By Owais Sultan
Phishing scams are sneaky and often difficult to detect. These types of cyber attacks involve cybercriminals sending emails,…
This is a post from HackRead.com Read the original post: The Types of Phishing Attacks and How to Dodge All of Them

Phishing scams are sneaky and often difficult to detect. These types of cyber attacks involve cybercriminals sending emails, texts, or websites that appear to be from a trusted source but are not. The goal of this type of social engineering tactic is to trick unsuspecting users into giving up sensitive information.

In fact, phishing is one of the most common and successful hacker attacks. One of the contributing factors is that 97% of people are unable to recognize this type of scam. 

In this blog post, we will look at different types of phishing and how you can avoid being a victim of this kind of cybercrime.

**Email Phishing**

The most common form of phishing is email phishing, which has been around since the 1990s. In fact, a phishing assault occurs in one out of every 99 emails, according to an examination of more than 55 million emails. These scam emails are sent by hackers to any address they can find. Typically, the email service provider warns you about potential phishing scams and requests that you respond quickly.

In some cases, an email may ask you to click on a link and verify your account. Legitimate companies will never ask you to provide sensitive information via email. If you get a message that seems suspicious, don’t open the email or click on any links. Instead, contact the company through a different channel, such as their customer service number or website.

If you want some extra protection, try using a program that can help you detect phishing emails. Some email security solutions are designed to protect you against phishing attacks. These tools can scan your emails for suspicious links, domain names, and other indicators that the email might be a phishing scam. It’s a great way to prevent cybercriminals from getting what they want.

**Search Engine Phishing**

In search engine phishing, commonly referred to as SEO poisoning or SEO Trojans (and lately ransomware), hackers attempt to rank highly in a search engine. Your visit to the hacker’s website is facilitated by clicking on the link that is presented within the search engine.

In this type of situation, you need to trust your cyber instincts. Always pay attention if the website URL is incorrect or sounds suspicious. If you have any doubts, _don’t_ visit it.

Another solution here would be to block suspicious domains with an extension.

Anti-phishing extensions are beneficial as they can warn you if you’re visiting a suspicious website. 

Some of the well-known anti-phishing services that are available to protect your privacy from online phishing attempts include extensions like Netcraft and Cryptonite.

A hacked website used in delivered Gootloader malware through Google

**Vishing **

Vishing, often known as voice phishing, is the use of telephones to carry out phishing attacks. A vishing phone call aims to trick you (it recently tricked one of Cisco employees) into disclosing financial and personal information, including account numbers and passwords.

The fraudster may assert that your account has been compromised, represent your bank or law enforcement, or offer to assist you in installing software. 

The best way to protect yourself from vishing is through knowledge, as even password managers can’t help to avoid human mistakes. Hang up if a person or a recording calls you and asks for personal information. Call the company directly to confirm the request if the call appears to be from a reliable source.

**Smishing**

Smishing is a type of phishing attack where SMS is used. Due to the fact that people are more inclined to believe a message received through a messaging app on their phone than one sent via email, it is really popular.

Smishing attack via WhatsApp

Your name and location could be used by the smishing criminal to address you specifically. The message may sound more authentic because of that. Usually, a smishing message will contain a link to the website. The link could take you to a site that steals login credentials or malware that can infect your phone directly.

The malware can then be used to discreetly communicate private information to a server under the attacker’s control or to spy on your smartphone activity. To avoid that, you should keep in mind a few things to better defend yourself from these threats. Firstly:

*   Don’t respond.
*   Call your bank or merchant if doubtful.
*   Avoid opening links sent via text message. 
*   Make sure to check the number of the message, as unknown numbers are usually fake.

**Conclusion**

Information is power, and knowledge is the key to preventing yourself from becoming a victim of phishing attacks. The more you know about these cyber-based threats, like phishing, vishing, and smishing, and how they affect your online life, the less likely you are to fall victim to one. 

1.  How to detect phishing images in emails
2.  Phishing Scams: 5 Excellent Tips That Will Protect You
3.  Scammers Leveraging Microsoft Team GIFs in Phishing Attacks
4.  Hoxhunt Primed to Spread Gamified Phishing Awareness in the Enterprise
5.  ‘Important Notification’ Phishing Scam Targeting American Express Customers

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

The Types of Phishing Attacks and How to Dodge All of Them

By Waqas
According to Kiwi Farms' creator Joshua Moon, the site has become a victim of a data breach leading to hijacking his administrator account and possibly users' accounts.
This is a post from HackRead.com Read the original post: Kiwi Farms Website Hacked! Admin Warns of Data Leak

Kiwi Farms is a website that hosts user-generated content and discussion forums. The site has been accused of doxing, harassment, and cyberbullying. Last month Hackread.com reported about Kiwi Farms and Cloudflare issues and now, reports are that the website has been hit by a cyber attack.

