By Owais Sultan
Telco fraud, telecom fraud, telecommunications fraud – regardless of the name used, it refers to one thing that…
This is a post from HackRead.com Read the original post: The Onyx Fms: Monitor And Prevent Telecom Fraud In Real-time

Telco fraud, telecom fraud, **telecommunications fraud** – regardless of the name used, it refers to one thing that has mobile network operators racking their brains for an answer – the abuse of telecommunication companies for financial gain.

Over the years, telco fraud has evolved to the point where it costs communication service providers millions of dollars each year! Unfortunately, this loss has also affected mobile users. They have fallen victim to scams to extort money, bank information, and other financial or personal assets from them.

**The elderly**, unemployed, and other vulnerable groups have especially suffered under this new wave of phone scams. And it is up to mobile network operators to nip this fraud in the bud before it results in a global crisis.

But how can mobile network operators take this bull by its horns? 

**Keeping Abreast of the Latest Scams**

Thanks to technological advances, **scams have increased**. A simple phone call could be the gateway to having someone’s bank account swept clean in mere seconds. Some of the scams that have nagged mobile operators and their users include:

*   **Wangiri fraud**
*   **SMS phishing**
*   **Deposit fraud**
*   **PBX hacking**
*   **Traffic pumping**
*   **Account takeover**
*   **Subscription fraud**
*   **Telecom arbitrage fraud**
*   **The interconnect bypass fraud**
*   **The international revenue sharing fund**.

Knowing what’s affecting other networks can help you prepare for similar incidents. But how can you stop what’s coming?

**Investing in Proactive Technology**

Besides educating themselves and the public regarding the danger of phone scams, they must also arm themselves with technology equipped to monitor and prevent fraud in real-time. And what better way to do that than by investing in the **Onyx FMS**?

This hybrid fraud management system comes with several features, including:

1.  **Detection of new fraud schemes:** Often, mobile operators focus on preventing known fraud attacks. Examples include the IRSF, Interconnect bypass fraud, and traffic pumping. Unfortunately, this is not enough. Criminals are constantly devising new ways to scam their victims; a system that can detect and stop this fraud is the only way to keep up. The ONYX FMS reduces the fraud attack window, ensuring that the mobile operator and its users face minimal to no losses.
2.  **Detection of anomalies:** The ONYX FMS features a machine-learning-based solution with an anomaly detection component. Thanks to the study of previous fraud attacks like subscription fraud, account takeover, and SMS phishing rings, this statistical data plays a significant role in detecting new scams. Moreover, the system does not stop at past and current attacks but also predicts future fraud patterns. As a result, it can prevent previously unknown attacks with new fraud patterns.
3.  **Sharing of Databases**: Scammers often use a ploy in one network before trying it in another once they have been discovered. As a result of the reduced connectivity between the networks, the criminals often have their way with several networks before the scam dies down. The ONYX FMS solves this by providing a shared knowledge database that all operators can access. You can view some of the patterns present in scams in other networks and proactively prepare for them. It also gives you enough time to warn your users of impending scams before they even occur.
4.  **Investment Reusability:** Besides relying on the ONYX FMS for fraud detection and prevention, you can also use it for other network-related tasks. It features an open architecture that allows you to use its platform for predictive network maintenance, 5G network security, and a range of other new applications. You can thus rely on one system to protect your network and its users.

Whether you’re dealing with known frauds like the **Wangiri fraud** (PDF) or are grappling with a new scam, you can always rely on the ONYX FMS to weed out the scammers. Doing so can save you a lot of time and enable you to maximize your profits by cutting back on losses. Moreover, having a secure network makes you more marketable to users who may have fallen victim to scammers over the years.

