By Waqas
The 50GB worth of data is currently being sold on two clear web forums with a price tag of 1 BTC per database.
This is a post from HackRead.com Read the original post: Data of Israeli Employees from 29 Logistics Firms Sold Online

A group of hackers has posted a trove of approximately 50GB of data for sale on two online forums and a Telegram group. The data was posted on 26 and 27th November 2022. This was revealed to Hackread.com by researchers at VPNMentor.

A probe into the incident revealed that the data belonged to 29 Israeli transportation, logistics services and forwarding firms. Researchers believe that the hackers breached a software provider’s single point of failure, gained unauthorized access to these logistics firms’ supply chains, and exfiltrated a trove of personal data and shipping records.

**50 GB of Israeli Firms’ Data on Sale**

Hackers have posted the stolen data for sale. Visitors can buy a complete employee and customer information dataset from the targeted companies. The per-database rate is 1 BTC, which equals $17,000. An analysis of the graphics associated with these posts revealed that the data is part of a Black Friday Sale.

Previously, when some Israeli delivery firms were **targeted in cyberattacks**, the Israeli government’s cyber agencies named Iranian threat actors as the perpetrators. However, it is unclear if the same actors are responsible in this instance.

**Details of Leaked Data**

According to VPNMentor’s **blog post,** exposed data includes contract details and shipment information of the affected Israeli firms. The hackers have listed 1.1 million records for sale on different online forums. It seems like they have shared a small sample of data.

Whether 1 record represented 1 person or 1.1 million people were impacted in this data breach couldn’t be determined. The exposed information includes full names, addresses, and contact numbers.

Researchers were unsure whether the exposed addresses were work or home addresses. Customers’ exposed data includes full names and shipping details (sender and receiver’s addresses, number of packages, contact numbers, etc.).

Screenshot provided by VPNMentor shows post by hackers and what’s in the data.

**Possible Dangers**

These records can be exploited to intercept packages or blackmail/threaten courier firms’ employees into handing over valuable shipments. Threat actors can use personal data such as full names or contact details to target people with **scams and phishing attacks**.

Customers of these firms should be wary of suspicious SMS messages and calls and do not share personal information via phone. They should reveal sensitive data only to a trusted source only when necessary.

1.  **Australian Trading Giant Exposed 60GB of User Data**
2.  **MyEasyDocs Exposed 30GB of Israeli Students’ PII Data**
3.  **Iranian hackers leak a trove of Israeli LGBTQ dating app data**
4.  **Logistics giant D.W. Morgan exposed 100 GB worth of clients’ data**
5.  **Logistics giant exposes customer data, Lolz at researchers when alerted**

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Data of Israeli Employees from 29 Logistics Firms Sold Online

By Owais Sultan
Did you know Fortnite was the first game to break through on a variety of console platforms, including XBOX/PS/Switch?
This is a post from HackRead.com Read the original post: Behind The Success Of Phenomenon Game Fortnite

Fortnite refers to a video game series set in a post-apocalyptic, zombie-infested world. It was developed by **Epic Games** and uses the company’s signature Unreal Engine. Currently, Fortnite has two titles: a team survival shooter called Fortnite: Save the World and a single-player game called Fortnite: Battle Royale.

Millions of players have downloaded the game since its launch, generating hundreds of millions of dollars a month for its creators. According to a **survey** by CouponBirds, Fortnite’s monthly active player base has remained around 80 million. The incredible number of people online makes for incredible profits. Fortnite: Escape brought in $5.4 billion in revenue for Epic in 2018 alone, making it the world’s most profitable game that year.

**How did Fortnite achieve so much in such a short time?**

**Fortnite** achieved what was previously considered almost impossible in the gaming industry: it was the first game to break through on a variety of console platforms, including XBOX/PS/Switch. Fortnite’s simultaneous cross-platform PC/ console/mobile connectivity is a big deal in the closed gaming ecosystem. This is due to **Tim Sweeney** and Unreal Engine’s many years of experience in the industry and their contacts and influence.

On the other hand, Fortnite has made a significant model innovation in the **F2P premium system** with its Battle Pass season ticket subscription model. By most people’s understanding of free-to-play in-game payment mechanics, it’s a treasure chest or so-called ten-row model. Treasure chests are a great way to monetize a game on a large scale, but the number of paying players affects the balance of the game, and endless amounts of money usually make the game suck.

How did Fortnite do it? It takes the concept of a subscription system commonly accepted in Western Internet culture and differentiates rewards by season. More important is the way rewards are earned: each season, users play the game for free to gain experience points that can be used to improve their battle pass levels, which have corresponding rewards for each level.

