By Habiba Rashid
The bank confirmed that it had "experienced an unprecedented cyber attack from abroad."
This is a post from HackRead.com Read the original post: IT Army of Ukraine Hit Russian Banking Giant with Crippling DDoS Attack

Russia’s second-largest bank experienced the largest cyber attack (**DDoS attack**) in its history. The government-controlled St Petersburg-based VTB financial institution announced on Tuesday that it was experiencing an “unprecedented cyber attack from abroad.”

The bank warned customers of temporary difficulties in accessing its mobile app and website due to the ongoing DDoS attack (distributed denial of service attack) but assured them that their data remained safe. VTB stores its customer data in the internal perimeter of its infrastructure which the attackers did not breach.

According to the bank’s internal analysis and as **reported** by local Russian media, this DDoS attack was pre-planned and orchestrated to cause hindrance in the bank’s functionalities and to inconvenience its customers. Despite the bank’s online portals being inaccessible, all other core banking services are operating as usual.  

VTB stated that they identified most of the malicious DDoS requests from “foreign segments of the internet,” but some network-flooding traffic also originated from Russian IP addresses which the bank noted was “of particular concern.” 

Either foreign actors used local proxies for some of the attacks or they managed to recruit local dissidents in their **DDoS campaign**. The bank stated that it will hand over all the information regarding the Russian IP addresses to law enforcement for criminal investigation. 

What makes this DDoS attack particularly interesting in light of the recent political events is that VTB is 61% state-owned, implying that the attackers made an indirect blow at the Russian government. 

On Dec 6, 2022, in a **tweet**, the pro-Ukraine hacktivist group, going by the name ‘IT Army of Ukraine,’ claimed responsibility for the DDoS attacks against VTB, announcing the campaign on Telegram and Twitter.

According to the IT Army of Ukraine, over 900 Russian entities, including stores selling military equipment and drones, the Central Bank of Russia, the National Center for the Development of Artificial Intelligence, and Alfa Bank, have been targeted by the group since they started being more active in November. 

It is worth noting that the IT Army of Ukraine along with the hacktivist group Anonymous also took responsibility for **September 2022’s social engineering attack** in which the Russian Yandex taxi app was hacked to cause a massive traffic jam in Moscow.

On the other hand, Microsoft **warns** Europe to be on alert for cyber attacks from Russia because this attack follows a series of cyber campaigns launched against Russian organizations. 

Last week, **reports of data-wiping trojan** deployed against Russian mayors’ and courts’ computers surfaced. The media reported that the wiper poses as ransomware and demands half a million rubles and deletes files regardless of whether the organization pays the amount or not. 

With the latest round of wiper and DDoS attacks, GM of Microsoft’s Digital Threat Analysis Centre Clint Watts warns Europe that Russia is likely to expand its “hybrid-war” efforts beyond Ukraine. He further stated that the Kremlin might use such state-sponsored attacks to disrupt foreign supply chains. 

European nations and the US should also brace for more Kremlin-backed influence operations – preying on citizens’ concerns about rising energy prices and inflation, and pushing pro-Russian narratives, Watts wrote. 

1.  **Anonymous Hacktivists Leak 1TB of Top Russian Law Firm Data**
2.  **Ukraine Busts Pro-Russia Hackers Who Stole 30M EU Citizens’ data**
3.  **OldGremlin Gang Known for Targeting Russia Launches Linux Malware**
4.  **Russian Ministry Website Hacked to Display “Glory To Ukraine” Message**
5.  **Ukraine Thwart Russian Industroyer 2 Malware Attack on Energy Provider**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

IT Army of Ukraine Hit Russian Banking Giant with Crippling DDoS Attack

By Habiba Rashid
Spanish Police confirmed that the SIM Swapping gang also used dark web forums to illegally obtain ID and credit card numbers through cryptocurrency purchases.
This is a post from HackRead.com Read the original post: Police Dismantle SIM Swapping Gang in Spain

The Spanish National Police successfully arrested a **SIM swapping** gang known as the “Black Panthers”, making 55 arrests in Barcelona. 

Their operation included committing bank scams through SIM swapping attacks and other methods such as social engineering techniques, and voice phishing (aka **vishing**, **phishing**, and **call forwarding**.