1.  **Don’t Sell Your Laptop Without Following These Steps**
2.  **Phishing Scams: How To Recognize A Scam Email, VOIP call, or Text**
3.  **Guardio Review: Can This Browser Extension Protect From Cybercrime?**

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

The Onyx Fms: Monitor And Prevent Telecom Fraud In Real-time

By Deeba Ahmed
It is time to welcome a brand-new token consortium and on-chain governance framework, Grand Central hard fork, to…
This is a post from HackRead.com Read the original post: DeFiChain’s Grand Central Hard Fork Is Now LIVE

It is time to welcome a brand-new token consortium and on-chain governance framework, Grand Central hard fork, to **DeFiChain**, the world’s leading decentralized, proof-of-stake blockchain on the Bitcoin network.

The new development aims to extend the decentralized financial application (**DeFi**) access to a wide user base. The blockchain has officially activated the Grand Central hard fork on its network.

The activation occurred on 8 December 2022, at 01 am EST on Thursday, on Block Height 2,479,000. This is a monumental update for **DeFiChain** this year as it addresses a much-awaited product debt and ensures accelerated growth for the DeFiChain community in 2023.

The exchange will be rolling out the following key features:

*   On-chain governance
*   Token consortium framework
*   Pool commission & reward fixes
*   Masternode parameter updates support (for owner, operator, reward address)

According to DeFiChain’s co-founder U-Zyn Chua, Grand Central activation is a major step in the governance infrastructure of the exchange because it implements on-chain governance. It will make the voting procedures more transparent, strong, and convenient for its governance structure. That’s a welcome step for the **entire ecosystem**.

Regarding on-chain governance, community members can submit 3 kinds of proposals, which Masternode owners will vote on. The three proposals are listed here:

*   Block reward reallocation proposal
*   Vote of confidence (aka DeFiChain Improvement Proposal; DFIP)
*   Community development fund request proposal (aka Community Fund Proposal; CFP)

At the moment, the proposal creation and voting process are conducted off-chain. On-chain governance will enable a proposal that needs community voting will be directly conducted on DeFiChain.

This will improve its governance structure and make the voting process fully transparent. Results will be available in real-time on a dashboard that can be accessed on defiscan.live to ensure easy tracking.

Masternode owners can generate a script to vote for each proposal through the dashboard to reduce the effort involved in voting. The changes would allow a superior level of participation in proposal voting.

DeFiChain Consortium will encourage a proper structure for dAssets backing so that all digital assets can be backed. Consortium members like Cake DeFi will have a dedicated key to mint and burn tokenized digital assets.

Each member will have to back any digital assets they minted, whether they minted for themselves or on behalf of their platform’s users.

Moreover, they will have to pledge two days’ worth of collateral in DUSD or DFI, which will be locked up in a smart contract apart from backing the **tokenized digital assets**. This collateral will determine the number of digital assets each member can mint daily.

DeFiChain’s Grand Central Hard Fork Is Now LIVE

By Deeba Ahmed
Bybit users will access the ApeX decentralized protocol directly from their Bybit account.
This is a post from HackRead.com Read the original post: Leading Crypto Exchange Bybit Announces ApeX Pro Integration

Bybit, the third most visited crypto exchange in the world has announced its integration of ApeX Pro into its platform. This service will be available soon, and Bybit users will access the ApeX decentralized protocol directly from their Bybit account.

This new development will encourage the addition of ApeX to Bybit’s portfolio and offer vast opportunities to traders to benefit from the decentralized exchange (DEX) and centralized exchange (CEX) both on a single platform.

**How Does it Work?**

Users have to simply transfer funds from their **Bybit** exchange account to ApeX Pro. Funds will be transferred quickly, and there won’t be any platform charges added. So, users can start trading without compromising privacy or transparency.

Bybit’s co-founder and CEO, Ben Zhou, stated that this integration is a “great moment for the industry,” as it helps restore the trust in the crypto ecosystem and serves as a gateway for users to access the entire range of opportunities offered by Web.

**What is ApeX Pro?**

It is a permissionless, non-custodial DEX that uses StarkEx, StarkWare’s scalability engine, to offer high-performance perpetual contracts. This integration will ensure CEXs become securer, more efficient, and useful for traders, along with encouraging privacy, transparency, and self-custody, which are the hallmarks of DEXs, hence, closing the gap for users to use the order book model more conveniently in their trades.