According to Kiwi Farms’ creator Joshua Moon, the site has become a victim of a data breach leading to hijacking his administrator account and possibly users’ accounts.

**Data Breach Details**

Cybersecurity researcher Kevin Beaumont says that someone hacked Kiwi Farms website and proxy service after which all avatars were replaced with the logo of another “free speech” forum, and deleted every node on the forum index one at a time.

However, since Kiwi Farms had backups, none of the data was deleted permanently but the personal information of users could have been compromised.

**How The Hack Occurred?**

According to Joshua Moon, the site’s offshore hosting provider was compromised, and the hacker(s) accessed an unknown number of user accounts and his admin account using the session hijacking technique.

In this method, the attacker obtains authentication cookies set by the site after an account holder logs in successfully by entering valid authentication credentials and completing 2FA verification.

The attacker could perform this technique after uploading malicious content on a site XenForo, which Kiwi Farms uses to run its user forums. 

Per Moon, the attacker uploaded a webpage disguised as a ‘.opus’ audio file on XenForo and elsewhere may be through an inline frame. This caused random users to generate automated requests and send their authentication cookies outside of the site. The attacker then used them to access their accounts.

The same mechanism was used to hack Moon’s admin account. Once there, the attacker issued a command for XenForo to send data of all users, but the system logs couldn’t fulfill this command.

Homepage of Kiwi Farms at the time of publishing this article

**What Data was Leaked?**

Moon stated that he was unsure if user information was leaked. Analysis of his access logs revealed that the attackers tried to download all user records in one go, which caused an error, and the attempt remained fruitless.

Moon assured users of Kiwi Farms that their emails, posts, usernames, recent activity, and other sensitive data were safe. However, the possibility that the attacker issued other commands or scripts that were successfully executed cannot be ruled out at this point, Moon noted.

Launched in 2013, Kiwi Farms has remained in hot waters lately. The forum has been accused of cyberbullying and frequently targeting non-binary, transgender people, LGBTQ community members, and females.

Cybersecurity experts had long anticipated hackers would eventually target the site because of its involvement in swatting and doxing activities. Eventually, on Monday, the forum’s creator posted a notice on the site to alert users about the hack, claiming that user passwords, IP addresses, and emails may have been stolen.

1.  New tool lets teens report, remove their nude photos online
2.  Firm calls cops on researcher for responsibly disclosing data leak
3.  4chan hackers tried changing voting results of NASA student challenge
4.  WT1SHOP Cybercrime Market Seized by US and Portuguese Authorities
5.  FBI Seizes RaidForums and Arrests Alleged Founder Diogo Santos Coelho

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Kiwi Farms Website Hacked! Admin Warns of Data Leak

By Deeba Ahmed
LockerGoga ransomware has been targeting industrial organizations since around 2019.
This is a post from HackRead.com Read the original post: No More Ransom Offers Free Decryptor to LockerGoga Ransomware Victims

There is good news for victims of LockerGoga ransomware. They can recover their files for free with a new decryption tool. The decryption tool is available through the No More Ransom project.

The decryptor was published by cybersecurity firm Bitdefender on Friday, in collaboration with the Zürich Public Prosecutor’s Office, Europol, and the Zürich Cantonal Police.

**LockerGoga ransomware**

LockerGoga ransomware has been targeting users since around 2019. It was mainly used in cyberattacks against industrial organizations. Its key targets include the Norway-based energy and metal firm Norsk Hydro, French engineering consulting firm Altran, and American chemical manufacturer Momentive and Hexion.

LockerGoga ransomware operator is supposedly associated with a cybercrime gang, which also used MegaCortex ransomware and Dharma malware strain. It is worth noting that decryptor for MegaCortex ransomware victims will also be released soon.

According to researchers, LockerGoga ransomware gang hasn’t been too active since October 2021. By the same time, Europol had started working with law enforcement authorities from the US, the Netherlands, Norway, France, Germany, Ukraine, the USA, and Switzerland to arrest the 12 alleged members of the LockerGoga ransomware gang.