The group managed to accumulate a total amount of €250,000 by draining the bank accounts of a hundred victims by gaining access to their personal details after tricking the phone companies. 

The police stated that vishing was the technique majorly used to obtain **duplicate SIM cards**. “They did it directly to well-known telephone and telecommunications companies in our country, posing as customers – whose data they already had after having carried out phishing attacks on the employees of the telephone operators themselves,” said the police

By cleverly posing as technical support workers, the gang members gained straightforward access to databases containing the user credentials of phone company employees. This enabled them to acquire customers’ personal details and make duplicate SIM cards.

In its **press release**, Spanish Police added that the cybercriminals also used dark web forums to illegally obtain ID and credit card numbers through cryptocurrency purchases.

The items purchased using the cloned cards were usually luxury products that were collected at the delivery points by displaying the physical IG cards stolen or bought on black markets to make it difficult for the purchase to be traced back to them. During the bust, 45 SIM cards, 11 mobile phones, and four laptops were seized. 

The group consisted of a network of four differentiated but interconnected cells that used different methods to carry out scams. The group had an interesting collaborative dynamic that allowed them to work without a central leader, instead relying on highly specialized individuals to succeed in their separate criminal endeavors. 

1.  **Europol nabs SIM hacking network from across Europe**
2.  **10 SIM-swapping hackers nabbed for targeting US celebrities**
3.  **Turkish PoliceArrests Sim Swapping Crypto Stealing Hackers**
4.  **Sim swapping hackers charged with stealing $2.5m in crypto**
5.  **Europol nabs 106 criminals for SIM swapping, money laundering**

“Those investigated took control of mobile phone numbers of victims by making a duplicate of their SIM cards,” said police. “To do this, they used phishing, vishing, and call-forwarding techniques. Once they impersonated the identity of the users, they took control of victims’ electronic banking and made fraudulent transfers to a network of mules spread throughout the Levantine coast.”

By doing so, the criminals drained their victims’ accounts with approximately €2,500 stolen from each one.

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Police Dismantle SIM Swapping Gang in Spain

By Deeba Ahmed
A new dark web marketplace called InTheBox has surfaced online, serving smartphone malware developers and operators.
This is a post from HackRead.com Read the original post: Largest Dark Web Webinjects Marketplace “In The Box” Discovered

The California-based cybersecurity firm Resecurity has discovered a brand-new **Dark Web marketplace** that serves mobile malware developers and operators. Presented below is an overview of the firm’s findings.

**What is “In The Box”?**

According to Resecurity’s cybersecurity researchers, the new marketplace, called “In The Box” has been available for scammers and cybercriminals on the **TOR network** since at least early May 2020.

Since then, the marketplace has evolved into a full-fledged cybercrime services facilitator and has become the **Dark Web’s largest marketplace**, given the many unique tools and WEB-injects up for sale. Cybercriminals can use these tools for online banking and financial fraud, including theft.

**Why Web-Injects Are in Demand?**

Web-injects are similar to the **Man in the Browser attacks**. The difference is that these attacks previously worked on PCs using malware like SpyEye, Zeus, and Gozi, whereas threat actors have now learned to apply the same approach to mobile devices.

Web-injects successfully extract sensitive financial data because digital payments are interconnected with mobile apps. Web-injects can be integrated into mobile malware for intercepting banking credentials, social media login details, payment systems, email credentials, etc.

That’s not all. These tools can also collect sensitive data such as credit card info, phone number, personally identifiable information, and address.

**How Dangerous is this Marketplace?**

Currently, this marketplace has more than 1,849 malicious tools for sale, specifically designed to target major e-commerce and financial institutions, payment systems, social media firms, and online retailers in at least 45 countries.

This includes the UK, USA, Brazil, Canada, Colombia, Saudi Arabia, Mexico, Bahrain, Singapore, and Turkey. Cybercriminals have already targeted high-profile organizations like Citi, Amazon, Bank of America, PayPal, DBS Bank, Wells Fargo, etc. An update was made in 144 injects in November 2022 to improve their efficacy and visuals.