ApeX Pro offers many advanced features. Such as it operates and even looks like Bybit, and with the integration of the order book model, it will not increase the learning curve. Furthermore, ApeX Pro uses zero-knowledge proofs, in which the balance changes are recorded on the blockchain. This allows the user’s wallet identity to remain private.

Leading Crypto Exchange Bybit Announces ApeX Pro Integration

By Deeba Ahmed
The exposed server, which belonged to the global online retailer VEVOR, was exposed twice between April and July 2022.
This is a post from HackRead.com Read the original post: Online Retailer Giant Exposed User Data and Over 1B Records

The cyber security researchers at Website Planet published a report on discovering an **unprotected database** containing a trove of data. The exposed server, which belonged to a global online retailer, was identified twice between April to July 2022.

**Research Findings**

According to Website Planet and security researcher Jeremiah Fowler, the first time the server was found was in April 2022. What’s worse, even after several responsible disclosure attempts, they didn’t receive any response from the company, and the unprotected database remained open to public access for several days post-discovery.

In July 2022, they discovered the same database hosted on a different IP address. Again, they didn’t receive any response from the owner, but the **exposed AWS server** was secured quickly.

However, a probe revealed the database was exposed due to a misconfiguration caused by the server’s owner or the company responsible for managing IT infrastructure, not Amazon Web Services’ fault.

During the first exposure in April, the database contained 706,206,770 documents (406.79GB size), and the second time in July, it contained 1,166,293,742 documents (601.84GB).

**Who Owns the Database?**

According to Fowler, the database had several references to Vevor, an online retailer based in California. However, Crunchbase claims that although the company is registered in the US, its website suggests it is based in **China**, boasting more than ten million customers across 200 countries/regions.

The brand deals in tools and equipment and offers DIYers and professionals advanced tools and equipment at low rates.

**Contents of the Database**

The content of the database was marked as Production. It contained PII and other sensitive data related to the company’s online operations. For instance, the data contained customer details, including first and last names, transaction IDs, partial credit card numbers, refund info, etc.

The checkout and payment records were also part of the database. This included names, currency, home addresses, email IDs, etc. It is worth noting that the data was stored both in hashed and plain text formats.

The email addresses were part of around seven folders named email-API. There were, in total, 8.1 million records (approx. 31.64GB). A limited sample of 10,000 records was evaluated, and 2,559 email IDs were declared unique.

Emails in the email-API folder (Image: Website Planet)

Conversely, 12.9 million records were contained in folders titled Members. Researchers found that all records didn’t have customer names in plain text. There were records with various Localized Domains, including .com, .ca, .de, .it, .uk, .es, .fr, and .au.

Also, part of the database were error messages in Chinese and internal images and documents hosted on amazonaws.com.cn. Furthermore, there were internal Vevor account admin names and plaintext passwords, active password reset links, credit card numbers (partial), and references to tax and passport numbers.

“IP addresses, Ports, Pathways, middleware, and storage info that cybercriminals could exploit to access systems or services. Overall, the exposure provided a complete look at Vevor’s operating structure, logging, monitoring and error records, and more. Configuration information that could be used to penetrate deeper in the network,” Website Planet’s **blog post** revealed.

At the time of writing, the server was either secured or taken down. Nevertheless, the good news is that it is not available for public access.

**Dangers of a misconfigured server**

Databases are a crucial part of modern technology, used to store and manage important data. However, if these databases are not properly configured, they can become a massive security flaw that can leave your personal or business information vulnerable to attack.

A misconfigured database can open the door for hackers and other malicious outsiders to access confidential information without authorization. The risks associated with an improperly configured or misconfigured database are numerous and should be taken seriously.

By leaving key ports open on your server or failing to update software regularly, hackers could gain unauthorized access to sensitive information such as usernames, passwords, credit card numbers, social security numbers, and more.

Additionally, they could manipulate stored data or even delete valuable records entirely – making it vital that proper measures are taken to ensure a secure system environment.