Image credit: Epic Games

These mechanics combine to create an addictive growth experience that allows Fortnite games to go crazy for retention and daily active players. **Fortnite’s Battle Pass** payout rate is 70%, something every game developer dreams of. Fortnite’s original Battle Pass payment design was a huge success, and many of the world’s biggest games have followed suit, almost all of which have had a direct impact on retention and payment.

Not only that, but in Fortnite, users can build, socialize, and interact. In addition to the gameplay experience, Fortnite quickly transformed itself into a social space, connecting the game space with real life.

Fortnite is one of the closest systems ecosystems to a **metaverse**. It stopped being a real game and became more and more social, evolving into a virtual space where custom characters interact. So far, there have been concerts, movie launches, fan meets, and other real-world events held in Fortnite’s virtual environment:

*   Marshmello’s first live Fortnite concert in February 2019 was played by more than 10 million players;
*   In April 2019, Marvel’s Avengers: Endgame offered a new co-branded interactive mode in Fortnite, where players take on the role of the Avengers as they battle Thanos;

*   In December 2019, Star Wars: The Rise of Skywalker held an audience screening at Fortnite, where director JJ Abrams was interviewed;
*   In April 2020, American rapper Travis Scott held an immersive concert called Astronomical in Fortnite, which was watched by 17 million people at the same time, causing a viral spread on social media;
*   In August 2021, Ariana Grande, a popular American singer, performed five consecutive concerts in Fortnite.

Image credit: The Verge

The star power made the game more popular and contributed to its success. The future looks bright for Fortnite. New maps, lots of new content, and a blank slate are sure to host crazy **new livestreams**. The number of players is growing and this match is sure to be one of the top games for the foreseeable future.

1.  **Top Dangers That Online Gamers Face**
2.  **Influence of technology on the gaming industry**
3.  **12 Classic Games You Can Play on Your Smartphone**
4.  **Minecraft declared the most malware-infected game**
5.  **What is Blockchain Gaming and its Play-to-Earn Model?**

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

Behind The Success Of Phenomenon Game Fortnite

By Habiba Rashid
According to white hat hacker Sam Curry, once exploited, attackers could use the flaw to unlock the door, honk the horn, flash the lights, or even start the vehicle.
This is a post from HackRead.com Read the original post: App Flaw Allowed Honda and Nissan Cars Hack by Knowing VIN number

As convenient as it may be to be able to control certain features of your car using only a mobile app, you should keep in mind that with innovative technology comes the threat of **hackers finding vulnerabilities in it**.

As it turns out, remote car apps for several automakers giants that allow users to start, unlock, honk, and locate their car from their phones could actually be used without needing the login credentials.

Hacker, bug bounty hunter and Staff Security Engineer for Yuga Labs **Sam Curry published two threads on Twitter** explaining his research in which he uncovered this gaping hole in the remote car app security system of several makes including Nissan, Honda, Infiniti, and Acura vehicles. 

> More car hacking!
> 
> Earlier this year, we were able to remotely unlock, start, locate, flash, and honk any remotely connected Honda, Nissan, Infiniti, and Acura vehicles, completely unauthorized, knowing only the VIN number of the car.
> 
> Here’s how we found it, and how it works: pic.twitter.com/ul3A4sT47k
> 
> — Sam Curry (@samwcyo) November 30, 2022

Curry stated that he located the vulnerability by searching for the telematic platform shared by all these companies, which is offered by SiriusXM. Otherwise known for its satellite radio functionality, **SiriusXM offers** a Connected Vehicle Services package to other brands as well such as BMW, Hyundai, Jaguar, Land Rover, Lexus, Subaru, and Toyota. 

According to Curry, only the vehicle identification number (VIN) was needed to authorize the data exchanged through the telematics platform, allowing any person who knew the vehicle’s VIN to carry out various commands such as unlocking the door, honking, flashing the lights, or even starting the vehicle. 

When Curry tested this out, he also found that he could retrieve customer details such as a customer’s name, home address, contact information, and car details using only the VIN which is visible through the windshield on the dash of most vehicles.

Furthermore, the API calls for telematic services worked even if the user no longer had an active SiriusXM subscription. Curry also noted that he could enroll or enroll vehicle owners from the service at will.

Curry was only able to confirm that this vulnerability existed for Nissan, Honda, Infiniti, and Acura vehicles and did not cover the rest of the brands linked together by the service. 

On the brighter side, however, you can rest assured that your car is not affected by the vulnerability anymore. Before disclosing his findings publicly, Curry compiled a detailed report of the security vulnerability and presented it to the company.

He said that SiriusXM had used that information to immediately patch the vulnerability which means that the issue was already fixed before the news went public.

**Limited Security Options**

In the digital age, connected cars are becoming increasingly popular. They offer a range of benefits, from remote access to fuel consumption monitoring and more. But for car owners using apps to manage their vehicles, there are also potential security risks that need to be addressed.