> There is no doubt, “In The Box” may be called the largest and probably the only one in its marketplace category providing high-quality webinjects for popular types of mobile malware.
> 
> Resecurity

As shown in the screenshot below, the team behind In The Box are offering Web-injects for $100 per month and as an “Unlim” tier that lets the buyer generate an unlimited number of injects for $2,475 and $5,888, depending on the trojans it supports.

(1) Login page of the In the Box market place (2) Prices list for each attack (3) Types of Web-injects (4) Already developed Web-injects being offered on In the Box Marketplace (Screesnhots: Resecurity)

**Who Runs “In The Box”?**

The marketplace operators are connected closely to developers of major mobile malware families, such as Ermac, Cerberus, Octopus aka Octo, Hydra, MetaDroid, and Alien, among others. The actors operating “In The Box” have Web-injects categorized by geography and can be bought by bad actors to launch attacks.

“The automation allows other bad actors to create orders to receive the most up-to-date web injects for further implementation into mobile malware,” Resecurity researchers wrote in their **blog post**.

1.  **Authorities seize world’s biggest dark web child abuse site**
2.  **What Are Dark Web Search Engines and How to Find Them?**
3.  **360m WhatsApp Records Shared on Telegram and Dark Web**

Largest Dark Web Webinjects Marketplace “In The Box” Discovered

By Deeba Ahmed
According to Tenable research, NETGEAR had to release last-minute patches for their devices that were a part of the Pwn2Own event. 
This is a post from HackRead.com Read the original post: NETGEAR Router Vulnerability Allowed Access to Restricted Services

A new report from Tenable, a Columbia, Maryland-based cybersecurity firm, outlined an emerging threat related to NETGEAR and TP-Link routers.

According to Tenable research, both TP-Link and NETGEAR had to release last-minute patches for their devices that were a part of the **Pwn2Own event**. For your information, Pwn2Own is a computer hacking competition held yearly at the CanSecWest security conference since 2007.

Last Minute Patch Issued by TP-Link

According to researchers, the NETGEAR Nighthawk WiFi6 Router (RAX30 AX2400 series) was to be included in the **bug-finding contest at Pwn2Own**. Just one day before the deadline for registering for the contest, the company identified a flaw that invalidated their submission and had to issue a patch urgently.

**What was the Issue?**

According to a **blog post** published by cybersecurity experts at Tenable, network misconfiguration was identified in NETGEAR Nighthawk router versions released before 1.0.9.90. These devices, by default, feature IPv6 for the WAN interface.

The problem is that firewall restrictions in place to determine IPv4 traffic’s access restrictions don’t work on the IPv6 WAN interface. That’s why anyone gaining random access to a service running on the device can listen to IPv6 inadvertently.

For instance, by default, Telnet servers and SSH spawned on Ports 22 and 2. An adversary can exploit this misconfiguration to interact with services accessible only by local network clients.

**Threat Mitigation Response**

Tenable discovered the patch for a flaw pending disclosure on 1st December 2022, and the next day it reached out to the vendor for its CVE identifier.

Those using the affected NETGEAR Nighthawk routers should apply the recently released patch, which can be found **here**.

It must be noted that the auto-update and Check for Updates features of the affected router don’t detect this patch at the moment, so you have to apply it manually.

1.  **415,000 routers infected by cryptomining malware**
2.  **How To Keep Your Router And WiFi Safe From Hackers**
3.  **D-Link home routers plagued with critical vulnerabilities**
4.  **Security flaws turn Netgear Routers into army of botnets**
5.  **Netgear Gaming Router Offers Protection Against DDoS Attacks**

NETGEAR Router Vulnerability Allowed Access to Restricted Services

By Deeba Ahmed
The infamous North Korean state-backed Lazarus hacking group is using AppleJeus malware to steal crypto funds from Windows users.
This is a post from HackRead.com Read the original post: Fake Windows Crypto Apps Spreading AppleJeus Malware

The cybersecurity researchers at Volexity have detected a new wave of attacks in which AppleJeus malware is distributed through fake cryptocurrency apps. Researchers claim that the North Korean APT group **Lazarus** is behind this new campaign.

It is worth noting that, as **reported** by Hackread.com in August 2018, the Lazarus hacker group was found using AppleJeus malware against macOS in its attack against multiple cryptocurrency exchanges.

**Campaign Analysis**

According to researchers, the notorious **Lazarus hacking group** uses a fake trading website and DLL Side-loading to distribute the malware. The primary targets of this campaign are cryptocurrency users and organizations.

