but a Qualcomm chipset, so their devices aren’t vulnerable. However, European owners of the same phone are not as lucky. Therefore, those using unpatched devices must disable Wi-Fi Calling and VoLTE (voice over LTE).

1.  Hacking Honda and Nissan Cars by Knowing VIN number
2.  Hacking Facebook Account by Knowing its Phone Number
3.  New attack vector ReVoLTE lets hackers monitor phone calls
4.  Hacker finds Aussie PM’s passport number using his Instagram
5.  PlayStation serial number leads Feds to bust a massive drug ring

Hackers can hijack Samsung and Pixel phones by knowing phone number

By Deeba Ahmed
The ChatGPT-powered Blackmamba malware works as a keylogger, with the ability to send stolen credentials through Microsoft Teams.
This is a post from HackRead.com Read the original post: ChatGPT-powered polymorphic Blackmamba malware evades detection

****The malware can target Windows, macOS and Linux devices.****

HYAS Institute researcher and cybersecurity expert, Jeff Sims, has developed a new type of ChatGPT\-powered malware named Blackmamba, which can bypass Endpoint Detection and Response (EDR) filters.

This should not come as a surprise, as in January of this year, cybersecurity researchers at CyberArk also reported on how ChatGPT could be used to develop polymorphic malware. During their investigation, the researchers were able to create the polymorphic malware by bypassing the content filters in ChatGPT, using an authoritative tone.

As per the HYAS Institute’s report (PDF), the malware can gather sensitive data such as usernames, debit/credit card numbers, passwords, and other confidential data entered by a user into their device.

The ChatGPT-powered Blackmamba keylogger in action (Screenshot credit: Jeff Sims)

Once it captures the data, Blackmamba employs MS Teams webhook to transfer it to the attacker’s Teams channel, where it is “analyzed, sold on the dark web, or used for other nefarious purposes,” according to the report.

Jeff used MS Teams because it enabled him to gain access to an organization’s internal sources. Since it is connected to many other vital tools like Slack, identifying valuable targets may be more manageable.

Jeff created a polymorphic keylogger, powered by the AI-based ChatGPT, that can modify the malware randomly by examining the user’s input, leveraging the chatbot’s language capabilities.

The researcher was able to produce the keylogger in Python 3 and create a unique Python script by running the python exec() function every time the chatbot was summoned. This means that whenever ChatGPT/text-DaVinci-003 is invoked, it writes a unique Python script for the keylogger.

This made the malware polymorphic and undetectable by EDRs. Attackers can use ChatGPT to modify the code to make it more elusive. They can even develop programs that malware/ransomware developers can use to launch attacks.

Researcher’s discussion with ChatGPT

Jeff made the malware shareable and portable by employing auto-py-to-exe, a free, open-source utility. This can convert Python code into .exe files that can operate on various devices, such as macOS, Windows, and Linux systems. Additionally, the malware can be shared within the targeted environment through social engineering or email.

It is clear that as ChatGPT’s machine learning capabilities advance, such threats will continue to emerge and may become more sophisticated and challenging to detect over time. Automated security controls are not infallible, so organizations must remain proactive in developing and implementing their cybersecurity strategies to protect against such threats.

**What is Polymorphic malware?**

Polymorphic malware is a type of malicious software that changes its code and appearance every time it replicates or infects a new system. This makes it difficult to detect and analyze by traditional signature-based antivirus software because the malware appears different each time it infects a system, even though it performs the same malicious functions.

Polymorphic malware typically achieves its goal by using various obfuscation techniques such as encryption, code modification, and different compression methods. The malware can also mutate in real time by generating new code and unique signatures to evade detection by security software.

The use of polymorphic malware has become more common in recent years as cybercriminals seek new and innovative ways to bypass traditional security measures. The ability to morph and change its code makes it difficult for security researchers to develop effective security measures to prevent attacks, making it a significant threat to organizations and individuals alike.

1.  ARMO integrates ChatGPT to secure Kubernetes
2.  Scammers Pose as ChatGPT in New Phishing Scam
3.  Russian Hackers Eager to Bypass ChatGPT Restrictions

Source

HackRead