By Deeba Ahmed
The hackers behind Rsocks botnet used the hacked IoT devices as proxy servers where its customers would pay…
This is a post from HackRead.com Read the original post: Feds Dismantle Russian Rsocks Botnet Powered by Millions of IoT Devices

****The hackers behind Rsocks botnet used the hacked IoT devices as proxy servers where its customers would pay them for using the device’s IP address while the device owner remained unaware of the exploitation.****

The US Department of Justice (DoJ) seized and dismantled a Russian botnet infrastructure, the operators of which hijacked millions of devices across the globe to offer IP proxy service.

The prosecutors alleged that Rsocks was in use by an undisclosed, notorious Russian hacker(s) running a sophisticated cybercrime organization. The gang offered web proxy service after hacking into millions of IoT devices, computers, laptops, and Android smartphones.

**How did the Seizure happen?**

In a press release, the DoJ confirmed the involvement of law enforcement agencies from the UK, the Netherlands, and Germany in this operation launched in 2017 by the Federal Bureau of Investigation (FBI).

Seized Rsocks website

The bureau secretly purchased proxies from Rsocks to track its infrastructure and located at least 325,000 infected devices in the US. Prosecutors claimed that the botnet conducted cyber intrusions within the US and abroad.

**What are Proxy Servers?**

Proxy service operators provide access to IP addresses to interested users for a fee. Though not inherently illegal, the service manages to bypass censorship and access geo-restricted content for the user.

In the case of Rsocks’ botnet, the hackers used the devices as proxy servers. The customers would pay them for using the compromised devices’ IP address while the device owner remained unaware of the exploitation.

> “The owners of these devices did not give the RSOCKS operator(s) authority to access their devices in order to use their IP addresses and route internet traffic.”
> 
> Department of Justice

**A Botnet Comprising 8M Residential Devices**

As per the information shared by Rsocks on Twitter, the botnet had claimed 8 million residential devices and over a million mobile IPs. According to the prosecutors, Rsocks used brute force attacks to invade millions of devices and expand the botnet army illegally.

An archive copy of the now seized website

The operators not only victimized individuals and home businesses but also high-profile private and public entities, including a hotel, a university, a TV studio, and an electronics maker.

**How Was Rsocks Used?**

Reportedly, those intending to avail Rsocks proxies rented the access through an online storefront for different timelines and rates, ranging from $30/day for accessing 2,000 proxies to $200/day for 90,000 proxies.

After purchasing, the cybercriminals redirected malicious internet traffic via the IP addresses linked to the infected devices to hide their identity and launch various attacks such as credentials stuffing, hijacking social media accounts, or phishing messages.

This seizure comes just two weeks after the US authorities seized another illegal marketplace, SSNDOB, for stealing/selling the private data of around 24 million US citizens.

**More Botnet Seizure News**

*   Microsoft takes down largest botnet network “Necurs”
*   World’s Most ‘Resilient Malware’ Botnet Emotet Taken Down
*   The US jails Russian hacker for 8 years over botnet, bank fraud
*   Hacker disrupts Emotet botnet operation by replacing payload with GIFs
*   FBI Disrupts Cyclops Blink Botnet Used by Russian Intelligence Directorate

Feds Dismantle Russian Rsocks Botnet Powered by Millions of IoT Devices

By Owais Sultan
In this technological era, the world has been converted into a global village with everything connected to everything.…
This is a post from HackRead.com Read the original post: 5 Reasons You Should Learn About Cyber Security

In this technological era, the world has been converted into a global village with everything connected to everything. The internet plays a massive role in this revolution, thanks to the emergence of smartphones and similar portable devices.

We can easily connect to social media and chat with people we don’t know, subscribe to an online banking system, and do much more. What many don’t realize, however, is that with such convenience comes certain risks – mostly cyber security concerns.

While using different online systems via these devices, bad actors may hack into your accounts, stealing your personal information and using it in destructive ways. Even the systems you think may be so secure could still be vulnerable to such issues internally and externally.

News headlines like “Uganda Security Exchange Caught Leaking 32GB of Sensitive Data” have become far too familiar. And hence, the need and importance to understand your vulnerabilities and security online.

**What Is Cyber Security?**

Cyber security is simply defined as defending and protecting PCs, servers, technical infrastructure, mobile devices, electronic systems, networks, and sensitive data from malicious attackers.

Some call it information technology security, a term applicable in a wide range of markets, including businesses and mobile computing (know the difference). This practice is divided into different categories: network, information, operational, and end-user education, among others.

**Why Should You Learn About Cyber Security**

There is a lot of information on the benefits of learning cyber security, but not so much focuses on the end-user. Information in these publications only focuses on the career benefits of studying this subject at higher levels of education.