In their recent attack, the group is using a variant of AppleJeus malware distributed via **malicious Microsoft Office documents**. This campaign started in June 2022 and is still active.

“The Lazarus Group continues its effort to target cryptocurrency users, despite ongoing attention to their campaigns and tactics. Perhaps in an attempt to allude to detection, they have decided to use chained DLL side-loading to load their payload. Despite these changes, their targets remain the same, with the cryptocurrency industry being a focus as a means for the DPRK to bolster their finances,” researchers wrote in their **blog post**.

Volexity’s findings should not come as a surprise; as of January 2022, Lazarus hackers have **stolen $1.7 billion** from cryptocurrency exchanges. In fact, in April 2022, it was **reported** that the group has been using another malware called TraderTraitor to target Blockchain organizations.

**How Did the Scheme Work?**

The scheme reportedly involves a live crypto-themed site featuring content stolen from a legit website. AppleJeus malware was deployed with a new variant of DLL Side-loading, which hasn’t been documented in the wild.

Further probe revealed that in June 2022, the threat actors registered a domain name (bloxholdercom _which was live at the time of writing_) and configured it for hosting a website related to automated cryptocurrency trading.

This site was a fake version of the genuine cryptocurrency trading platform HaasOnline (haasonlinecom). All references to this website were modified to be BloxHolder, along with a few tweaks.

Legit website (left) – Fake website (right) – Screenshot credit: Volexity

The fake website distributes a **malicious Windows MSI installer** disguised as the BloxHolder app. This app helped in the installation of AppleJeus malware and the QTBitcoinTrader app.

**Detailed Analysis**

Volexity researchers noted that the Lazarus hacker group was installing AppleJeus malware through malicious MS Office documents titled OKX Binance & Huobi VIP fee comparision.xls in the place of an MSI installer. This development was observed in October 2022.

The malicious document contained a **macro** split into two parts. The first one decoded a base64 blob containing a second OLE object, which contained a second macro.

Moreover, the first document also stored various variables, encoded with base 64 to allow defining where the malware would be deployed in the affected system. Additionally, the hackers also used OpenDrive to deploy the last stage payload.

However, researchers couldn’t retrieve the final payload deployed since October. They noted similarities in the DLL Side-loading mechanism as it was similar to the attacks involving the **MSI installer**.

Fake Windows Crypto Apps Spreading AppleJeus Malware

By Owais Sultan
SBOM or Software Bill of Materials implies a comprehensive inventory of all the constituent elements or components of the software.
This is a post from HackRead.com Read the original post: The Best Ways to Automate SBOM Creation

For the DevOps and software engineer, there’s nothing more important than having a safe and secure product. With **cybersecurity hacks** becoming more than a passing trend today, it has become imperative to take extreme steps to protect the software supply chain and its many components.

**Why is software cybersecurity important?**

The Software Development Life Cycle (**SDLC**) is a lengthy process. Given how fast-paced the world of software development is, it is common to have engineers use several other third-party sources and components to aid them rather than build everything from scratch.

This method is rather important for quick product and update delivery. However, the truth is that it exposes software to several corruptions and vulnerabilities, which, when exploited by hackers, become gaping security weaknesses that can compromise the entire project.

These vulnerabilities often exist for considerable dwell periods, such as in the case of the **SolarWinds hack**, before discovery. In the latter’s case, the vulnerabilities lay undiscovered for several months.

The respective hackers (**suspected Russians**) were only too glad to take advantage of the illegal backdoor to the software, stealing dollars worth of private and government data, including state secrets.

Upon discovery, the phenomenon shook the entire software industry, highlighting the importance of maintaining top-notch security practices throughout the development pipeline.

Since then, many standardized approaches have emerged. One essential way to protect your supply chain’s integrity is to assess the **SBOM**.

In this article, we’ll comprehensively examine the concept of SBOM and go on to explain the best ways to automate its creation.

Read on.

**What is SBOM?**

SBOM is an acronym for Software Bill of Materials. **Software Bill of Materials definition** implies a comprehensive inventory of all the constituent elements or components of the software.

