NodeJS Module infected by it's Developer to Steal Bitcoins

NodeJS Library Event-Stream version 3.3.6 containing a new library, called Flatmap-Stream, as a dependency, which was specifically crafted and designed to target people using BitPay's open-source bitcoin wallet app, Copay, a company that incorporated event-stream into its app.


Interestingly Since the flatmap-stream module was encrypted, the malicious code remained undetected for more than 2 months until Ayrton Sparling (FallingSnow), a computer science student at California State University, flagged the issue Tuesday on GitHub.

As a preventive action open source project manager that hosted event-stream code library—removed the backdoor from NPM's listing .

BitPay also published an advisory saying Copay versions 5.0.2 through 5.1.0 were affected by the malicious code and that users with these versions installed should avoid running or opening the app until they install Copay version 5.2.0.

"Users should assume that private keys on affected wallets may have been compromised, so they should move funds to new wallets (v5.2.0) immediately," BitPay says in the advisory.

"Users should first update their affected wallets (5.0.2-5.1.0) and then send all funds from affected wallets to a brand new wallet on version 5.2.0, using the Send Max feature to initiate transactions of all funds."

Google Plus Shutting down: Bigger they are harder they fall

So Google finally decided to close down google plus which never been attracted wide audience and leaving open space for Facebook monopoly . Interestingly at the same time google has also revealed that in march 2018   google found an API vulnerability in google plus that potentially can be used by the google plus app developers to extract various information  including 

names, email addresses, dates of birth, gender, profile photographs, places lived, relationship status, and occupation from 500,000 Google Plus profiles

Nd decided not reveal this information in public 

Mutagen Astronomy: A new integer overflow vulnerability affect linux kernel

Mutagen Astronomy vulnerability tracked as CVE-2018-14634, is a type of a local privilege escalation issue Discoverd by Qualys —and exists in the Linux kernel's create_elf_tables() function that operates the memory tables.
IMPACT :
To successfully exploit this vulnerability, attackers need to have access to the targeted system and run their exploit that leads to a buffer overflow, thereby resulting in the execution of malicious code and achieving complete control of the affected system.

Affected Systems:

1. This security vulnerability can be exploited to escalate privileges to root via a SUID-root binary, but it only works on 64-bit systems.

2. Affects the kernel versions released between July 2007 and July 2017, impacting the Red Hat Enterprise Linux, CentOS, and Debian distributions.

Exploit:
Qualys researchers have also released both technical details and proof-of-concept (PoC) exploits (Exploit 1, Exploit 2) for the vulnerability to the public.

Zero Day Alert ! Microsoft Windows JET Database engine vulnerability

ZDI  Has released details for unpatched zero day vulnerability in the Microsoft Windows JET Database engine vulnerability which affects all windows versions

Root Cause:
The root cause of this issue resides in the Microsoft JET Database Engine. Microsoft patched two other issues in JET in the September Patch Tuesday updates. While the patched bugs are listed as buffer overflows, this additional bug is actually an out-of-bounds write, which can be triggered by opening a Jet data source via OLEDB.

How To Exploit:To trigger this vulnerability, a user would need to open a specially crafted file containing data stored in the JET database format. Various applications use this database format. An attacker using this would be able to execute code at the level of the current process.

POC:
Here is the link of github that contains the POC

How to protect:
1. Use updated security software restrict
2. Do not open files from untrusted source

Gone in 2 Seconds : Tesla Model S Hack

KU Leuven researchers found that Tesla uses a keyless entry system built by a manufacturer called Pektron, which uses a weak 40-bit cipher to encrypt those key fob codes.

The researchers made a 6-terabyte table of all possible keys for any combination of code pairs, and then used a Yard Stick One radio, a Proxmark radio, and a Raspberry Pi mini-computer, which cost about $600 total—not bad for a Tesla Model S though—to capture the required two codes.

With that table and those two codes, the team says it can calculate the correct cryptographic key to spoof any key fob in just 1.6 seconds. To understand more clearly, you can watch the proof of concept video demonstration which shows the hack in action.

The team reported the issue to Tesla last year, but the company addressed it in June 2018 by upgrading the weak encryption. Last month, the company also added an optional PIN as an additional defense.