The security of a vulnerable app is in the hands of its developers and owners, and only they can issue security updates and patches to fix the issue. This means users have limited and traditional options to go with. Here are a couple of steps you can take to protect your car from hackers and other cyber threats when you’re using applications.

To start with, do not share your car’s VIN numbers with unreliable third-party, make sure you use unique passwords for each app associated with your vehicle. Strong passwords that combine letters, numbers, and symbols can help protect valuable data stored in the connected cloud networks used by those apps.

Additionally, users should update their systems regularly with any new security patches released by their chosen app provider – these updates help keep hackers out of your car’s system.

1.  **Smart Cars: Increasing Comfort — Reducing Security**
2.  **How Hackers Can Remotely Unlock/Start Honda Cars**
3.  **Unlocking Tesla Cars, Smart Devices with Bluetooth Flaws**
4.  **Self-driving cars can be fooled by displaying virtual objects**
5.  **Internet-connected cars can be hacked to gridlock major cities**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

App Flaw Allowed Honda and Nissan Cars Hack by Knowing VIN number

By Habiba Rashid
The backdoor is equipped with a wide range of spying capabilities, including exfiltrating files, keylogging, and stealing browser data, etc.
This is a post from HackRead.com Read the original post: North Korean APT37 Unleashes Dolphin Backdoor on South Korea

On 30th November, ESET researchers uncovered Dolphin, a sophisticated backdoor used by an APT group named ScarCruft, likely to be linked to **North Korea**.

The group also referred to as APT37, InkySquid, Reaper, and Ricochet Chollima, is known to attack government entities, diplomats, and news organizations in South Korea and certain other Asian countries.

The geopolitical espionage group has been active since 2012, working to compromise targets linked to the interests of North Korea. It is worth noting that **in August 2021**, the same APT group was previously found using the Konni RAT variant against Russian organizations, while **in December 2019**, Microsoft had already spotted and dismantled a network of 50 malicious domains used by the group.

This time around, the backdoor used by the group has a wide range of spying capabilities which includes monitoring drives and portable devices, exfiltrating files of interest (such as media, documents, emails, and certificates), keylogging, taking screenshots, and stealing credentials from browsers.

Initially, a targeted device is compromised using less advanced malware after which the Dolphin backdoor is deployed to abuse cloud storage services, specifically **Google Drive**, to allow Command and Control (C&C) communication. 

During their investigation, ESET researchers observed that the older versions of the previously unreported backdoor were able to modify the settings of victims’ signed-in Google and Gmail accounts to lower their security, in order to gain access to victims’ email inboxes.

Furthermore, it searches the drives of compromised systems for interesting files and infiltrates them into Google Drive. This should not come as a surprise since **Google Drive is accounted for 50%** of malicious document downloads.

It was first found by the Slovak cybersecurity company in early 2021 and deployed as a final-stage payload as part of a watering hole attack against a South Korean digital newspaper. The campaign exploited two Internet Explorer flaws (**CVE-2020-1380** and **CVE-2021-26411**) to drop a backdoor named BLUELIGHT.

Although made by the same APT Group, BLUELIGHT is not as advanced as Dolphin and is only used to execute an installer shellcode that activates a loader comprising a Python and shellcode component, the latter of which runs another shellcode loader to drop the Dolphin backdoor. 

Dolphin backdoor’s infection chain (ESET)

“While the BLUELIGHT backdoor performs basic reconnaissance and evaluation of the compromised machine after exploitation, Dolphin is more sophisticated and manually deployed only against selected victims,” ESET researcher Filip Jurčacko explained in a **blog post**.

Since initially being discovered in April 2021, Dolphin has undergone three successive iterations that improve its features and grant it more capabilities to evade detection. 

“Dolphin is another addition to ScarCruft’s extensive arsenal of backdoors abusing cloud storage services,” Jurčacko said. “One unusual capability found in prior versions of the backdoor is the ability to modify the settings of victims’ Google and Gmail accounts to lower their security, presumably in order to maintain account access for the threat actors.”

1.  **N. Korean hackers stole $1.7B from cryptocurrency exchanges**
2.  **N. Korean Radio Station Hacked to Play “The Final Countdown”**
3.  **US Warns Firms About N. Korean Hackers Posing as IT Workers**
4.  **N. Korean hackers used VPN flaws to hack S Korean atomic agency**
5.  **Elite N. Koreans aren’t opposed to exploiting internet for financial gain**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

North Korean APT37 Unleashes Dolphin Backdoor on South Korea

By Deeba Ahmed
CryWiper showcases ransomware-like features, such as file modification, adding a .CRY extension to the files, leaving a ransom note, etc.
This is a post from HackRead.com Read the original post: CryWiper Masquerading as Ransomware to Target Russian Courts

Threat actors are targeting Russian Mayors’ courts and offices with a new malware called CryWiper that appears as ransomware. In reality, it’s a wiper that can destroy all the data on an infected system permanently.