1.  **Misconfigured baby monitors expose video stream online**
2.  **Anonymous hacked 90% of Russian misconfigured databases**
3.  **US and China Exposed Most Servers Among 308k Found in 2021**
4.  **Misconfigured Servers Exposed 579 GB of Users’ Website Activity**
5.  **Exposed Server Revealed US Military’s Social Media Spying Campaign**

Online Retailer Giant Exposed User Data and Over 1B Records

By Owais Sultan
Before selling or trading in your laptop, it is important to prepare the device for its new owner as this will help ensure all of your personal data remains safe.
This is a post from HackRead.com Read the original post: Don’t Sell Your Laptop Without Following These Steps

In an age when every day, a new version of a laptop with better features, sleek design, and improved performance hits the market, it is no wonder that you also wish to buy a new laptop to achieve excellence in performance and enjoy new features.

You have money, you can buy a new laptop, great! But what about your previous laptop? If you are thinking of selling it, then…stop.

If you think selling a laptop is all about saving your data, finding a seller, and selling it, then you need to think again. It goes beyond this! It is not all about getting a fair price, but also saving your personal information and private data from reaching a stranger – that might cost you a lot if that stranger is fraudulent or malicious.

Before selling or trading in your laptop, it is important to prepare the device for its new owner. This can be done by taking several simple precautions that will help ensure all of your personal data remains safe.

**1 Save Your Important Data**

It goes without saying that your first step should be keeping a **backup of your essential data**, including personal and work-related files and folders, containing documents, presentations, emails, plans, strategies, or anything else that you have prepared with so much hard work.

If you don’t want to see your data slipping from your fingers, then this should be your number one step.

You can save your data on a data drive or upload it to a reliable **cloud service**. Or send them to your own email address (well, this is my favorite way of saving my data!). Do whatever suits you, but saving data is a must before selling your laptop.

However, this can only work if you have a few GB of data. In case you have terabytes of data then owning a workstation from companies like **Western Digital (WD)** is a good way to go.

**2 Delete Passwords Permanently**

Nobody wants the passwords of important accounts to get leaked. Full stop! But have you ever thought about how to save your passwords before giving your laptop? What — did you just say you can do it by signing off from all your accounts and deleting history and cookies? Ah, I wish it was really that easy, but it is not. 

Where technology has brought so much **ease into our lives**, there it has also become a trouble in many ways — like this one. Unfortunately, some software can extract passwords even if you log out from your accounts.

That is where you should act smartly if you don’t want someone to sneak into your Facebook and start sending weird messages through your accounts to your friends. It could trigger so many controversies – eh. So, cut iron with iron.

You can also use apps such as password generators. One such example is the **IPVanish** password generator which lets users delete passwords permanently from their browsers. If you wish to do that manually, follow these easy steps:

**For Chrome browser:** First, open Chrome and click on the three-dot menu icon located in the top right corner. Then select “Settings” and click on “Passwords” under Autofill. Here you will find a list of all the websites that have saved credentials, along with their usernames and passwords.

Select an entry to see the details, then click on the three-dot menu icon next to it and select “Remove.” You’ll be asked to confirm by clicking “remove” again; once confirmed all login information for that website will be deleted from your computer. (_Read more on_ **Google**.)

**For Firefox:** First, launch the Firefox browser on your device. Then, click the ‘Menu’ icon (three lines in the upper right corner) and select ‘Options’ or ‘Preferences’. In this menu, you will see a section for ‘Logins & Passwords. You can then scroll through all of your saved logins and passwords until you find the one that needs to be deleted.

**For Safari Browser:** To begin, open up the Safari browser on your computer and click the ‘Safari’ menu at the top left corner. In that menu option, select ‘Preferences’ and then navigate to the ‘Passwords’ tab. (Read more on **Mozilla**.)

Here you will see a list of all of your stored passwords that have been saved by Safari. To delete one or more of these passwords, simply check off each box next to each entry that you wish to remove and hit delete in the bottom right corner. (Read more on **Apple**.)