According to the Zürich Public Prosecutor’s Office, the investigation teams spent months analyzing the data gained during the Oct 2021 raid. They discovered private keys to help unlock the data from numerous ransomware attacks. Working with partner organizations, the prosecutors created a universal decryption tool using the master decryption key.

The attackers are accused of launching ransomware attacks on over 1,800 people/entities across 71 countries. Bitdefender’s director of threat research and reporting, Bogdan Botezatu, stated that the LockerGoga ransomware attacks caused damages of around $104 million.

LockerGoga ransowmare’s ransom note

The decryption keys were obtained from a specific actor already detained in Zürich and will be facing money laundering and hacking charges. Affected individuals are urged to file criminal complaints against the hackers if they haven’t already done that.

Cybersecurity experts believe that this gang is a third-tier ransomware group and has successfully launched large-scale attacks without having a force multiplier of a RaaS offering.

> Indicators of a LockerGoga infection are the presence of files with a ‘.locked’ Iextension. If you or your company have been affected by LockerGoga, you can now use the tool below to recover your files for free. 
> 
> Bitdefender

The direct download of the decryptor is available here or you can visit No More Ransom Project’s website for more information.

1.  Universal decryptor key for Sodinokibi, REvil ransomware released
2.  How to decrypt your data from Hakbit & Jigsaw ransomware for free
3.  First Ransomware to Exploit Telegram Cracked and Decryptor Published
4.  GoodWill Ransomware demands food for the poor to decrypt locked files
5.  Programmer hacks attacker; releases decryption Mushtik ransomware keys

No More Ransom Offers Free Decryptor to LockerGoga Ransomware Victims

By Waqas
Rockstar Games has acknowledged the breach stating that the company is "extremely disappointed" to have any details of their next game shared with the public in such a way.
This is a post from HackRead.com Read the original post: Uber Hacker Targets Rockstar Games, Leaks Trove of GTA 6 Data

In an unexpected twist, the hacker who claimed to have hacked Uber Inc. has targeted Rockstar Game. Resultantly, Grand Theft Auto 6 (GTA 6) gameplay videos and source code have been leaked online.

Uber hacker on GTA forums announcing GTA 6 hack and leaking its data (Image: Waqas – Hackread.com)

**Incident Details**

As seen by Hackread.com, a hacker going by the online handle of “teapotuberhacker” on GTA Forums uploaded a ZIP file listing videos and screenshots of what he termed the alleged first and unreleased footage of GTA 6.

GTA images and videos plus internal software (Image: Waqas – Hackread.com)

The hacker also claimed that he was behind Uber’s cyberattack and posted screenshots of GTA V and GTA 6 source code as proof. It is worth noting that the GTA 6 will be released sometime in 2025.

The hacker further claimed that he has stolen GTA 5 and 6 source code, assets, and GTA 6 testing build and is now trying to extort Rockstar Games instead of leaking more data. The massive GTA 6 leak was also possible through Slack. That’s the same way the hacker targeted Uber.

**Leaked Content Analysis**

The leaked GTA 6 footage shows a female protagonist. The image could be authentic if the rumor spread by Bloomberg’s Jason Schreier in July is to be believed. The source code and videos were first leaked on GTAForums, and the RAR archive contains around ninety (90) stolen videos.

These videos are created by developers while debugging the game’s different features, including NPC tracking, camera angles, and Vice City locations. Some videos also contain voice communication between various NPCs and the protagonist.

Other clips showcase female and male main characters and gameplay taking place in the fictional city.

The female protagonist in GTA 6 everyone talking about

**Company’s Response**

Rockstar Games has acknowledged the security breach. On Twitter, the gaming giant released a statement sharing its disappointment. However, the company vowed to continue to work on the next GTA 6 as planned.

According to Schreier, he also confirmed from Rockstar that this leak was indeed authentic and the footage is real. On the other hand, the hacker has revealed that Rockstar Games is willing to pay $10,000 for the GTA V source code/assets, whereas the GTA 6 source code is currently not up for sale.

Rockstar Games on Twitter

Since the leaked content has made it to Twitter and YouTube, Rockstar Games’ owner Take 2 Interactive has issued DMCA infringement notices and requested to take the videos offline, which has been facilitated.

But it is too little and too late because the hacker has already started leaking the GTA 6 stolen videos and source code portions on Telegram. Today, the threat actor posted a GTA 6 source file containing 9,500 lines, which seems related to the execution of scripts for in-game actions.