Here, we will dwell on the end-user, who downloads apps, subscribes to apps, and does financial transactions, among other activities. Consider the following five general reasons why you should or otherwise must learn about cyber security.

**#1: The Every Rising Scale of Cyber Threat**

As the need for technological advancement rises, so does the increase in the number of data breaches. A recent publication on Forbes reveals the alarming cyber statistics that everyone must know in 2022. Part of this writing is an extract from another source showing how cybercriminals can penetrate more than 90% of company networks. Attackers can breach these systems within a very short period.

And that is just for companies; what about an everyday person. A 2019 report from RiskBased Security brought up overwhelming 7.9billlion records related to data breaches. Medical services, retailers, and public entities seemed to have the biggest loopholes. With that, the International Data Corporation predicted the dependence on cyber-security solutions to rise to $133.7 billion by the end of 2022.

Cybercriminals are getting smarter, using complex programs like malware (virus, Trojans, spyware, ransomware, botnets, etc.), SQL Injection, and phishing to attack their victims. Learning about cyber security makes you more aware of these threats. You will therefore be more careful when accessing any internet-related services.

**#2: The Rising Demand for Cyber Security Experts**

Due to the above reasons, there is a steady rise in demand for cyber security jobs. The Bureau of Labor Statistics reveals that this industry is expected to grow by 28% by 2026 again.

One of the main reasons for this surge is the automation of many industries. If you are career-oriented, trying out cyber-security could brighten your future.

**#3: Cyber-attacks Affect Everyone**

Anyone in that coverage area will feel the impact if a cybercriminal attacks an electrical power breach. And no one is safe if they touch military equipment, breach national security, or steal sensitive information like clinical records.

A cyberattack can even occur globally, breaking government organizations and causing chaos. Only those who understand such threats will be sober enough to know what to do.

**#4: Anyone Can Be Targeted by Cyber Attacks**

Identity theft through phishing has become one of the biggest concerns for the modern internet generation. Many times have we heard our friends complaining about their Facebook or Twitter accounts being hacked, not to mention financial attacks.

A hacker can use stolen personal information like location, names, and identification to blackmail you or sell to terrorists who will cause serious damage. With some knowledge, you can take quick action to prevent further damage immediately after you realize an issue.

**#5 Cyber Concerns Increase Regulations and Legislations**

Consider an internet user who applies a tool like giga-rapid seedbox for torrenting and to avoid ISP throttling by service providers. This tool shields them from the prying eyes of ISPs/governments, protects them from potential cyber threats, and lets them access content from restricted platforms by masking their IPs.

It all comes down to understanding the threats these activities present, which would be if they didn’t know about cyber security. You can use similar tools too to avoid leaving a huge online footprint.

**Conclusion**

A large percentage of the world today depends on the internet and automated technologies, which have vulnerabilities. Even though better cyber-security technologies have been created, the threats are still real. We can no longer live in ignorance, oblivious of the security threats that come from internet activities. And that is why you should learn about this industry – cyber-attacks affect us all.

*   How to Teach Your Employees About Cybersecurity
*   Why Businesses Need To Go Lean With Cybersecurity
*   Cybersecurity Automation: How Can Businesses Benefit From It
*   How big data analytics helps enterprises improve cyber security
*   Cyber Security Risks That You Should Be Careful Of While Streaming

5 Reasons You Should Learn About Cyber Security

By Deeba Ahmed
The hacker was arrested in 2021 for breaching Apple iCloud accounts and stealing more than 620,000 private images…
This is a post from HackRead.com Read the original post: 9 Years Jail for iCloud Phishing Scam Hacker Who Stole Nude Photos

****The hacker was arrested in 2021 for breaching Apple iCloud accounts and stealing more than 620,000 private images and 9,000 videos of young females.****

Hao Kuo Chi, a 41-year-old hacker from California, has been sentenced to nine years in prison. The sentence was announced on Thursday for breaching iCloud accounts, said the US Attorney’s Office for the Central District of Florida.

US District Judge Kathryn Kimball Mizelle sentenced Hao Kuo Chi to nine years in federal prison on conspiracy and computer fraud charges. The accused pleaded guilty in October 2021.

**Background Story**

As Hackread.com previously reported, Chi stole people’s nude videos and photos of young females and shared them with conspirators. He used the online moniker “icloudripper4you” to hack thousands of iCloud accounts. He was arrested for breaching Apple iCloud accounts and stealing more than 620,000 private images and 9,000 videos of young females.

The La Puente, California resident admitted impersonating Apple customer support staff and carrying out iCloud phishing scams to trick the victims into giving away their Apple IDs and passwords.