**3 Format the Drive**

Have you saved your important data? Great! Now, what about data that is still on your laptop? Obviously, you can’t leave it like this for others to see your private information and confidential data. No, just deleting data files and clearing Recycle Bin or Shift + Delete might not work. It can still keep the issue of data leakage and privacy breaches there. 

In this condition, most people go for drive formatting that cleans up your laptop and makes it data free. However, this method works if your files are overwritten and you are using a solid-state drive (SSD) with TRIM enabled.

With HDD or TRIM disabled, you would have to overwrite the hard drive if you don’t want cheap software to recover your data – yes, even after formatting. It is very easy to recover a permanently deleted file through even cheap software. So, be safe than sorry!

**4 Prepare Your Laptop for Selling**

Once you are done saving your information, next, it is time to prepare your laptop for sale at a good price. The price of your gadget also depends on its model, functionalities, current market price, and a lot more. However, improving the outer condition, and speed, upgrading Windows, and enhancing the memory storage can enhance the price of your laptop. 

So, work on the following things to get good bucks:

*   First, install the latest Windows to make your buyer happy. You can vow anyone with the latest functionalities already installed on the laptop, so that person wouldn’t have to go through all the trouble. It is a good chance to impress a buyer.

*   Second, work on the speed of the laptop. Half of the work is already done when you delete files and data. So, reset the laptop to speed it up.

*   Clean up your laptop, please. Don’t take your laptop to a buyer with all the lint or dust trapped between keys and scratches on the screen. You can remove lint or dust with a brush and change the screen cover. This simple work can make a lot of difference.

*   Lastly, visit a laptop expert and ask for a thorough inspection so that you can rectify if there are any internal faulty parts.

1.  **World’s most dangerous laptop has been sold for $1.3 million**
2.  **BusKill USB cable switches off your laptop in the event of theft**
3.  **German army’s sensitive data found on laptop bought from eBay**
4.  **World’s most dangerous laptop ‘Persistence of Chaos’ up for auction**

Don’t Sell Your Laptop Without Following These Steps

By Habiba Rashid
From December 7th, 2022, their Mastodon instance, Vivaldi Social, will be integrated into the sidebar of the desktop browser, creating an inbuilt Mastodon client for users.
This is a post from HackRead.com Read the original post: Vivaldi Integrates Mastodon Into its Web Browser

Riding the **Mastodon hype**, Vivaldi recently became the first browser to not only have its own Mastodon instance, Vivaldi Social but to also integrate Mastodon into its newest browser version, Vivaldi 5.6. available on Windows, macOS, and Linux.

In the recent update where the company announced its newest functionality, it also explained how **Mastodon** matched its values to give its users an algorithm-free experience with no surveillance capitalism or data profiling. 

According to the company’s **press release**, From December 7th, 2022, their Mastodon instance, Vivaldi Social, will be integrated into the sidebar of the desktop browser, creating an inbuilt Mastodon client for users. However, users will have the option to add any Mastodon server of their choice to the sidebar.

The new feature does not demand implementation and can be ignored if it is not up your alley. Moreover, the app does not run in the background which means that system resources or valuable bandwidth will not be used unless you open the panel.

Vivaldi Social has expanded to around 11,000 people ever since it went live in mid-November.  Vivaldi’s founder **Jon Stephenson von Tetzchner** explained that they “support the idea of a decentralized federated social media network like Mastodon.” 

Along with the creation of its own Mastodon instance, comes the responsibility of dealing with content moderation but the company remains confident that it has the expertise necessary to tackle the thorny issue. 