1.  Minecraft declared the most malware-infected game
2.  Fake gaming apps on Microsoft Store drop Electron Bot malware
3.  Russian Hacker Exploits GTA 5 PC Mod to Install Cryptocurrency Miner
4.  Grand Theft Auto (GTA) Fan Forum Hacked; Thousands of Accounts Stolen
5.  Authorities search & seize properties of GTA V’s “Infamous” cheat developers

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Uber Hacker Targets Rockstar Games, Leaks Trove of GTA 6 Data

By Waqas
According to LastPass, threat actor did access its Developer environment but could not compromise sensitive data because of its effective system design and controls.
This is a post from HackRead.com Read the original post: LastPass Says No User Data Compromised in Cyberattack

On 25 August 2022, as reported by Hackread.com, LastPass confirmed about a security incident impacting its development environment, revealing that some of its source code and technical data were stolen.

Now LastPass has shared the latest details on the data breach “to provide transparency and peace-of-mind” to its customers/business communities after investigating extensively with Mandiant.

**LastPass Security Breach Details**

As per the latest updates, the attack continued for four days in August 2022. During this period, LastPass’s security team identified and contained the threat actor’s activities. The attacker managed to access the Development environment by exploiting a compromised endpoint of a developer.

However, the company couldn’t conclusively determine the initial endpoint compromise. In addition, the attacker used persistent access to impersonate the developer after the victim successfully authenticated using MFA.

**What Data Was Breached?**

So far, the company hasn’t found any evidence that the activity continued beyond this timeframe. Moreover, LastPass confirmed that the threat actor accessed user data or encrypted password vaults.

LastPass’s security notice read that the threat actor did access the Developer environment but could not compromise sensitive data because of its effective system design and controls. That’s because its Development environment doesn’t share a direct or physical connection with the Production environment. 

Moreover, LastPass doesn’t store encrypted vaults or user data in its Development environment. Lastly, it never has access to the customer vaults’ master passwords. Without a master password, no one can decrypt vault data except for the owner due to its Zero-Knowledge security mechanism.

Furthermore, code integrity was validated by analyzing production builds and source code, and the company ruled out any possibility of malicious code injection or code poisoning.

**Threat Prevention Efforts**

LastPass stated that it has collaborated with a leading cybersecurity firm to enhance its existing source code safety mechanism, including secure software development life cycle procedures, vulnerability management, and threat modeling.

The company has also implemented advanced security solutions such as enhanced endpoint security monitoring and controlling.

> We have also deployed additional threat intelligence capabilities as well as enhanced detection and prevention technologies in both our Development and Production environments.”
> 
> Karim Toubba, CEO LastPass

1.  5 Best Password Managers
2.  LastPass hacked; security compromised for good
3.  Error prompted LastPass to send false breach alerts to users
4.  “Highly Unique Sophisticated” Vulnerability Found in LastPass Manager
5.  Bypassing LastPass’s Security? A phishing Attack Would Serve Just Right

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

LastPass Says No User Data Compromised in Cyberattack

By Waqas
Meet Akeyless, a secure identity and access management platform that helps organizations manage user identities, passwords, and access control. 
This is a post from HackRead.com Read the original post: Akeyless Empowers Enterprise Code Security with Comprehensive Secrets Management

Today’s enterprise IT infrastructures are built for speed and scalability, conditions that make Akeyless’s secrets management solution all the more useful. Companies like Cimpress, Stash, and Constant Contact have turned to Akeyless for help with secrets management, which makes sense given the way today’s operations, development, and security teams operate. 

Considering the competitive business landscape, having the ability to get workloads online as quickly as possible has become an advantage. As such, organizations are actively embracing the DevOps approach to software supply chains, which often involves extensive containerization and automated orchestration. 

Acumen Research and Consulting predicts that the global DevOps market will reach $37 billion in revenues by 2030. The move to hybrid and cloud-native app development, which require resources to communicate with one another, has made secrets such as credentials, passwords, certificates, and keys, an integral aspect of IT management. Secrets facilitate the interconnectedness of infrastructure components. Users, devices, and applications must undergo verification and credential exchanges to connect and interact with others securely. 

Because all workloads now involve IT, it is possible for even a small enterprise to have thousands of secrets in use within its ecosystem, giving rise to the problem of secrets sprawl. IT teams often lack complete oversight and visibility over all the secrets across the organization, making zero trust principles like dynamic, “just in time” credential generation, a major challenge. 