**The “Terror” Campaign**

In the DoJ’s press release, authorities referred to Chi’s illicit activities as a terror campaign, sharing nude images/videos of innocent users on his website and calling the stolen content his “wins.” Furthermore, he illegally hacked into iCloud accounts of approximately 4700 individuals and shared the content with conspirators on 300 occasions.

US Attorney Roger Handberg stated that Chi victimized “hundreds of women across the country” and made them fearful for their reputation and safety because some conspirators leaked those images online.

> “This man led a terror campaign from his computer, causing fear and distress to hundreds of victims. The FBI is committed to protecting the American people by exposing these cybercriminals and bringing them to justice.”
> 
> David Walker, FBI Tampa Division Special Agent in Charge.

Court documents reveal that Chi’s campaign was spread over Anon-IB for several years. This now-defunct website served as an image-sharing platform where users were encouraged to post sexually explicit and nude photos.

Chi used an undisclosed foreign, end-to-end encrypted email service for sharing images with his conspirators. When Anon-IB was active, Chi collected 3.5TB of data from 500 victims, which he stored in physical devices and iCloud.

**More iCloud Hacks and Flaws**

*   55 Apple vulnerabilities risked iCloud account takeover, data theft
*   Apple users hit with KYC Validation/iCloud ID review phishing scam
*   iCloud Glitch? Woman buys iPhone, finds contact details of top celebs
*   New iCloud Phishing Scam steals credit card data, access device’ camera
*   MetaMask Asks Users to Disable iCloud Backup for Wallet After User Lost $650k

9 Years Jail for iCloud Phishing Scam Hacker Who Stole Nude Photos

By Deeba Ahmed
MaliBot Android Malware is also capable of bypassing 2FA (Two-factor authentication). F5 Labs researchers have discovered a new…
This is a post from HackRead.com Read the original post: New MaliBot Android Malware Found Stealing Personal, Banking Data

****MaliBot Android Malware is also capable of bypassing 2FA (Two-factor authentication).****

F5 Labs researchers have discovered a new Android malware family that can exfiltrate personal and financial data after compromising devices. According to researchers, the malware can not only bypass multi-factor authentication processes, but can also steal banking data, passwords, and cryptocurrency wallets.

It is worth noting that the malware is distributed through fraudulent websites and tricks victims into downloading it, thinking it is a popular cryptocurrency tracking app. It is also distributed through smishing.

Furthermore, researchers have identified two malicious sites distributing MaliBot. One of them is a fake version of TheCryptoApp that boasts over a million downloads on the Google Play Store.

**Details of MaliBot**

F5 Labs has dubbed the Android malware MaliBot. This powerful malware disguised as a cryptocurrency mining application may pretend to be another app or a Chrome browser. It asks the user for accessibility and launcher permissions when downloaded to monitor the device and carry out its malicious operations.

MaliBot uses a Virtual Network Computing (VNC) server implementation to gain control of the infected devices. Once it infects a device, it starts exfiltrating financial data and steals PII (personally identifiable information) and cryptocurrency wallet information.

Research revealed that the malware’s C2 server is based in Russia and the servers are the same that were previously used for distributing the Sality malware. From June 2020, the IP was used to launch different malware campaigns.

**MaliBot Capabilities**

MaliBot has diverse capabilities, such as it supports web injections and can be used in overlay attacks. It can run and delete applications and steal sensitive data such as MFA codes, cookies, SMS messages, etc.

It can remotely steal passwords and access text messages, crypto wallet information, web browser cookies, bank details, and capture screenshots from compromised devices. It can also bypass MFA protection.

It mainly abuses the Android Accessibility API that lets it perform specific actions without asking for user permission or interaction and maintain persistence on the infected device. It also bypasses 2FA processes by validating Google prompts via the Accessibility API and steals 2FA codes, which are later transferred to the attacker.

When distributed via SMS messages, the malware can log exceptions and registers itself as a launcher. Bypassing protections around crypto wallets lets the attackers steal bitcoins and other cryptocurrencies from the victim’s wallet linked to the infected device.

Lastly, like FluBot, MaliBot can send SMS messages to other users to spread the infection chain. Currently, this campaign is targeting Spanish and Italian bank customers, but the scope of infection may soon broaden, F5 Labs researcher Dor Nizar noted.

**More Android Malware News**

*   Authorities Take Down SMS-based FluBot Android Spyware
*   Predator Spyware Using Zero-day to Target Android Devices
*   Ginp Android trojan targets banking apps & threaten 2FA/SMS
*   HiddenMiner Android Monero Mining Malware Cause Device Failure
*   New Android banking malware Xenomorph found in Play Store apps

New MaliBot Android Malware Found Stealing Personal, Banking Data

By Owais Sultan
What is VPS? VPS can be a great solution for the web presence of your business, blog, e-commerce,…
This is a post from HackRead.com Read the original post: How to configure cPanel and WHM Panel on your VPS

**What is VPS?**

VPS can be a great solution for the web presence of your business, blog, e-commerce, or any other project, especially when you are just going to start or not going to use too many resources, a VPS provides you with a pretty much solid ground, that is to say, security and stability, uptime and fault resistance combined with relatively lower costs.