1.  **Trust Wallet Launches Browser Extension Wallet for Desktop**
2.  **8 Online Best Dark Web Search Engines for Tor Browser (2022)**
3.  **Improving privacy: Alternative browsers and chrome extensions**
4.  **Meet Plexus, An AI-based Browser Security Solution from LayerX**
5.  **Guardio: Can This Browser Extension Protect You From Cybercrime?**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Vivaldi Integrates Mastodon Into its Web Browser

By Habiba Rashid
The bank confirmed that it had "experienced an unprecedented cyber attack from abroad."
This is a post from HackRead.com Read the original post: IT Army of Ukraine Hit Russian Banking Giant with Crippling DDoS Attack

Russia’s second-largest bank experienced the largest cyber attack (**DDoS attack**) in its history. The government-controlled St Petersburg-based VTB financial institution announced on Tuesday that it was experiencing an “unprecedented cyber attack from abroad.”

The bank warned customers of temporary difficulties in accessing its mobile app and website due to the ongoing DDoS attack (distributed denial of service attack) but assured them that their data remained safe. VTB stores its customer data in the internal perimeter of its infrastructure which the attackers did not breach.

According to the bank’s internal analysis and as **reported** by local Russian media, this DDoS attack was pre-planned and orchestrated to cause hindrance in the bank’s functionalities and to inconvenience its customers. Despite the bank’s online portals being inaccessible, all other core banking services are operating as usual.  

VTB stated that they identified most of the malicious DDoS requests from “foreign segments of the internet,” but some network-flooding traffic also originated from Russian IP addresses which the bank noted was “of particular concern.” 

Either foreign actors used local proxies for some of the attacks or they managed to recruit local dissidents in their **DDoS campaign**. The bank stated that it will hand over all the information regarding the Russian IP addresses to law enforcement for criminal investigation. 

What makes this DDoS attack particularly interesting in light of the recent political events is that VTB is 61% state-owned, implying that the attackers made an indirect blow at the Russian government. 

On Dec 6, 2022, in a **tweet**, the pro-Ukraine hacktivist group, going by the name ‘IT Army of Ukraine,’ claimed responsibility for the DDoS attacks against VTB, announcing the campaign on Telegram and Twitter.

According to the IT Army of Ukraine, over 900 Russian entities, including stores selling military equipment and drones, the Central Bank of Russia, the National Center for the Development of Artificial Intelligence, and Alfa Bank, have been targeted by the group since they started being more active in November. 

It is worth noting that the IT Army of Ukraine along with the hacktivist group Anonymous also took responsibility for **September 2022’s social engineering attack** in which the Russian Yandex taxi app was hacked to cause a massive traffic jam in Moscow.

On the other hand, Microsoft **warns** Europe to be on alert for cyber attacks from Russia because this attack follows a series of cyber campaigns launched against Russian organizations. 

Last week, **reports of data-wiping trojan** deployed against Russian mayors’ and courts’ computers surfaced. The media reported that the wiper poses as ransomware and demands half a million rubles and deletes files regardless of whether the organization pays the amount or not. 

With the latest round of wiper and DDoS attacks, GM of Microsoft’s Digital Threat Analysis Centre Clint Watts warns Europe that Russia is likely to expand its “hybrid-war” efforts beyond Ukraine. He further stated that the Kremlin might use such state-sponsored attacks to disrupt foreign supply chains. 

European nations and the US should also brace for more Kremlin-backed influence operations – preying on citizens’ concerns about rising energy prices and inflation, and pushing pro-Russian narratives, Watts wrote. 

1.  **Anonymous Hacktivists Leak 1TB of Top Russian Law Firm Data**
2.  **Ukraine Busts Pro-Russia Hackers Who Stole 30M EU Citizens’ data**
3.  **OldGremlin Gang Known for Targeting Russia Launches Linux Malware**
4.  **Russian Ministry Website Hacked to Display “Glory To Ukraine” Message**
5.  **Ukraine Thwart Russian Industroyer 2 Malware Attack on Energy Provider**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

IT Army of Ukraine Hit Russian Banking Giant with Crippling DDoS Attack

By Habiba Rashid
Spanish Police confirmed that the SIM Swapping gang also used dark web forums to illegally obtain ID and credit card numbers through cryptocurrency purchases.
This is a post from HackRead.com Read the original post: Police Dismantle SIM Swapping Gang in Spain

The Spanish National Police successfully arrested a **SIM swapping** gang known as the “Black Panthers”, making 55 arrests in Barcelona. 