In a non-software context, an SBOM can be likened to the ingredients that make up a canned good, including its source. Here, it would include the manufacturers of the can m, the farm where the raw ingredients were sourced, and so on.

An SBOM includes all third-party components used in software development, including code libraries, packages, patch status, dependencies, component version, license type, etc.

**What formats does the SBOM take?**

So vital is the data contained with SBOMs, particularly to mitigating the risk involved in cyberattacks, that the **US government has strict regulations** regarding it.

By law, software companies working with the government are required to provide a comprehensive SBOM in any one of three standardized formats.

These formats are identified by the NTIA (National Telecommunications and Information Administration) as methods for generating a comprehensive SBOM inventory list inclusive of software entities and related metadata.

Here are the three formats:

*   ●       OWASP Cyclone DX
*   ●       SPDX (Software Package Data Exchange)
*   ●       SWID (Standard for Software Identification)

The SPDX is an open standard for SBOM generation containing security references, copyrights, and software components.

On the other hand, the OWASP CycloneDX standard is used in generating inventories of third-party and proprietary software constituents for risk analysis. This makes it ideal for documenting information like firmware, libraries, containers, operating systems, frameworks, etc.

SWID is an ISO (International Organisation for Standardization) definition that consists of an XML file containing software components inventory such as patch statuses, licenses, and installation bundles.

> A “software bill of materials” (SBOM) has emerged as a key building block in software security and software supply chain risk management.
> 
> CISA

**Why is it important to automate SBOM generation?**

SBOM formats are designed to be machine-readable. As they comprise so much data, the manual analysis, curation, and processing of this data is time-consuming.

Even the smallest software is often composed of several components. Culling an inventory of these constituents is a near-impossible task per manual execution.

As such, automating the process the crucial to generating SBOMs. This way, there will be better consistency in the change implementation after release. Additionally, it facilitates the digital cryptographic verification and signing of components by vendors. Besides, it ensures continuous scanning to generate SBOMs, inherently making them valuable to the Continuous Integration/Continuous Delivery pipeline.

Also, SBOM automation offers machine speeds, thus saving valuable time. Instead of devoting crucial hours to curating the inventory, your software organization can focus on effective deployment. Additionally, it becomes easy to flag and isolate the faulty component and run update scans for **risk mitigation if vulnerabilities are detected**.

**Methods for automating SBOM creation**

There are three common methods of automating SBOM creation:

**SCA tools**

SCA stands for **software composition analysis**. These tools automate SBOM creation by comprehensively analyzing third-party code integrity, license compliance, and software security.

The process is highly efficient, guarantees code integrity boosts productivity, and does not compromise security.

Some of the components that SCA tools investigate include the following:

*   ●       Binary files
*   ●       Manifest files
*   ●       Source code
*   ●       Container images.

SCA tools provide security and reliability by analyzing tons of data points. Today, they’re highly useful in the cloud niche.

**Use plugins**

Another way to generate SBOMs is to use plugins within the **CI/CD pipeline**. This involves creating and auditing SBOMs in the DevOps pipeline.

A common plugin is the CycloneDX maven plugin which generates comprehensive SBOMs based on various project dependencies.

To begin with, the pox.xml file will have to be configured, with the culmination of the process being a generation of a bom.json file.

Next, the inventory is audited by a Dependency-Check SCA tool, after which the SBOM is finally generated.

**Use Scribe**

Scribe is an all-in-one software supply chain tool that helps developers generate comprehensive SBOMs.

The tool provides end-to-end security as far as your **software supply chain** is concerned, with a steady assurance of quality and code integrity throughout the SDLC.

The generated SBOMs can be shared with your team and your vendors, granting unhindered insight into code tampering and vulnerabilities in your software project.

With Scribe, you get comprehensive visibility, actionable insights, evidence-based compliance, and code integrity validation.

**Conclusion**

SBOMs are indispensable as far as the software supply chain is concerned. They’re the link between software developers and their respective project dependencies.

Without the comprehensive outlines they provide, optimizing cybersecurity practices within the development pipeline will be impossible.

As such, it’s important to generate a standardized SBOM in the course of a project’s development. It’s more than just essential- it is a necessity.