The reason for this is the virtualization technology that allows dividing the capacities of one single physical server into separate virtual machines with dedicated resources – storage, memory, CPU – as well as their own virtual system and IP address. This way you get the virtual server whose operation is not bothered by its neighbors and at the same time you pay less because you pay just for a part of a physical capacity.

If you’ve made up your mind to opt for a VPS as your hosting solution, you also have to think, about which kind of VPS you need, since VPS are rather customizable and there are many parameters that your choice can affect and that eventually may affect the productivity of your project: the choice of location is determined by the location of your target audience; the technical requirement of your website determines the number of resources you are going to set; the operating system determines, which software you are going to use and so on.

Another important aspect is the way you are going to manage your web server. To simplify and automate this process, usually, a control panel is used. Among available control panel apps perhaps the most often chosen is cPanel. 

**What is cPanel**

cPanel is probably the most popular web hosting control panel. It has a rather broad range of features combined with a user-friendly graphical user interface. cPanel is responsible for managing the server regarding particular tasks, like monitoring resources, file management, mailing, and database management.

These tasks are performed via cPanel user accounts. What about the accounts, these are created and managed with the help of WHM (Web Host Manager), which is basically responsible for root access, that is administering the server on a deeper level.  
cPanel has a number of advantages which include:

*   **Compatibility**. With cPanel being such a popular control panel solution, many developers adapt their server software namely for cPanel. That’s why cPanel is compatible with various other programs that will help you manage your server.
*   **Graphical user interface (GUI).** cPanel is famous for its user-friendly graphical interface that will let you access the required settings fast and easily.
*   **Efficient server management.** cPanel will let you keep an eye on the various aspects of your server operation – files, mailing, DNS, databases, and server capacities so that you’ll always be able to provide your VPS’ brilliant performance. 

cPanel, like anything in this world, has a few drawbacks as well. 

*   It is still **not compatible** with some software solutions;
*   The **interface may seem counterproductive** for people who have a higher than average level of technical expertise and are more used to using the command line;
*   It is **not open-source** software, so it’s not as customizable as some people would like it to be;
*   It is **not free,** so you’ll have to consider whether you can afford it or not.

With all the above, cPanel is still one of the best control panels available for your server. That’s why we highly recommend checking Hostzealot hosting VPS cPanel. There you’ll be able to find the best VPS solution for your web presence, with a variety of locations to choose from, lightning-fast provisioning, and various web panels pre-installed.

In today’s article, we are going to have a look at the configuration process of these server management tools.

*   The first thing you need to do is to log on to your VPS server.
*   Then, you’ve got to install Perl. To do so, use the following command:  
    yum –y install perl 
*   After installing Perl, you will need to download WHM. Once the downloading is finished, use the following script to install WHM:  
    cd /home && curl -o latest -L https://securedownloads.cpanel.net/latest && sh latest
*   The next step is setting up WHM. First, access WHM by entering “https://your-server-ip:2087” into your browser’s address line. Don’t forget to type “https”!
*   Log in with your “root” username and the correspondent password.
*   On the next screen, you’ll see the license agreement. Read it through and accept its conditions. 
*   Enter your email address as well as other ways to contact you
*   Make sure to enter the DNS resolvers as well as the network device.
*   If you have purchased additional IP addresses, you can add them at this stage. If not, you can proceed.
*   Choose the configuration of your nameserver out of four possible variants. We recommend you choose BIND. Also, you can choose “disabled” if you aren’t going to use your local machine to run a DNS server.
*   Type the nameservers. They can look like this: “ns1.bobsdomain.com” and ns2.mydomain.com”. Make sure to add A entries for your hostname. 
*   Select the configuration for your FTP server. It’s best to choose PURE-FTPD.
*   Turn on cPHulk. Leave the settings standard. 
*    Select, whether you wish to use system quotas. We recommend to “use files system quotas”.
*   Finish setup wizard.
*   Select, which features you are going to need and “save settings”
*   Create a new cPanel account. Go to  “Home > Account Functions > Create a New Account.”
*   Use your domain, username, password, and email to log in. You don’t need to pay special attention to other items right now.
*   Go to your-server-ip:2083 and log in to your cPanel
*   Feel free to use your cPanel VPS!

**Conclusion**

cPanel and WHM are powerful tools to manage your virtual private server. We hope that this guide was clear and helpful and now you can use your cPanel to manage your VPS for whatever reason you’ve purchased it. Thank you for your attention and have a nice day!