Their operation included committing bank scams through SIM swapping attacks and other methods such as social engineering techniques, and voice phishing (aka **vishing**, **phishing**, and **call forwarding**.

The group managed to accumulate a total amount of €250,000 by draining the bank accounts of a hundred victims by gaining access to their personal details after tricking the phone companies. 

The police stated that vishing was the technique majorly used to obtain **duplicate SIM cards**. “They did it directly to well-known telephone and telecommunications companies in our country, posing as customers – whose data they already had after having carried out phishing attacks on the employees of the telephone operators themselves,” said the police

By cleverly posing as technical support workers, the gang members gained straightforward access to databases containing the user credentials of phone company employees. This enabled them to acquire customers’ personal details and make duplicate SIM cards.

In its **press release**, Spanish Police added that the cybercriminals also used dark web forums to illegally obtain ID and credit card numbers through cryptocurrency purchases.

The items purchased using the cloned cards were usually luxury products that were collected at the delivery points by displaying the physical IG cards stolen or bought on black markets to make it difficult for the purchase to be traced back to them. During the bust, 45 SIM cards, 11 mobile phones, and four laptops were seized. 

The group consisted of a network of four differentiated but interconnected cells that used different methods to carry out scams. The group had an interesting collaborative dynamic that allowed them to work without a central leader, instead relying on highly specialized individuals to succeed in their separate criminal endeavors. 

1.  **Europol nabs SIM hacking network from across Europe**
2.  **10 SIM-swapping hackers nabbed for targeting US celebrities**
3.  **Turkish PoliceArrests Sim Swapping Crypto Stealing Hackers**
4.  **Sim swapping hackers charged with stealing $2.5m in crypto**
5.  **Europol nabs 106 criminals for SIM swapping, money laundering**

“Those investigated took control of mobile phone numbers of victims by making a duplicate of their SIM cards,” said police. “To do this, they used phishing, vishing, and call-forwarding techniques. Once they impersonated the identity of the users, they took control of victims’ electronic banking and made fraudulent transfers to a network of mules spread throughout the Levantine coast.”

By doing so, the criminals drained their victims’ accounts with approximately €2,500 stolen from each one.

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Police Dismantle SIM Swapping Gang in Spain

By Deeba Ahmed
A new dark web marketplace called InTheBox has surfaced online, serving smartphone malware developers and operators.
This is a post from HackRead.com Read the original post: Largest Dark Web Webinjects Marketplace “In The Box” Discovered

The California-based cybersecurity firm Resecurity has discovered a brand-new **Dark Web marketplace** that serves mobile malware developers and operators. Presented below is an overview of the firm’s findings.

**What is “In The Box”?**

According to Resecurity’s cybersecurity researchers, the new marketplace, called “In The Box” has been available for scammers and cybercriminals on the **TOR network** since at least early May 2020.

Since then, the marketplace has evolved into a full-fledged cybercrime services facilitator and has become the **Dark Web’s largest marketplace**, given the many unique tools and WEB-injects up for sale. Cybercriminals can use these tools for online banking and financial fraud, including theft.

**Why Web-Injects Are in Demand?**

Web-injects are similar to the **Man in the Browser attacks**. The difference is that these attacks previously worked on PCs using malware like SpyEye, Zeus, and Gozi, whereas threat actors have now learned to apply the same approach to mobile devices.

Web-injects successfully extract sensitive financial data because digital payments are interconnected with mobile apps. Web-injects can be integrated into mobile malware for intercepting banking credentials, social media login details, payment systems, email credentials, etc.

That’s not all. These tools can also collect sensitive data such as credit card info, phone number, personally identifiable information, and address.

**How Dangerous is this Marketplace?**

Currently, this marketplace has more than 1,849 malicious tools for sale, specifically designed to target major e-commerce and financial institutions, payment systems, social media firms, and online retailers in at least 45 countries.