This challenge often ultimately becomes an alarming security issue. Leaked passwords from human users are obviously potential security risks; static secrets such as keys and certificates can also be left neglected on servers and instances. Malicious actors can exploit any secret in use. According to Verizon, stolen credentials account for nearly half of today’s data breaches.

Akeyless looks to solve this issue for enterprises through its SaaS-based solution. Through its Akeyless Vault Platform, the company enables security teams a comprehensive control, injecting all credentials as needed, across the organization, whether on-premises or in the cloud. By centralizing oversight and control, companies can assign, revoke, and redeploy efficiently and securely.

**Overcoming Security Silos**

While there are older ways to manage secrets, they are generally tied to a particular type of secret. For example, credentials and levels of access are often managed using identity and access management tools. Username and password combinations are organized using password managers or, as often is the case, Excl sheets. Companies requiring more robust security use devices like hardware security modules to store their keys and process encryption.

While many of these solutions can be effective independently, they can lack interoperability. Security teams often end up using several tools to manage all of their secrets, which do support integrations and DevOps use cases. This becomes a stumbling block for organizations looking to leverage orchestration and automation. 

Akeyless works around this by unifying the management of secrets to a single platform,  including passwords, keys, and certificates, with a back end that refreshes and encrypts keys across environments, injecting them into code using API calls.

As a SaaS solution, implementing Akeyless is quick and easy. Individual users can instantly take advantage of multi-tenant password management. They can even conveniently sign in to services using a browser extension. If the organization is already using other secret managers, Akeyless can readily import data from Kubernetes Secrets Manager, HashiCorp Vault, and Azure Key Vault. 

The platform’s native integrations with DevOps solutions like Terraform, Jenkins, and CircleCI ensure that coders can maintain security without the need to change work environments. 

The Akeyless dashboard also features an intuitive interface that allows IT teams to organize secrets using folders and subfolders, much like how file systems in operating systems work. Access and permissions can then be assigned to these folders. This way, CISOs, and IT teams will be able to sort secrets as they see fit. For instance, folders can be organized according to business units, making it easy to identify which groups have access to particular secrets.

**Integrating into Modern Workflows**

A defining advantage that the platform offers is its seamless integration into workflows. Akeyless can be hooked up to identity providers like Active Directory and Okta. The platform also provides an SDK, allowing developers to integrate Akeyless into existing libraries, scripts, and applications. It can integrate seamlessly into DevOps pipelines, including with CI/CD tools like CircleCI, GitHub, and Jenkins.

Enterprises can also use Akeyless to handle dynamic or rotating secrets. Assigning and reassigning keys and certificates is usually done during provisioning and as part of security measures, and that these tasks can be managed centrally and automatically is a game-changer for enterprises leveraging the cloud, DevOps, and containerization. 

The typical back-and-forth between development and IT teams for requests to generate keys and assign certificates can be eliminated, allowing for greater efficiency across the enterprise.

**Achieving Zero-Knowledge Security**

Akeyless believes that enterprises should retain complete control and ownership of their secrets through zero-knowledge security. 

Akeyless’s patented Distributed Fragments Cryptography (DFC) technology makes this possible. Not even Akeyless can see any of the actual secrets stored on the platform or reveal them cryptographically. Secrets information is stored in secure fragments distributed in different servers and regions and constantly refreshed mathematically.

Users keep a key fragment in their own environment, which is used to prove themselves as trusted identities. Through DFC, there is no need to reassemble the fragmented encryption keys. It becomes virtually impossible for secrets to be compromised by external threat actors.

With all these capabilities, Akeyless ultimately provides a comprehensive and practical secret management solution for the modern enterprise. Security and product teams alike can become true custodians of secrets and security in their respective organizations while enabling efficiency for all IT stakeholders.

1.  What Are the Security Benefits of Using a Digital Signature?
2.  Ways That VoIP Technology Is Impacting Marketplaces and How to Adapt
3.  Software Architects Manage Technical Debt in a Microservice Architecture
4.  Automation Affects The Interpretation Profession And Interpreting Services

Akeyless Empowers Enterprise Code Security with Comprehensive Secrets Management

By Waqas
Uber is downplaying a data breach that occurred on Thursday, saying that no sensitive data was exposed.
This is a post from HackRead.com Read the original post: Uber Downplays Data Breach Impact, Claims No Sensitive Data Stolen

Earlier, Hackread.com reported that the ride-hailing service’s corporate network was breached, after which several engineering systems and internal communications were taken offline.

It was also reported that Uber stopped its employees from using Uber’s dedicated workplace messaging app Slack and launched a probe into the incident. Here are the latest findings.