This reminds us of **Microsoft’s report in January 2022** in which a “destructive malware” was faking ransomware infection to target Ukrainian tech organizations, government agencies, and non-profit organizations.

**Campaign Analysis**

Cybersecurity firm Kaspersky and the Izvestia news service’s researchers have revealed startling details of how a new wave of attack has surfaced involving a brand-new trojan. It showcases ransomware-like features such as file modification, adding .CRY extension to the files and saving a README.txt file and a ransom note.

The note contains a bitcoin wallet address, the infection ID, and the email ID of the malware creators. However, these are deceptive measures employed by the attackers because CryWiper isn’t ransomware but a wiper, which is why researchers dubbed it CryWiper.

CryWiper ransom note (Image: Kaspersky)

The files, according to researchers, it modifies cannot be restored to their previous/original state. So, it is pointless even to **consider paying the ransom**.

**Pinpoint Targets**

In their **report**, Kaspersky researchers noted that CryWiper launches ‘pinpoint attacks’ on targets based in Russian Federation, whereas Izvestia noted that the targets are mayors’ courts and offices in Russia.

Reportedly, this wiper corrupts any data that isn’t essential for the operating systems’ functioning. Such as it doesn’t modify files with extensions .dll, .exe, .msi, or .sys. Kaspersky discovered the attacks in the past few months.

Moreover, it avoids affecting various system folders stored in the C:\\Windows directory. That’s because its main targets are user documents, archives, and databases.

**Why CryWiper Leaves a Ransom Note?**

Izvestia identified that after infecting a system successfully, CryWiper left a note demanding 0.5 bitcoin and a wallet address to transfer funds. Kaspersky researchers explained that although it extorts money from its targets for data decryption, it doesn’t encrypt data but destroys its completely. They further observed that this wasn’t a mistake but the developer’s original intention.

**How does it Work?**

CryWiper resembles **IsaacWiper**, using the same algorithms to generate pseudo-random numbers for directly corrupting targeted files and overwriting data. In this instance, the wiper directly rewrites the file contents replacing the original with garbage.

Then, It creates a task in the Task Scheduler to restart the wiper every 5 minutes. CryWiper can also send the targeted device’s name to a C2 server and wait for a command from the server to start the attack.

Furthermore, CryWiper halts processes of **MS SQL databases** and **MySQL servers**, MS Active Directory web services, and **MS Exchange mail servers**. It deletes shadow copies of documents on the C: drive only to prevent their restoration. It also disables the infected system’s connection through RDP remote access protocol, probably to complicate the job of incident response teams.

**Protection from ransomware and Wipers**

To protect yourself or your business from ransomware and data wipers, the first step in protecting yourself from data wipers is to back up your files regularly. This will allow you to restore any lost or damaged data if it does become compromised.

Kaspersky recommends carefully controlling remote access connections to your infrastructure including public networks. You should also use **antivirus software** with active malware protection, which will help detect and remove any malicious programs before they can cause damage.

Additionally, you should set up strong passwords for all accounts associated with sensitive data and check for suspicious activity on them regularly.

1.  **Police lose evidence to ransomware attack; suspects walk free**
2.  **DDoS Attack and Data Wiper Malware hit Computers in Ukraine**
3.  **Iranian hackers hit Israel with disk wiper in disguise as ransomware**
4.  **Crippling attack on Iranian trains linked to Meteor file wiper malware**
5.  **Linux and Windows hit with disk wiper, ransomware, crypto-malware**

CryWiper Masquerading as Ransomware to Target Russian Courts

By Deeba Ahmed
According to crypto intelligence firm Arkham, the attacker's wallet address was linked to a developer at Ankr, meaning an inside job can't be ruled out.
This is a post from HackRead.com Read the original post: 6 Quadrillion Token Heist Hits BNB Chain-Based DeFi Protocol Ankr

Web3 infrastructure provider **Ankr** is the latest victim of hacking and financial theft. The BNB Chain-Based DeFi protocol has confirmed in a series of tweets that it got hacked, and the attacker managed to steal six quadrillion tokens. The stolen crypto was Ankr Reward Bearing Stake/aBNBc.

**Incident Details**

Lookomchain, an on-chain analytics firm, stated that the hacking occurred on Friday, and the hacker stole around $10 million worth of crypto (USDC coins). The hacker could create countless Ankr Reward Bearing Staked BNB (aBNBc) tokens, which Blockchain security company PeckShield **claim** has an unlimited mint bug. Following the attack, the token’s value collapsed by at least 100%.