This includes the UK, USA, Brazil, Canada, Colombia, Saudi Arabia, Mexico, Bahrain, Singapore, and Turkey. Cybercriminals have already targeted high-profile organizations like Citi, Amazon, Bank of America, PayPal, DBS Bank, Wells Fargo, etc. An update was made in 144 injects in November 2022 to improve their efficacy and visuals.

> There is no doubt, “In The Box” may be called the largest and probably the only one in its marketplace category providing high-quality webinjects for popular types of mobile malware.
> 
> Resecurity

As shown in the screenshot below, the team behind In The Box are offering Web-injects for $100 per month and as an “Unlim” tier that lets the buyer generate an unlimited number of injects for $2,475 and $5,888, depending on the trojans it supports.

(1) Login page of the In the Box market place (2) Prices list for each attack (3) Types of Web-injects (4) Already developed Web-injects being offered on In the Box Marketplace (Screesnhots: Resecurity)

**Who Runs “In The Box”?**

The marketplace operators are connected closely to developers of major mobile malware families, such as Ermac, Cerberus, Octopus aka Octo, Hydra, MetaDroid, and Alien, among others. The actors operating “In The Box” have Web-injects categorized by geography and can be bought by bad actors to launch attacks.

“The automation allows other bad actors to create orders to receive the most up-to-date web injects for further implementation into mobile malware,” Resecurity researchers wrote in their **blog post**.

1.  **Authorities seize world’s biggest dark web child abuse site**
2.  **What Are Dark Web Search Engines and How to Find Them?**
3.  **360m WhatsApp Records Shared on Telegram and Dark Web**

Largest Dark Web Webinjects Marketplace “In The Box” Discovered

By Deeba Ahmed
According to Tenable research, NETGEAR had to release last-minute patches for their devices that were a part of the Pwn2Own event. 
This is a post from HackRead.com Read the original post: NETGEAR Router Vulnerability Allowed Access to Restricted Services

A new report from Tenable, a Columbia, Maryland-based cybersecurity firm, outlined an emerging threat related to NETGEAR and TP-Link routers.

According to Tenable research, both TP-Link and NETGEAR had to release last-minute patches for their devices that were a part of the **Pwn2Own event**. For your information, Pwn2Own is a computer hacking competition held yearly at the CanSecWest security conference since 2007.

Last Minute Patch Issued by TP-Link

According to researchers, the NETGEAR Nighthawk WiFi6 Router (RAX30 AX2400 series) was to be included in the **bug-finding contest at Pwn2Own**. Just one day before the deadline for registering for the contest, the company identified a flaw that invalidated their submission and had to issue a patch urgently.

**What was the Issue?**

According to a **blog post** published by cybersecurity experts at Tenable, network misconfiguration was identified in NETGEAR Nighthawk router versions released before 1.0.9.90. These devices, by default, feature IPv6 for the WAN interface.

The problem is that firewall restrictions in place to determine IPv4 traffic’s access restrictions don’t work on the IPv6 WAN interface. That’s why anyone gaining random access to a service running on the device can listen to IPv6 inadvertently.

For instance, by default, Telnet servers and SSH spawned on Ports 22 and 2. An adversary can exploit this misconfiguration to interact with services accessible only by local network clients.

**Threat Mitigation Response**

Tenable discovered the patch for a flaw pending disclosure on 1st December 2022, and the next day it reached out to the vendor for its CVE identifier.

Those using the affected NETGEAR Nighthawk routers should apply the recently released patch, which can be found **here**.

It must be noted that the auto-update and Check for Updates features of the affected router don’t detect this patch at the moment, so you have to apply it manually.

1.  **415,000 routers infected by cryptomining malware**
2.  **How To Keep Your Router And WiFi Safe From Hackers**
3.  **D-Link home routers plagued with critical vulnerabilities**
4.  **Security flaws turn Netgear Routers into army of botnets**
5.  **Netgear Gaming Router Offers Protection Against DDoS Attacks**

Source

HackRead