• 3 Posts
  • 53 Comments
Joined 3 years ago
cake
Cake day: July 9th, 2023

help-circle







  • The volunteer investigated further and found that when people ignored the warning, the attacker (1) stole the SSH password, (2) opened a connection to the server and observed all typed commands, and (3) opened a second connection and infected the server with Ebury.

    To investigate the campaign, Kaba created a script that polled all of Tor’s roughly 3,000 exit nodes to check whether they received a correct SSH fingerprint from a test server. The test server then checked whether the connection came from a pinned exit node or one of 12 SSH interception servers used by the attacker. The volunteer further set up a honeypot to observe the interception software attempting to log in and install Ebury.

    . . . The takeaway from the event is the crucial role in-depth defense plays in preventing data theft in mass hacks like this one. Those measures include configuring email accounts to accept only encrypted traffic and reject unencrypted ports. Another is to disable password authentication in favor of SSH keys.







  • According to the report, Controlium is able to harvest a user’s identity and IP address when the user is shown a seemingly benign custom-created ad – for example, for a digital game or a telecoms service. If the user has been selected as a target for hacking, a mercenary spyware firm can then send a malicious code containing spyware to their device, the researchers say.

    They say that millions of users worldwide have been served ads by Discover-Tech since 2024, including in Yemen, Brazil, Mexico and Czechia.

    Related work by the research group Confiant also suggests that Discover-Tech’s ads have been shown to users of the networks of government entities in Europe and the US, as well as the UN, Nato, the international criminal court and the International Atomic Energy Agency.

    “It’s disastrous that major ad vendors and organisations apparently were neither able to detect nor prevent the company’s malicious advertising operations for years,” said Wolfie Christl, a researcher at Citizen Lab. “The way the online advertising ecosystem works today is a security threat for states, the private sector, civil society and everyone else alike.”