**More VPS News**

*   6 ways to enhance your VPS hosting
*   What is VPS Hosting? How Does it Work?
*   VPS Hosting Vs. Dedicated Servers – Which Is Better?
*   How to Secure Your VPS and Dedicated Servers from Hackers
*   Managed vs. Unmanaged VPS hosting -What are the Differences?

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

How to configure cPanel and WHM Panel on your VPS

By Owais Sultan
Microsoft is a global leader in cloud storage and data protection. They prove that even the most respected…
This is a post from HackRead.com Read the original post: How Data Landlords Put Their Tenants at Risk

****Microsoft is a global leader in cloud storage and data protection. They prove that even the most respected cloud databases offer weak security.****

Today’s microservice architecture is highly dependent on the fluid and interconnected transference of data. SQL is a coding language perfect for storing data in relational databases, rapidly and securely supplying data when asked. It’s also a highly reliable coding language, capable of maintaining the integrity of databases over the globe.

Unfortunately, the constant pressure to iterate and produce has forced many developers to rely on third-party platforms; cloud providers have also started over-optimizing, cramming multiple customers together on one cloud instance. This has opened up brand new attack surfaces within cloud data protection, as unknown and untrusted companies must rely only on thin walls of protection.

**The Importance of PostgreSQL**

PostgreSQL is the world’s most advanced open-source library for SQL, with a specific focus on stability, high availability, and scalability. Developed over 30 years ago, the database has the goal of streamlining and cleaning community-developed code. This is then published and re-usable with or without a commercial license. 

This SQL code makes use of cloud-stored data; it only makes sense to store the code itself also on a cloud. This is where the Microsoft Azure platform is a godsend for many development firms; this platform is a (mostly) secure and managed database.

Cloud platform offerings are hassle-free foundations for applications and services. From this reliable foundation, app developers can rapidly design and create apps without the need to focus on nitty-gritty platform management_._ Microsoft offers the Azure Database for PostgreSQL service in three deployment variations: Single Server, Flexible Server, and Hyperscale. 

Cloud storage is beneficial in a number of major ways; scalability is an inherent strength of the cloud, as businesses will only need to pay enough for their own storage. Any storage will require a set amount of computational power; however, from a business perspective, flexibility flies in the face of reliability.

Microsoft fixes this with an ingenious method: given a set amount of server space, multiple clients can ‘inhabit’ this cloud, optimizing both customer demand and computation power.

**How Multi-Tenancy Architecture Works**

This multi-tenant layout sees different customers share system resources like storage, memory, and operating systems. Bundled together, these are all powered by a single set of physical hardware. 

Customer instances are separated by virtualization. The second layer of software encompasses the cloud environment, simulating hardware functionality to create a singular virtual computer system. There is one instance per client allowing for logical separation, and further helping to separate and track resource usage. 

**The PostgreSQL Attack**

In 2022, researchers discovered a critical vulnerability within the PostgreSQL Microsoft Azure platform.

When validating the authorization of a server and validating a connection, Azure’s source code checks the client’s certificate. It searches for a predefined common name. However, an oversight in the validation process meant that slipping in extra characters between the beginning and end of the fake certificate allowed access anyway.

The next step in the attacker’s to-do list is to establish which elements of a user’s database contain valuable info.

External to every client’s virtual environment, the clients all share a level 3 memory cache. Put simply, this mirrors the system memory across all client instances. An attacker could manipulate this cache to a known state. When a user logs on and uses the platform, the attacker can then look at the changes present in the cache, pinpoint it to a victim’s activity, and trace it back to where the user stores their sensitive data.

With a chain of attack suitably established, the final step is to find a victim.

The researchers have clarified that this attack only works against databases from the same region. However, finding the region of a pre-existing database is a relatively easy task; it’s evident from the IP address of its hosting server. Once this is known, it’s a relatively simple task to set up an account and start exploiting other users on the same cloud.

So, how can you protect yourself from malicious neighbors?

**Keeping Your Cloud Secure **

Whereas many coding libraries are publicly shared and open source, multi-million-dollar companies have no such obligation to publish their own code and architectures. Though this makes complete sense from a patent perspective, it comes at the detriment of your own security choices.

More researchers are beginning to ask cloud providers to give a better overview of their isolation architectures; always ask for relevant documentation before choosing a provider.

CVE provides a global documentation process for vulnerabilities and misconfigurations. When code is mishandled and exploited, it is given a CVE ID. This aids in researching, tracking, and ultimately preventing those vulnerabilities.