Soon after the attack occurred, the Binance crypto exchange **paused withdrawals**. Crypto intel firm Arkham stated that the attacker’s wallet address was linked to a developer at Ankr. Based on this, Arkham is not ruling out the possibility of an **inside job**.

As per Ankr’s spokesperson, the hacking occurred from a compromised private security key. The private-key hack helped the attacker initiate infinite tokens minting, PeckShield noted. The key was swapped out and replaced. It is worth noting that developers are allotted private keys to modify/manage smart contracts.

**Ankr’s Statement**

Ankr **tweeted** about the incident, claiming that all underlying assets on its Staking are safe at the moment, whereas all infrastructure services remain unaffected. Ankr has confirmed that after the exploitation of its aBNB token, it has urged exchanges to stop trading immediately.

The protocol has requested users to stop trading aBNB, and liquidity providers should remove liquidity from DEXes and keep the aBNBc.

Furthermore, Ankr claims that it is in touch with DEXes and will reissue tokens after evaluating the situation. the protocol suspects that it is an insider job and is devising a plan to compensate impacted users.

**What Happened to Stolen Funds?**

According to PeckShield’s **tweet**, hacker(s) transferred some funds to a decentralized cryptocurrency tumbler, Tornado Cash. It is worth noting that **Tornado Cash was blacklisted** by the US government in August 2022.

A portion of these funds was bridged through Celer and deBridgeGate. Therefore, they shifted 20 trillion of the stolen tokens into Helio, a decentralized lending protocol, and converted them into Binance Coin (BNB). Using crypto mixer Tornado Cash, they swapped the BNB for $5 million of USDC, which is equivalent to the US dollar.

1.  **Ankr Confirms Providing RPC to Sui Blockchain**
2.  **Ankr Launches Chainscanner Blockchain Explorer Tool**
3.  **Ankr Becomes First RPC Provider to the Aptos Blockchain**
4.   **Harmony’s Horizon Blockchain Bridge Hacked to Steal $100 Million**
5.  **$625m Stolen From Ronin – The Blockchain Behind Axie Infinity Game**

6 Quadrillion Token Heist Hits BNB Chain-Based DeFi Protocol Ankr

By Deeba Ahmed
Hackers are using compromised platform certificates to sign Android malware apps.
This is a post from HackRead.com Read the original post: Malware Apps Signed with Compromised Android Platform Certificates

Google’s Android security team has reported that hackers signed malicious applications using several compromised Android platform certificates. This incident also reminds us of **what happened in March 2020** when threat actors were found dropping info-stealer malware with fake security certificate alerts.

What are Platform Certificates? For your information, platform certificates are digital keys, trusted and owned by specific device original equipment manufacturers (OEMs). These are used for signing their core apps. Therefore, attackers abuse them to sign malicious apps to obtain root access as legit apps, causing serious trouble for unsuspecting users.

Every device OEM has numerous trusted certificates for signing the platform’s core apps. This is just like verifying docs with a signature to allow the signed apps to gain root privileges and let the system function optimally.

**Findings Details**

Threat actors are abusing platform certificates used by reputed Android smartphone makers, including LG Electronics, Samsung, Revoview, and Media Tek, for signing malware-infected apps. This was discovered first by Google Android Security Team’s reverse engineer Łukasz Siewierski. 

As per Siewierski, if a malicious app is signed with the same certificate for gaining the highest privilege level as the Android OS, it is possible to extract sensitive data of all kinds from the compromised device. That’s because the Android app runs with a “highly privileged user ID” dubbed android.uid.system. It holds a variety of system permissions, such as permission to access user data.

Google also published a list of malware samples signed using 10 platform certificates, which were also noted in the Android Partner Vulnerability Initiative (AVPI) issue tracker:

com.attd.da  
com.arlo.fappx  
com.android.power  
com.houla.quicken  
com.metasploit.stage  
com.sledsdffsjkh.Search  
com.management.propaganda  
com.sec.android.musicplayer  
com.russian.signato.renewis  
com.vantage.ectronic.cornmuni

**How Hackers Obtained these Certificates?**

The biggest mystery surrounding this data harvesting campaign is how the threat actors accessed these certificates. It could be possible that someone working with the company leaked them.

The apps signed with the abovementioned OEMs’ platform certificates contained HiddenAd trojans, Metasploit, info stealers, and malware droppers, with the objective of delivering additional malware or harvesting device users’ data.

Google has informed impacted manufacturers about its findings and urged them to rotate these certificates. The company confirmed that there’s no evidence that the apps were delivered via its **official Play Store.**

“Google has implemented broad detections for the malware in Build Test Suite, which scans system images. Google Play Protect also detects malware. There is no indication that this malware is or was on the Google Play Store. As always, we advise users to ensure they are running the latest version of Android,” Google stated.