It all started when a hacker, who claimed to be an 18-years-old male, accessed Uber’s communications system after hijacking a worker’s Slack account and compromising various internal databases of the company.

Message posted by the hacker on Uber’s official Slack channel

The hacker blamed Uber’s weak security for successfully compromising its databases and provided screenshots of the company’s internal systems as proof of the attack.

The hacker went on to contact the New York Times claiming that he hacked Uber for fun and has its source code in his possession, which he might leak soon.

Screenshots of Uber’s internal system leaked by the hacker

**Investigation Details**

According to Uber, the investigation is still underway, but there was no evidence that the hacker accessed sensitive user data. Furthermore, all Uber services, including Uber Freight, Uber Eats, Uber Drive, and Uber, were fully functional on Friday. The latest update is that Uber’s internal software tools are also online.

Uber stated that it is in contact with relevant law enforcement authorities and has collaborated with the FBI for an in-depth investigation. In a tweet, the company said:

> All of our services including Uber, Uber Eats, Uber Freight, and the Uber Driver app are now bringing back online its internal software tools. As we shared yesterday, we have notified law enforcement.”

**Sensitive Data Wasn’t Exposed**

On its security update page, Uber claimed that users’ personal information was safe, and there was no evidence that the hacker accessed the information. The company shared that trip history data wasn’t exposed, and all the services were up and running.

However, Uber didn’t respond to queries regarding whether the breach impacted its applications.

On the other hand, Independent security researcher Bill Demirkapi is not buying this ‘no evidence’ theory. Demirkapi believes this stance is unclear because it indicates that the attacker might have accessed the information, and Uber just hasn’t found evidence of infiltration.

Moreover, Demirkapi stated that Uber has mentioned sensitive data wasn’t exposed and refrained from using the term data. This also hints that there’s a possibility of data exposure.

> That first sentence is sketchy, because "no evidence" could mean the attacker did have access, Uber just hasn't found evidence that the attacker \*used\* that access for "sensitive" user data. Explicitly saying "sensitive" user data rather than user data overall is also weird. 20/N
> 
> — Bill Demirkapi (@BillDemirkapi) September 16, 2022

**Uber’s History of Rubbishing Seriousness of Security Issues**

Uber is almost reaching a 100 million customer base. The company has a presence in 71 countries and 10,000 cities across the globe however its approach to hacking and security vulnerabilities has always been dismissive.

In January 2018, as reported by Hackread.com, an Indian IT security researcher Karan Saini discovered a critical security flaw in the two-factor authentication (2FA) protocol used by Uber. The flaw would allow attackers to bypass 2FA which could apparently lead them to perform a number of malicious acts.

Saini reported the bug to Uber’s bug bounty program on HackerOne, who acknowledged that there is indeed a bug in its 2FA but at the same time the company downplayed the severity of it and stated that his findings were informative but “this report contained useful information but did not warrant an immediate action or a fix.”

**Uber pays cybercriminals but not to the good guys**

In November 2017 reports surfaced that Uber suffered a massive security breach in October 2016 in which hackers stole private details of around 75 million of its users. In return, the company paid $100,000 to hackers to hide the breach.

For your information, in the breach, two hackers stole files containing names and license numbers of 600,000 drivers from the US and personal data such as names, email IDs and mobile phone numbers of 57 million Uber users from across the globe. 

**How Uber was Hacked?**

How Uber was hack? That is a million dollar questions. However, Marcus Hutchins, the security researcher who protected the world from the infamous WannaCry ransomware attack claims to have the answer. Watch his latest video in which Hutchins address the Uber hack.

1.  Hundreds of Uber Eats User records leaked on Dark Web
2.  Hacked Uber Accounts of US Based Customers Used in China
3.  Uber Rival Careem Hacked, 14 million customer & driver data stolen
4.  Uber users beware; Faketoken Android malware hits ride-sharing apps
5.  Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover up

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Uber Downplays Data Breach Impact, Claims No Sensitive Data Stolen

By Waqas
Threat actors managed to target more than 1,800 IP addresses of a single organization, and the DDoS attack was dispersed at six different locations.
This is a post from HackRead.com Read the original post: Akamai Mitigated Record-Breaking DDoS Attack Against European Customer

On Monday, 12th September 2022, cybersecurity firm Akamai mitigated a distributed denial of service attack (DDoS Attack), which has been declared a record-breaking attack in terms of packets-per-second compared to the attack Akamai recorded in July.