However, the issue with cloud providers is that software security flaws and misconfigurations do not receive CVE IDs. This makes it far more difficult to establish a cloud provider’s track record. There is good news on this front, however – a hard-working team of security professionals is creating a Github database of cloud security incidents. 

If you’re already in a multi-year contract with a cloud provider, then your options are slightly more limited. It’s important to remember that relying on the properties of a single program, or virtual machine is not sufficient; vulnerability in any component of service can compromise the security of the entire service. The bottom line is that – if data is exposed to the internet – then it is vulnerable.

Managing this risk is an important part of operating a secure company. 

Any critical data – that is, data that could do irreparable damage if stolen from your organization – should not be stored in any third-party cloud environment; multi-tenant or not. Instead of relying on an un-transparent third party’s architecture, critical data should be stored on an ultra-secure local server. This should have no direct access to the public internet.

For your uncritical data, cloud storage is a convenient and scalable solution, as long as you put further barriers between any attackers and your data. Encrypting your data once it’s in the cloud means that – even if an attacker does gain access – the data is functionally useless for them.

How Data Landlords Put Their Tenants at Risk

By Deeba Ahmed
The apps were loaded with info-stealing malware that can extract victims’ Facebook credentials and download other software, etc.…
This is a post from HackRead.com Read the original post: Play Store Apps Caught Spreading Android Malware to Millions

****The apps were loaded with info-stealing malware that can extract victims’ Facebook credentials and download other software, etc.****

According to researchers at Dr. Web, at least a dozen mobile apps on Google Play Store contain info-stealing malware, adware, and other types of malicious software. Most of the apps are Android\-based and collectively boast over 2 million downloads. Based on the app reviews, users aren’t too happy with these apps because of their shady functioning.

**Details of Malicious Apps**

Researchers noted that five infected apps were available for download on Play Store. These include:

1.  **Wild & Exotic Animal Wallpaper:** It contains adware that replaces its name with SIM Tool Kit soon after downloading. It has 500,000 downloads so far.
2.  **PIP Pic Camera Photo Editor**– This app appears as an image editor, but in reality, it steals the Facebook credentials of its users. This app has over 100,000 downloads.
3.  **ZodiHoroscope – Fortune Finder-** This is another malicious app designed to steal Facebook credentials. It has 500,000 downloads.
4.  **PIP Camera 2022**– This app showcases various camera effects but actually steals your Facebook profile information. Around 50,000 users have downloaded it.
5.  **Magnifier Flashlight:** This malicious app contains adware and has around 10,000 downloads.

According to Dr.Web’s report, researchers identified four additional malicious apps that aren’t available on the platform anymore. The apps included a racing game, an app offering deleted photos recovery, a state compensation app for Russians, and an app for free access to OnlyFans.

Though these apps are no longer available to the general public, the risk posed to users who have downloaded them already cannot be overlooked. The worrying aspect is that the malicious apps can steal data from other apps installed on your phone.

Malicious apps pointed out by Dr.Web

**Lesson**

When this article was published, all apps highlighted by Dr. Web were removed from Google Play Store. However, the lesson for smartphone users is that they must not download unnecessary apps from Official or third-party app stores.

Furthermore, always read reviews and feedback in the app’s review section. Although some reviews can be fake or published by developers to promote their app, primarily, the review section plays a vital role in keeping users secure by avoiding downloading malicious apps.

**More Android Malware News**

*   Play Store apps plagued with malware have 700,000 downloads
*   BRATA Android malware factory resets phones after stealing funds
*   New Android banking malware Xenomorph found in Play Store apps
*   Web3 Backdoor Wallets Stealing Seed Phrases from iOS/Android Users
*   New Russian Android Malware Tracks GPS Location and Spies on Victims

Play Store Apps Caught Spreading Android Malware to Millions

By Deeba Ahmed
The DDoS attack originated from 121 countries and was powered by a small botnet of only 5,067 hacked…
This is a post from HackRead.com Read the original post: Cloudflare Thwarted Largest Ever HTTPS DDoS Attack

****The DDoS attack originated from 121 countries and was powered by a small botnet of only 5,067 hacked IoT devices.****

Cloudflare has reported stopping a record-breaking HTTPS DDoS attack (distributed denial of service attack) this month. The company claims this attack peaked at 26 million requests per second (RPS), making it the largest ever HTTPS DDoS flood recorded.

It is worth noting that in April 2022, Cloudflare reported stopping a similar attack that peaked at 15.3 million rps. Evidently, the latest attack is significantly larger than the previous one. Cloudflare is an American DDoS mitigation, SSL certificate service, and content delivery network. 

**An Unusual Attack**

Cloudflare’s product manager, Omer Yoachimik, noted that the target was a customer using a Free plan. The previous largest DDoS attack reported by the company was also targeted against one of its customers.