1.  **Importance of Automation for Businesses**
2.  **Importance of Tax Automation in Digital Business**
3.  **How Automation Affects The Interpreting Services**
4.  **Software Tech – Amp Up Your Onboarding Experience**
5.  **Cybersecurity Automation: How Businesses Benefit From It**

The Best Ways to Automate SBOM Creation

By Habiba Rashid
The Andre-Mignot Hospital in Versailles, near Paris, had to cancel operations and transfer patients after being hit by a cyber attack.
This is a post from HackRead.com Read the original post: French Hospital Suspends Operations After Crippling Cyber Attack

Over the weekend, the Andre-Mignot Hospital in Versailles, near Paris, had to cancel operations and transfer patients after being hit by a cyber attack, France’s health ministry said on Sunday.

By Saturday evening, six patients had been transferred – three belonged to intensive care while the other three were from the neonatal unit – said the minister, Francois Braun, after visiting the hospital. He added that more might follow. 

The hospital experienced a complete “reorganization” due to the cyber attack, according to Braun. The regional health agency (ARS) said the hospital had canceled operations but was doing its best to keep walk-in services and consultations running. 

Extra staff was also called into the intensive care. Although the machines were still functioning, more people were needed to watch the screens since they were no longer working as part of a network. 

The Paris prosecutor’s office has opened a preliminary investigation into attempted extortion, as well as the access and maintenance of the state digital system after the hospital filed a formal complaint on Sunday. 

This cyber attack is not a standalone event since many hospitals and health systems in France have been targeted by threat actors for several months now. Braun stated that “the health system suffers daily attacks” in France but the “vast majority of these attempts are prevented”. 

**In August**, the Corbeil-Essonnes hospital on the outskirts of Paris – which provides healthcare for nearly 700,000 residents – was targeted.

Its operations were severely disrupted for several weeks before returning to normal in mid-October. On that occasion, the cyber attack was followed by a demand for $10 million, subsequently lowered to one or two million.

The hackers had set a September 23 deadline for the hospital to pay the ransom, after which they posted confidential data on patients and staff to the “**dark web**.”

1.  **Ransomware attack on hospital causes patient’s death**
2.  **Authorities bust ransomware gang planning to hit hospitals**
3.  **CISA warns of disruptive ransomware attacks on US hospitals**
4.  **Hacker demands ransom in BTC after taking over hospital servers**
5.  **Doctor says his laptop was hacked and led to Aleppo hospital airstrike**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

French Hospital Suspends Operations After Crippling Cyber Attack

By Waqas
The 50GB worth of data is currently being sold on two clear web forums with a price tag of 1 BTC per database.
This is a post from HackRead.com Read the original post: Data of Israeli Employees from 29 Logistics Firms Sold Online

A group of hackers has posted a trove of approximately 50GB of data for sale on two online forums and a Telegram group. The data was posted on 26 and 27th November 2022. This was revealed to Hackread.com by researchers at VPNMentor.

A probe into the incident revealed that the data belonged to 29 Israeli transportation, logistics services and forwarding firms. Researchers believe that the hackers breached a software provider’s single point of failure, gained unauthorized access to these logistics firms’ supply chains, and exfiltrated a trove of personal data and shipping records.

**50 GB of Israeli Firms’ Data on Sale**

Hackers have posted the stolen data for sale. Visitors can buy a complete employee and customer information dataset from the targeted companies. The per-database rate is 1 BTC, which equals $17,000. An analysis of the graphics associated with these posts revealed that the data is part of a Black Friday Sale.

Previously, when some Israeli delivery firms were **targeted in cyberattacks**, the Israeli government’s cyber agencies named Iranian threat actors as the perpetrators. However, it is unclear if the same actors are responsible in this instance.

**Details of Leaked Data**

According to VPNMentor’s **blog post,** exposed data includes contract details and shipment information of the affected Israeli firms. The hackers have listed 1.1 million records for sale on different online forums. It seems like they have shared a small sample of data.

Whether 1 record represented 1 person or 1.1 million people were impacted in this data breach couldn’t be determined. The exposed information includes full names, addresses, and contact numbers.

Researchers were unsure whether the exposed addresses were work or home addresses. Customers’ exposed data includes full names and shipping details (sender and receiver’s addresses, number of packages, contact numbers, etc.).

Screenshot provided by VPNMentor shows post by hackers and what’s in the data.