For your information, cybercriminals bombard servers with fake requests and traffic to prevent legit visitors from accessing their services in a DDoS attack.

The primary targets of the attack Akamai recorded recently were European companies. It peaked at 704.8 million packets per second, marking the second attack on such a massive scale against the same customer within a short span of three months.

According to Akamai’s Craig Sparling, prior to June 2022, this customer only saw attack traffic against its primary data center. However, unexpectedly, the attack campaign expanded, hitting six different global locations, from Europe to North America.

> Akamai Prolexic’s DDoS specialization culture, focus on customer infrastructure designs, and history are rooted in defending the most complex, multifaceted attacks, and our platform is equipped with purpose-built tooling for rapid threat mitigation, even in the ‘fog of war.
> 
> Sean Lyons, Senior Vice President and General Manager of Infrastructure Security

The attack was thwarted on the same day it was identified. Though not the largest DDoS attack ever, this one raised eyebrows because it was the largest attack against European organizations. The attackers used UDP as their DDoS vector and ICMP, SYN, RESET floods, TCP anomaly, PUSH flood, etc.

Attackers managed to target more than 1,800 IP addresses of a single organization, and the attack was dispersed at six different locations. Akamai noted that this attack originated from the same threat actor that targeted it previously, while the target is also the same unnamed customer based in Eastern Europe.

Previously, the attacker targeted the company’s primary data; this time, they could target 6 data center locations in North America and Europe.

As shown above, Akamai recorded a humongous 659.6 MPPS DDoS attack back in July. The latest attack was 7% higher than the one in July. The company received 74 DDoS attacks before July, and around 200 attacks afterward. The company stated that this campaign indicates attackers continuously improve their attack techniques to evade detection.

1.  The Growing Threat of Ransom DDoS Attacks
2.  Google Fended Off Largest Ever Layer 7 DDoS Attack
3.  Cloudflare Thwarted Largest Ever HTTPS DDoS Attack
4.  Microsoft Azure customer hit by largest ever 3.47 Tbps DDoS attack
5.  DDoS attacks on Minecraft event crippled the internet of a European country

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Akamai Mitigated Record-Breaking DDoS Attack Against European Customer

By Waqas
Unconfirmed reports claim an 18-year-old kid is behind the massive Uber hack.
This is a post from HackRead.com Read the original post: Uber Hack – Ride-hailing Giant Investigating Large-Scale Data Breach

Uber Inc. is investigating a cybersecurity incident where a hacker claimed to have breached its internal network and took down multiple engineering and communications systems. Initially discussed on social media the incident affected Uber’s internal Slack messaging, which was shut down after a cybersecurity breach and compromised the company’s data.

**What Happened?**

Reportedly, on Thursday, Uber employees received a Slack message from someone claiming to be a hacker. The attacker also urged that the company increase its drivers’ pay.

“I announce I am a hacker and Uber has suffered a data breach,” the message read.

For your information, Uber uses Slack for its internal communications system.

After accessing one of the company’s staff member’s Slack accounts, the hacker could compromise Uber’s internal databases, after which they posted an explicit photo on the company’s internal information page for its employees after getting control of its internal systems.

The breach was discovered shortly after, and resultantly, Uber’s IT security team took most of its internal engineering and communications systems offline. An investigation into the incident was also promptly launched.

> We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available.
> 
> Uber

> We are currently responding to a cybersecurity incident. We are in touch with law enforcement and will post additional updates here as they become available.
> 
> — Uber Comms (@Uber\_Comms) September 16, 2022

**Data Breach Details**

The unknown hacker claims to have stolen Uber’s exclusive data and shared images of cloud storage, email, and code repositories with cybersecurity experts. As per Yuga Labs security engineer Sam Curry, the hacker seems to have gained full access to Uber’s internal computer systems and carried out a “total compromise.”

Meanwhile, Uber has instructed its employees to avoid using Slack, whereas its other internal systems are also inaccessible. Curry also shared a message apparently from an Uber employee which unofficially confirms the breach.

> From another Uber employee:
> 
> Instead of doing anything, a good portion of the staff was interacting and mocking the hacker thinking someone was playing a joke. After being told to stop going on slack, people kept going on for the jokes. lmao
> 
> — Sam Curry (@samwcyo) September 16, 2022

According to malware analysis platform vx-underground on Twitter, additional screenshots leaked by the threat actor show they allegedly have access to Uber’s AWS instance, vSphere, Google workplace, HackerOne administration panel, and several other platforms used by the San Francisco, California-based ride-hailing giant.