The latest attack is far more unusual than the one it mitigated in April. That’s because of several factors, such as the size and the fact that attackers used junk HTTPS requests. 

Moreover, the attack came from Cloud Service Providers instead of Residential ISPs, and virtual servers and machines were hijacked to launch this attack rather than low-bandwidth, infected IoTs (internet of things) devices.

The company reaffirmed that all the customers using its Free and Pro plans are protected against DDoS and similar attacks regardless of the attack duration or size.

**Further Details**

Cloudflare explained that a relatively tiny but powerful botnet was used to carry out this DDoS attack. Surprisingly, the botnet comprised only 5,067 devices. The attack originated from 121 countries, and each node made 5,200 rps at its peak moment. 

Within 30 seconds, the botnet generated 212 million requests over 1,500 networks, which is more powerful than other botnets the company has tracked so far, some of which even comprised over 730,000 devices at an average of 1.3rps/device. 

Most requests came from Indonesia, Brazil, the USA, and Russia. Conversely, around 3% of this attack was carried through TOR connections. Since the attack involved HTTPS, it cost attackers more money to launch it, and the company bore a massive financial burden for mitigating it.

> “HTTPS DDoS attacks are more expensive in terms of required computational resources because of the higher cost of establishing a secure TLS encrypted connection. Therefore, it costs the attacker more to launch the attack, and for the victim to mitigate it. We’ve seen very large attacks in the past over (unencrypted) HTTP, but this attack stands out because of the resources it required at its scale.”
> 
> Cloudflare – Blog post 

**More DDoS Attack News**

*   Imperva mitigated a series of massive ransom DDoS attacks
*   DDoS Attacks by Hacktivists Disrupted Russian Alcohol Supply Chain
*   Growing Threat of Ransom DDoS Attacks Requires Effective Mitigation
*   Pro-Iran Group ALtahrea Hits Port of London Website by DDoS Attacks
*   Admin of DDoS-For-Hire Service “DownThem” Gets 2 Years Prison Sentence

Cloudflare Thwarted Largest Ever HTTPS DDoS Attack

By Deeba Ahmed
The misconfigured Elasticsearch database apparently belonged to the US-based software solution provider Transact Campus. SafetyDetectives’ cybersecurity research team…
This is a post from HackRead.com Read the original post: Elasticsearch Database Mess Up Exposed Login, PII Data of 30,000 Students

****The misconfigured Elasticsearch database apparently belonged to the US-based software solution provider Transact Campus.****

SafetyDetectives’ cybersecurity research team led by Anurag Sen identified a misconfigured Elasticsearch server that exposed the data of Transact Campus app. According to their analysis, the server was internet-connected and didn’t need a password to allow access to data.

Resultantly, around 1 million records were leaked, revealing personally identifiable information of over 30,000 to 40,000 students.

**About Transact Campus**

Transact Campus is an American payment software provider headquartered in Phoenix, Arizona. The company offers technological solutions for integrating versatile payment functions into a single mobile platform.

Its software solutions are mainly used to facilitate student purchases at higher education institutes and streamline payment processes for institutions and students.

**What was Exposed?**

SafetyDetectives wrote in the report that the 5GB worth of database leaked by the server contained details of students who are account holders at Transact Campus. Most of the impacted individuals are US nationals.

The exposed data included students’

*   Full names
*   Phone numbers
*   Email addresses
*   Credit card details
*   Transaction details
*   Login information (username and passwords), etc.

It is worth noting that the login data, including username and password, was stored in plain text format. On the other hand, the credit card details included the banking identification number, which comprises the first six and last four digits of the credit card number, bank information, and the card’s expiration date. Furthermore, the students’ purchased meal plans and meal plan balance were also part of the leaked data.

Plaintext log in details and PII data (Image credit: SafetyDetectives)

**Transact Campus’ Response**

SafetyDetectives informed Transact Campus about the exposed database in December 2021, and the company replied after over a month in January 2022. However, the details of the incident were only published last week.

During this time, researchers made several attempts to contact them and also contacted US-CERT, after which it was secured. Transact Campus claimed that the leaked server wasn’t under their control and that the data was fake.

> “Apparently this was set up by a third party for a demo and was never taken down. We did confirm that the dataset was filled with a fake data set and not using any production data.”
> 
> Transact Campus

However, SafetyDetectives claim that the server in question was continuously being updated even when it was discovered. They checked the data using publicly available tools and found that it belonged to real people.