**Possible Dangers**

These records can be exploited to intercept packages or blackmail/threaten courier firms’ employees into handing over valuable shipments. Threat actors can use personal data such as full names or contact details to target people with **scams and phishing attacks**.

Customers of these firms should be wary of suspicious SMS messages and calls and do not share personal information via phone. They should reveal sensitive data only to a trusted source only when necessary.

1.  **Australian Trading Giant Exposed 60GB of User Data**
2.  **MyEasyDocs Exposed 30GB of Israeli Students’ PII Data**
3.  **Iranian hackers leak a trove of Israeli LGBTQ dating app data**
4.  **Logistics giant D.W. Morgan exposed 100 GB worth of clients’ data**
5.  **Logistics giant exposes customer data, Lolz at researchers when alerted**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Data of Israeli Employees from 29 Logistics Firms Sold Online

By Owais Sultan
Did you know Fortnite was the first game to break through on a variety of console platforms, including XBOX/PS/Switch?
This is a post from HackRead.com Read the original post: Behind The Success Of Phenomenon Game Fortnite

Fortnite refers to a video game series set in a post-apocalyptic, zombie-infested world. It was developed by **Epic Games** and uses the company’s signature Unreal Engine. Currently, Fortnite has two titles: a team survival shooter called Fortnite: Save the World and a single-player game called Fortnite: Battle Royale.

Millions of players have downloaded the game since its launch, generating hundreds of millions of dollars a month for its creators. According to a **survey** by CouponBirds, Fortnite’s monthly active player base has remained around 80 million. The incredible number of people online makes for incredible profits. Fortnite: Escape brought in $5.4 billion in revenue for Epic in 2018 alone, making it the world’s most profitable game that year.

**How did Fortnite achieve so much in such a short time?**

**Fortnite** achieved what was previously considered almost impossible in the gaming industry: it was the first game to break through on a variety of console platforms, including XBOX/PS/Switch. Fortnite’s simultaneous cross-platform PC/ console/mobile connectivity is a big deal in the closed gaming ecosystem. This is due to **Tim Sweeney** and Unreal Engine’s many years of experience in the industry and their contacts and influence.

On the other hand, Fortnite has made a significant model innovation in the **F2P premium system** with its Battle Pass season ticket subscription model. By most people’s understanding of free-to-play in-game payment mechanics, it’s a treasure chest or so-called ten-row model. Treasure chests are a great way to monetize a game on a large scale, but the number of paying players affects the balance of the game, and endless amounts of money usually make the game suck.

How did Fortnite do it? It takes the concept of a subscription system commonly accepted in Western Internet culture and differentiates rewards by season. More important is the way rewards are earned: each season, users play the game for free to gain experience points that can be used to improve their battle pass levels, which have corresponding rewards for each level.

Image credit: Epic Games

These mechanics combine to create an addictive growth experience that allows Fortnite games to go crazy for retention and daily active players. **Fortnite’s Battle Pass** payout rate is 70%, something every game developer dreams of. Fortnite’s original Battle Pass payment design was a huge success, and many of the world’s biggest games have followed suit, almost all of which have had a direct impact on retention and payment.

Not only that, but in Fortnite, users can build, socialize, and interact. In addition to the gameplay experience, Fortnite quickly transformed itself into a social space, connecting the game space with real life.

Fortnite is one of the closest systems ecosystems to a **metaverse**. It stopped being a real game and became more and more social, evolving into a virtual space where custom characters interact. So far, there have been concerts, movie launches, fan meets, and other real-world events held in Fortnite’s virtual environment:

*   Marshmello’s first live Fortnite concert in February 2019 was played by more than 10 million players;
*   In April 2019, Marvel’s Avengers: Endgame offered a new co-branded interactive mode in Fortnite, where players take on the role of the Avengers as they battle Thanos;

*   In December 2019, Star Wars: The Rise of Skywalker held an audience screening at Fortnite, where director JJ Abrams was interviewed;
*   In April 2020, American rapper Travis Scott held an immersive concert called Astronomical in Fortnite, which was watched by 17 million people at the same time, causing a viral spread on social media;
*   In August 2021, Ariana Grande, a popular American singer, performed five consecutive concerts in Fortnite.