More screenshots are available on vx-underground’s on Twitter.

According to security researcher Marcus Hutchins on Twitter, “the Uber hack looks really bad.” However, on TikTok, Marcus posted an updated revealing that the hacker is actually an 18-year-old kid with no connection to any group. However, at the time of writing, it was unclear who the hacker actually is, how old are they and what are their actual motives.

According to The New York Times, the hacker used social engineering tactics to infiltrate Uber’s communications system. He sent a text message to a worker at Uber claiming to be a corporate information technology personnel and persuaded the employee to hand over their Slack password.

Afterward, accessing Uber’s systems was pretty easy. The hacker claims that he is eighteen years old and was able to breach the ride-hailing company’s systems because of weak security.

Uber chief information security officer Latha Maripuri confirmed that there’s no specific estimate of when its services will be fully restored.

_Stay tuned, this article will be updated with more information._

1.  New Android Malware Disguised as Uber App
2.  Hundreds of Uber Eats User records leaked on Dark Web
3.  Uber Rival Careem Hacked, 14 million customer & driver data stolen
4.  Uber dismissive about security flaw that lets hackers bypass its 2FA
5.  Ex-Uber CSO Joseph Sullivan charged over 2016 data breach cover-up

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Uber Hack – Ride-hailing Giant Investigating Large-Scale Data Breach

By Deeba Ahmed
The US Treasury Department’s Office of Foreign Assets Control has announced extensive sanctions against three Iranian nationals, and…
This is a post from HackRead.com Read the original post: US Charges 3 Iranian Hackers Over Ransomware Attacks

The US Treasury Department’s Office of Foreign Assets Control has announced extensive sanctions against three Iranian nationals, and two Islamic Revolutionary Guard Corps (IRGC) sponsored firms for launching ransomware attacks against US\-based and other international companies since October 2020.

In an indictment unsealed this Wednesday, the US Department of Justice (DoJ) shared the details of a group of Iranian hackers who targeted hundreds of organizations in the USA and worldwide to extort their victims and make money. In several cases, they demanded thousands of dollars in ransom from their victims for unlocking their computers, revealed a DoJ official.

The intrusion was partially attributable to attacks launched by Charming Kitten, Phosphorus, Nemesis Kitten, and APT35. According to the Treasury Department, the hackers launched hacking campaigns against organizations in the USA and Middle Eastern companies.

Reportedly, three Iranian nationals were mainly involved in this scheme, whereas the alleged targeted organizations include a Pennsylvania-based domestic violence shelter, a Union County, NJ municipality, and an energy firm in Mississippi.

The indictment didn’t accuse the Iranian nationals of hacking the organizations on behalf of the Iranian government. Still, in sanctioning them, the Treasury Department accused all three of working with IT firms having close affiliations with the IRGC (Iranian Revolutionary Guard Corps). Their key targets included power firms, local governments, non-profit organizations, and small businesses. However, the indictment didn’t name the affected companies.

A copy of the intelligence bulletin from the US Customs and Border Protection dated 25 June was obtained by Yahoo News. It cited a DHS raw intelligence and claimed that Najee Technology and Akfar Systems were the two Iran-based firms used by the Iranian government to launch cyberattacks against foreign targets.

The DoJ has filed criminal charges against all three hackers: Mansour Ahmadi, 34, Ahmad Khatibi Aghda, 45, and Amir Hossein Nickaein Ravari, 30. All the indicted Iranian nationals are supposedly residing in Iran, which is why their extradition to the USA is not possible unless they travel to a country that has an extradition agreement with the USA.

The Treasury Department has sanctioned them and seven other Irani citizens for working for the abovementioned IT firms. The DoJ is offering a $10 million reward for Ravari, Ahmadi, and Aghda.

> “These three individuals are among a group of cybercriminals whose attacks represent a direct assault on the critical infrastructure and public services we all depend on.”
> 
> Christopher A. Wray – FBI Directer

Iran’s Permanent Mission to the UN is yet to respond to this latest development.

1.  US charges 3 North Korean hackers for extorting $1.3+ billion
2.  Iranian hackers hit Israel with disk wiper in disguise of ransomware
3.  9 Iranian hackers charged with hacking universities & stealing secrets
4.  FBI Adds Syrian Electronic Army Hackers to Cyber’s Most Wanted List
5.  Ransom fail: Iranian hackers leak a trove of Israeli LGBTQ dating app data

Source

HackRead