Nevertheless, SafetyDetectives and Anurag Sen have a proven track record of identifying and reporting exposed databases and servers to affected parties. Some of their previous reports include the following:

1.  Cosmetic Giant Natura
2.  Calgary Parking Authority
3.  Uganda Security Exchange
4.  German Shopping Giant Windeln
5.  Australian Trading Giant ACY Securities
6.  Brazilian Marketplace Integrator Hariexpress

_The list goes on…_

**Possible Dangers**

Researchers couldn’t identify whether or not unauthorized third parties and malicious actors accessed the database before being secured. In case it was accessed, cybercriminals can target students in various attacks, from scams to phishing and spam marketing, or even carry out account takeover since login credentials were stored in unencrypted form on the server.

**More Misconfigured Servers News**

*   Misconfigured baby monitors exposing video stream online
*   Anonymous hacked 90% of Russian misconfigured databases
*   Misconfigured AWS bucket exposed 421GB of Artwork Archive data
*   350 million email addresses exposed on misconfigured AWS S3 bucket
*   Exposed ElasticSearch Servers Exposed 579GB of Users’ Website Activity

Elasticsearch Database Mess Up Exposed Login, PII Data of 30,000 Students

By Owais Sultan
What occurs to your mind when you hear of 3D printing? The latest advent in technology? Well, truth…
This is a post from HackRead.com Read the original post: How 3D Printing Has Become a Global Trend With Time

What occurs to your mind when you hear of 3D printing? The latest advent in technology? Well, truth be told, 3D printing shares a pristine history and became a force changer for many industries across the globe in the 1980s.

Now, the capabilities of 3D printing technology have diversified with time. Especially with the 3D printer equipment manufacturers devoting time to allocating and using various resources, every industry is making the most out of this benefit. 

Thus, with the portfolio of compatible materials, users demand and rightfully receive high-quality products and have greater choice in everything. It is important to note that the growth potential in 3D printing materials is different from printing equipment. After all, the legacy printers are still functional and continue to consume all kinds of materials.

Therefore, the 3D printing value chain has shown tremendous growth in the last few years. According to various experts, the net worth of 3D printing materials is all set to cross the $30 billion mark in the future. 

**Technology and Applications**

Today, seldom will you find an industry that is not making the most out of 3D printing. In reality, the 3D printing market offers broad materials for every industry globally. And the sales of 3D printers are growing since this tool has become a trendsetter across the globe.

The majority of which are still purchased by various companies and academic institutions. According to recent research, the sales of 3D printers skyrocketed last year, after companies and schools opened again. As of now, the sales of desktop 3D printers are at an all-time high and booming. 

The worldwide revenue from the additive manufacturing and 3D printing industry is already impressive. Yet, it has miles to go since 3D printing is steadily finding pace in every company across the globe. Every country has shown impressive growth in terms of 3D printing. For example, if we take China for discussion, it is fair enough to say that China stands for concrete as the world’s center of mass manufacturing.

Now, it has embraced the power of 3D printing and is making the most out of it. According to a new report, it has been revealed that China will soon take over the US in terms of 3D printer sales anytime soon.

The sheer size of the country’s population is an answer to many questions. China itself is a market for brands that want to reach a larger audience. Last year, around a 0.25million printers, were sold in the country. But this number is expected to grow and bloom with time. This number is expected to cross the 1 million mark by 2025. Just like China, the printing market everywhere across the globe has shown tremendous change in revenue. 

**How is 3D Printing Better?**

Long story cut short, 3D printing has tons of benefits to offer. First of all, you don’t have to invest a lot of resources. This eventually helps in saving finances and major expenses in the long run.

Secondly, since 3D printing helps make the environment greener, it reduces the carbon footprint. This is enough reason why millions of companies globally are investing in 3D printing. The most recent one is the logistics industry, wherein it is crucial. Even large-format companies such as Massivit 3D are making the most out of this technology to save a lot of money in the long run. 

The shift to digital printing raises questions, but this technology has stood the test of time and is better than the conventional methods. More than contributing to a greener environment, it is helping revolutionize modern manufacturing methods. Now that customized 3D printing has been introduced, it has become an instant rage. 

According to recent research, small desktop printers are in higher demand than large industrial ones. The slight revenue growth in the industry has been the result of the demand by academic institutions. Even the 3D printing companies are focusing on providing diverse services to the clients since the demand of every firm is different.

Although the pandemic halted the growth, yet when everything returned to normal, the 3D printing industry witnessed larger-than-life growth. Therefore, it is fair enough for 3D printing firms to claim a fair share in the industrial market where the competition is at an all-time high. 

**More 3D Printing Technology News**

*   3D Printing and Engineering; an Overview
*   Prognosis On The Future Of 3D Typography
*   Injured Girl Gets 1st-ever 3D Printed Titanium Skull Implant
*   Here’s a 3D Printed Remaking of ‘Ear of Hell’ Classic Audio Speakers
*   3D-printed fingerprints can unlock your device with an 80% success rate

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Source

HackRead