1.  **Bahamut Using Fake VPN Apps to Steal Android User Credentials**
2.  **Schoolyard Bully Malware Stealing Facebook Credentials on Android**
3.  **42,000 phishing domains discovered masquerading as popular brands**
4.  **Crooks Hack World Bank SSL Certificate, Hosted PayPal Phishing Scam**
5.  **Fake Banking Rewards Apps Install Info-stealing RAT on Android Phones**

Malware Apps Signed with Compromised Android Platform Certificates

By Deeba Ahmed
The campaign is ongoing, and so far, Schoolyard Bully Malware has victimized over 300,000 Facebook users on Android devices across 71 countries.
This is a post from HackRead.com Read the original post: Schoolyard Bully Malware Stealing Facebook Credentials on Android

Mobile security company Zimperium’s zLabs has released a warning about a notorious Android trojan that has stolen around 300,000 credentials of Facebook users.

According to zLabs, Schoolyard Bully malware is the name of malware used in a brand-new Android threat campaign that has been active since at least 2008. The attackers specifically target Facebook user credentials, and the malware is found in several applications downloaded from **third-party app stores** and the Google Play Store.

The malware’s primary targets are based in Vietnam. However, zLabs researchers claim that over 300,000 victims have been identified so far, and they are located in 71 different countries since the apps were available via third-party app stores while Google Play Store has removed them from its official store.

**Trojan Details**

Schoolyard Bully malware is delivered via harmless-looking Android apps, mostly educational apps. Malicious code is hidden inside these apps, which can **steal Facebook credentials** and upload them to the Firebase C&C for threat actors. The trojan relies on JavaScript injections to display phishing pages that lure users into handing over their Facebook username/password. 

Threat actors leverage the trojan to obtain user credentials and successfully access financial accounts. Around 64% of the users used the same passwords already exposed in an earlier breach. Perhaps, this has allowed the trojan to remain active for years.

To remain hidden from antivirus software and machine learning virus detections, Schoolyard Bully Trojan uses native libraries such as libabc.so to store the stolen data. Data strings are hidden from detection software through further encoding. Moreover, the malicious educational apps are hidden in a **password-protected ZIP**.

Malicious apps (left) – Facebook phishing page (right) – Image credit: Zimperium

**What Date can be Stolen?**

The Schoolyard Bully malware can steal sensitive data from innocent users’ Facebook accounts, including user ID, password, email ID, phone number, Facebook profile name, Facebook ID, and device-related information such as device RAM and API.

Zimperium researchers have **released technical information** about the campaign and its indicators of compromises, which can help detect Schoolyard Bully malware.

1.  **9 apps with 6M installs stole Facebook logins of Android users**
2.  **Mandrake Android malware stealing Facebook, crypto data since 2016**
3.  **Fake Netflix, WhatsApp, Facebook Android Apps Contain SpyNote RAT**
4.  **Facebook removes 100s of accounts for spreading iOS, Android malware**
5.  **Cookiethief Android malware hacks Facebook accounts without password**

Schoolyard Bully Malware Stealing Facebook Credentials on Android

By Owais Sultan
Java is one of the most well-known programming languages and software platforms that is used on countless devices…
This is a post from HackRead.com Read the original post: 8 Reasons Why Enterprises Use Java

Java is one of the most well-known **programming languages** and software platforms that is used on countless devices such as mobile phones, laptop computers, etc. It is a reliable and scalable solution for the development of enterprise systems as well as web applications.

In this article, we will describe a few specifications of this programming language that make it so popular for building **enterprise-grade software**. So, upcoming is a short list of what Java is used for and the eight main reasons why business owners decide to go for java enterprise application development.

**What is an enterprise application in java?**

An enterprise application in Java is a software program whose backend was created with the help of the Java programming language. Java is an excellent choice for creating back-end functionality.

In addition, the use of Java microservices enables the creation of large-scale, complex but well-performing solutions, that’s why it is often chosen by enterprises that are dealing with large amounts of data and need to create multi-functional **complex solutions** for their business.

**What is Java used for?**

**Desktop Applications**

There are numerous features that Java language offers. The existence of its frameworks such as **AWT, Swing, and JavaFX** provide developers with a series of useful elements like buttons, menus, and form fields making it easier for engineers to create a series of functional desktop apps. Another opportunity is the creation of sophisticated 3D graphical apps thanks to the use of APIs and multiple functionalities. 

**Web-Based Applications**

Java’s popularity is mostly thanks to the fact that it helps create elegant and functional web applications. Together with .NET, Python, and Node.js, Java plays an important role in the modern web back-end world as we know it. Java is one of the most commonly used development languages to build the back-end of web apps using technologies or tools like Struts or servlets, JSP, JSF, or Spring.