Image credit: The Verge

The star power made the game more popular and contributed to its success. The future looks bright for Fortnite. New maps, lots of new content, and a blank slate are sure to host crazy **new livestreams**. The number of players is growing and this match is sure to be one of the top games for the foreseeable future.

1.  **Top Dangers That Online Gamers Face**
2.  **Influence of technology on the gaming industry**
3.  **12 Classic Games You Can Play on Your Smartphone**
4.  **Minecraft declared the most malware-infected game**
5.  **What is Blockchain Gaming and its Play-to-Earn Model?**

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Behind The Success Of Phenomenon Game Fortnite

By Habiba Rashid
According to white hat hacker Sam Curry, once exploited, attackers could use the flaw to unlock the door, honk the horn, flash the lights, or even start the vehicle.
This is a post from HackRead.com Read the original post: App Flaw Allowed Honda and Nissan Cars Hack by Knowing VIN number

As convenient as it may be to be able to control certain features of your car using only a mobile app, you should keep in mind that with innovative technology comes the threat of **hackers finding vulnerabilities in it**.

As it turns out, remote car apps for several automakers giants that allow users to start, unlock, honk, and locate their car from their phones could actually be used without needing the login credentials.

Hacker, bug bounty hunter and Staff Security Engineer for Yuga Labs **Sam Curry published two threads on Twitter** explaining his research in which he uncovered this gaping hole in the remote car app security system of several makes including Nissan, Honda, Infiniti, and Acura vehicles. 

> More car hacking!
> 
> Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car.
> 
> Here’s how we found it, and how it works: pic.twitter.com/ul3A4sT47k
> 
> — Sam Curry (@samwcyo) November 30, 2022

Curry stated that he located the vulnerability by searching for the telematic platform shared by all these companies, which is offered by SiriusXM. Otherwise known for its satellite radio functionality, **SiriusXM offers** a Connected Vehicle Services package to other brands as well such as BMW, Hyundai, Jaguar, Land Rover, Lexus, Subaru, and Toyota. 

According to Curry, only the vehicle identification number (VIN) was needed to authorize the data exchanged through the telematics platform, allowing any person who knew the vehicle’s VIN to carry out various commands such as unlocking the door, honking, flashing the lights, or even starting the vehicle. 

When Curry tested this out, he also found that he could retrieve customer details such as a customer’s name, home address, contact information, and car details using only the VIN which is visible through the windshield on the dash of most vehicles.

Furthermore, the API calls for telematic services worked even if the user no longer had an active SiriusXM subscription. Curry also noted that he could enroll or enroll vehicle owners from the service at will.

Curry was only able to confirm that this vulnerability existed for Nissan, Honda, Infiniti, and Acura vehicles and did not cover the rest of the brands linked together by the service. 

On the brighter side, however, you can rest assured that your car is not affected by the vulnerability anymore. Before disclosing his findings publicly, Curry compiled a detailed report of the security vulnerability and presented it to the company.

He said that SiriusXM had used that information to immediately patch the vulnerability which means that the issue was already fixed before the news went public.

**Limited Security Options**

In the digital age, connected cars are becoming increasingly popular. They offer a range of benefits, from remote access to fuel consumption monitoring and more. But for car owners using apps to manage their vehicles, there are also potential security risks that need to be addressed.

The security of a vulnerable app is in the hands of its developers and owners, and only they can issue security updates and patches to fix the issue. This means users have limited and traditional options to go with. Here are a couple of steps you can take to protect your car from hackers and other cyber threats when you’re using applications.

To start with, do not share your car’s VIN numbers with unreliable third-party, make sure you use unique passwords for each app associated with your vehicle. Strong passwords that combine letters, numbers, and symbols can help protect valuable data stored in the connected cloud networks used by those apps.

Additionally, users should update their systems regularly with any new security patches released by their chosen app provider – these updates help keep hackers out of your car’s system.

1.  **Smart Cars: Increasing Comfort — Reducing Security**
2.  **How Hackers Can Remotely Unlock/Start Honda Cars**
3.  **Unlocking Tesla Cars, Smart Devices with Bluetooth Flaws**
4.  **Self-driving cars can be fooled by displaying virtual objects**
5.  **Internet-connected cars can be hacked to gridlock major cities**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.