**Big Data Technology **

Big Data is a combination of methods and techniques to analyze and process complex and vast datasets in order to unveil patterns, trends, and other relevant information which helps businesses make smart data-driven decisions. Data scientists process massive amounts of datasets using Spark as a tool and a Java framework like Hadoop as a backup. 

*   **Why use Java in Big Data?** 

Java is among the most popular programming languages for Big Data engineers. Most of the modern tools Big Data analysts use as well as their ecosystems are written on the basis of Java: Hadoop, Hive, **MapReduce**, and Storm. Those platforms which are not written in Java, are written in Scala (like Spark) and after knowing Java Scala is a lot easier to learn than for those who know only Python. Besides, Java is very convenient for creating complex scalable enterprise applications, which are capable of collecting and processing data.

*   **Best Big Data tools for Java developers**

The majority of modern tools for collecting, processing, storing, and analyzing data are written with the help of Java or its relative language – **Scala**: **Hadoup**, Storm, Spark, Mahout. Java also has a large community of fans and a vast open-source base which enables the creation of new tools quite frequently.

**Internet of Things (IoT) Software**

The **Internet of Things** is a system of connected devices that make our life easier in many aspects. The devices range from wearables, TVs, and smartwatches to smart electric switches, security panels, and other useful objects.

This is where Java comes into action, as it is one of the primary programming languages for the Internet of Things as it was created to run on various platforms and devices. Java flexibility, security, and a rich library base make it an excellent choice for the task of allowing humans to manage, control and efficiently use hardware devices.

**Cloud-Based Apps**

As simple as it is, cloud computing is the **on-demand provision of IT resources** on the internet that include servers, storage, databases, and networking with accessible pricing models. This means that cloud-based applications make extensive use of Java as businesses use it to create cloud-based SaaS, IaaS, and PaaS services due to the low cost and extensive usage. 

**3 main reasons**

1.  Thanks to its distributed nature
2.  It features building apps used in SaaS, IaaS, and PaaS 
3.  Provides Java development tools such as Oracle Java

**Mobile Apps **

Java uses a cross-platform framework J2ME to create mobile apps that have the objective to function on smartphones. One of the most useful operating systems for mobile apps is Android, which is based on Java. Additionally, Java is also compatible with AndroidStudio and Kotlin.

**Examples of mobile apps written using Java: **

*   Social media: Tinder
*   Location App: Google Earth
*   Service Apps: Uber, CashApp
*   Entertainment: Netflix, Twitter, Spotify

**Enterprise Applications **

Why should you use java for enterprise apps? Because it’s only among the few programming languages that offer the needed scalability, flexibility, and security. Java enterprise applications require. a lot more resources, power, and nuances than ordinary apps. Here Java plays a significant role in the build and deployment of enterprise applications thanks to its robust features and outstanding performance.

In addition, Java improves performance and strengthens the enterprise apps’ security, documentation process, maintainability, and troubleshooting.

**8 reasons to choose Java for Enterprise Applications**

Java enterprise software development is very common for the same reason that Java presents advantages in comparison to other programming languages, its robust nature being one of the main ones. However, the following list will give a clear scope of why java is used so often as a tool for programming various software systems. 

1.  Its complexity level is low, it is easy to write, compile and/or debug. 
2.  It is object-oriented allowing the creation of modular programs and reusable code.
3.  It is cloud independent as it moves easily from one computer system to another. 

The above section explains in detail what Java is used for. The following portion of the information is to give a clear scope and the reasons to choose Java for enterprises even when **outsourcing java development** services. 

**Stable Language**

Among **all programming languages**, Java has the highest stability. Besides gaining stability in growth, it has developed into a stable language as well. This is the reason why firms around the world hire Java experts, to create solutions that use the needed technology to attain stability. One thing that has helped this stability is the use of different testing methods to remove faults. Additionally, it allows the creation of programs that do not require a lot of upkeep. 

**Scalability **

Scalability is the capacity for something to be changed in size or scale. In technological terms, it is the versatility with which a computing method can be applied or produced. Java is used to build applications that are easy to handle any growing workload. 

**High Speed and Performance**

In addition to the stability and scalability, Java leverages multi-threading and less memory use to achieve improved performance. It is a quick-moving technology that helps programmers provide solutions instantly. Companies that require fast and efficient results rely on programming languages to power up their products. 

**Extensive and Active Community**

Java fosters innovative and analytical thinking in all types of developers and designers. It helps large engineering firms with the greatest information networks expand. Everything is free, and it is a pleasure to create, offer, and receive professional advice on Java application development.

**Cross-Platform Compatibility**

Operating systems including Mac OS, Unix, and Windows can easily run Java applications thanks to the **Java Virtual Machine (JVM)**. The Java apps can be run on any device with a contemporary processor. It is possible to manage multiple threads since JVM has been optimized for operation on potent multi-core machines.

**Various Libraries**

Java Libraries are crucial for creating enterprise applications because they enable the addition of new features, the resolution of frequent issues, or the discovery of novel development techniques. It is simpler for developers to use free and open-source libraries for practical applications because they have business-friendly licenses.

**Platform-Independence**

Java is used on enterprise software applications due to being a platform-independent language. There is no need to repeat tasks, the moment a code is developed it can be dragged across a variety of platforms without having to redo the code. In short, developers use this and work on building Java enterprise applications without worrying about the platforms they are building them for.

**Economic Maintenance**

When choosing enterprise software development with java, firms must think of the economical aspects as well. Java’s clear nature makes it cheap and simple to create. Programmers dealing with it can run it on any computer, regardless of hardware, which significantly reduces high costs. 

**Conclusion**

Java is a programming language that is the first choice by many, whether engineers or enterprises. In general terms, it is a programming language that has been and will continue to be used. It has the proper characteristics and components to produce adaptive applications in different businesses and start-ups.

Enterprise applications in Java are scalable, resilient, secure, and highly maintainable, which is why we believe this trend will continue and Java will be in demand for years to come.

8 Reasons Why Enterprises Use Java

By Habiba Rashid
In total, there are records belonging to alleged WhatsApp users from 108 countries.
This is a post from HackRead.com Read the original post: 360m Alleged WhatsApp Records Shared Freely on Telegram and Dark Web

Previously we **covered** the news of a database containing 487 million up-to-date WhatsApp user records from 84 countries being sold online on the hacking forum BreachForums which surfaced as an alternative to popular and **now-sized Raidforums**.

It is worth noting that, as **reported** by Hackread.com, it is the same forum where the personal details of 5.3 million Twitter users were recently leaked.

Now, Check Point Research (CPR) has published a report where they confirm seeing files available for sale on the **Dark Web** and Telegram groups containing 360 million phone numbers from 108 countries. 

Data seen by Check Point on the Dark Web

Each country had a different amount of mobile phone numbers present in the records and they range from 604 in Bosnia and Herzegovina to 35 million attributed to Italy. For the past four days, the files were set for sale but in a turn of events, they are now being distributed freely amongst hackers. 

In its **report**, CPR also stated that it could not confirm whether these numbers really belonged to WhatsApp users or not. On the other hand, Hackread.com downloaded a file that the threat actors claimed contained 500 million WhatsApp numbers. This is what it looks like:

Data seen by Hackread.com on Telegram

Karol Paciorek, a cybersecurity researcher and expert from the computer security incident response team of the Polish financial sector (CSIRT KNF) **wrote** on Twitter on Tuesday that the leaked database was simply a re-use of an older **2019 Facebook breach**.

He stated that the sample of the 5000 WhatsApp data records from Poland is identical to the one they saw in 2019. 

Keeping the current situation in mind, it is likely that vishing and smishing attacks will rise. They are both forms of phishing but instead of sending malicious links through email, threat actors dupe the victim into giving information over the phone (**vishing**) or through SMS (**smishing**). 

Certain measures that users should take to protect themselves from any such attacks include the following:

*   Do not click links that you are unable to verify due to link shortening and the inability to hover over links to see targets. Instead of clicking directly on the links in text messages, open the target site directly from the browser.
*   Do not install apps from any links sent through SMS. Instead, always use reputable app stores for downloading applications and ideally, also verify their authenticity from the creator’s website.

*   Smishing and vishing attacks can only harm you if you interact with them and give out information. Therefore, never provide any personal data to someone that you have not called or texted using the number shown on their website.

*   Always verify phone numbers to confirm that the caller belongs to a legitimate organization. Before providing any data or following any instructions, get the caller’s name and call them back using the official number from the company website. If the caller does not straightforwardly give his name and talks you out of it, it is likely to be a scam.
*   Never provide remote computer access to any individual claiming to help you in “removing malware” or fixing some other issue. Only trust the verified members of the IT department.

1.  **142M MGM Resorts Records Leaked on Telegram**
2.  **Ransomware Gang Leaks Medibank Data on Dark Web**
3.  **New credit card skimmers channel funds through Telegram**
4.  **Data of 21M SuperVPN, GeckoVPN users leaked on Telegram**
5.  **8 Online Best Dark Web Search Engines for Tor Browser (2022)**

I’m a student and cybersecurity writer. On a random Sunday, I am likely to be figuring out life and reading Kafka.

Source

HackRead