Tesla Paid $10,000 Bounty to the Researchers

After the story broke, Tesla was criticised on Twitter for using a weak cipher, though a member of the KU Leuven team appreciated Tesla for quickly responding to their report and fixing the issue,, on the same time, accused other vehicle makers using keyless entry techhashtag

Google Fixes 40 Security bugs in new Chrome Updates for Windows, Mac, Linux, Android

A new version of Google Chrome is rolling out to Windows, Mac, Linux, and Android over the next few weeks, the company announced this week.

Chrome version 69.0.3497.81 is being promoted to the stable channel for Windows, Mac, and Linux. The update packs 40 security fixes, including patches for vulnerabilities an attacker could abuse to assume control over a target system, according to a US-CERT advisory on the update.

In addition to Google's security team, many of the bugs were detected using AddressSanitizer, MemorySanitizer, UndefinedBehaviorSanitizer, Control Flow Integrity, libFuzzer, or AFL.

Chrome for Android 69 (69.0.3497.76) has also been released and will be available on Google Play over the next few weeks, Google reports. The 10^thanniversary edition aims to improve mobile payment security with third-party payment apps, password generation on more websites, stability and performance improvements, and a cleaner modernized design.

Read more details here.

Time to change your password: Air Canada has locked down all 1.7 million accounts

Don't be surprised if If you are not able to login to air canada mobile app as Air canada has lock down al of its 1.7 million users in response of a breach detection which impacts it's 1% users which is around 20000 users.

  Air Canada said that detected unusual login behaviour with Air Canada’s mobile App between Aug. 22-24, 2018. We immediately took action to block these attempts and implemented additional protocols to protect against further unauthorized attempts.
Air Canada has confirmed a data breach that may have 1% users from 1.7 million mobile Mobile app users which is about 20000 users.
So what has been exposed and what not : any thing which is stored in your  profile could be accessed by the attackers
1. Credit card information: It is encrypted so even attacker access it they may not be able to use it
but as precaution keep an eye on your credit card bill for any unusual activity
2. Passport number :  yes
3. Aeropplan number : yes
4. Aeroplan Password : no
5. Personal information: like date of birth, gender ,NEXUS number etc that you have saved in your profile

What user can do now: 

1. Mobile app itself is secure so you can continue using it
2. Change your password
3. Be Aware of Phishing email that can lead to other problems always verify any password change
email and make sure its from the Air Canada
4. Keep an eye for any unusual activity on ur credit card & Aeroplan transaction
5. Change password from other site as well if same password has been used

S

SPONSORED

Tug of War: Researcher released POC for Windows Unpatched Zero Day

Researcher named SandboxEscaper Disclosed a zero-day vulnerability, without notifying Microsoft which is very rare now days. Its not clear what trigger this action from researcher as now a days MS is very friendly with researcher . This Disclosure leaving all Windows users vulnerable to the hackers until a security patch is release by the tech giant to address the issue..

The vulnerability is a privilege escalation issue which resides in the Windows' task scheduler program and occurred due to errors in the handling of Advanced Local Procedure Call (ALPC) systems.

Advanced local procedure call (ALPC) is an internal mechanism, available only to Windows operating system components, that facilitates high-speed and secure data transfer between one or more processes in the user mode.

Since Advanced Local Procedure Call (ALPC) interface is a local system, the impact of the vulnerability is limited with a CVSS score of 6.4 to 6.8, but the PoC exploit released by the researcher could potentially help malware authors to target Windows users.
Here is POC demo

NEwspaper

Father's Wish list for baby handling hack

Being a new father bring many challenges, though every dad wants their child to be happpy & play with innocent once but they also deal with many boring stuff .Apart from sleepless nights dad need to learn many new skill e.g. how change diaper, feed baby  understand what is meaning of baby cry .

being a programmer  and hacker we can automate and hack many boring stuffs at work  . So i am also lookin forward some hack around baby handling and here is my top wish list .

Diaper changer:  An automatic diaper changer robot that can change baby diaper in schedule interval . you dont want your baby to be made  neother want to have rashes. Some time baby dosn't cry even it's too wet .

Diaper Wet indicator: if robot is not fasible or too costly then a simple device that send a message to parents when diaper is wet enough to change.

Soother insertion: voice activated soother insertion device that automaticaly goes to into baby mouth whenenver they cry and use very gentlr push if baby take the soother in then great else message to parent so they can see if any thing else need to do calm baby.

Auto milk feeder: This will need a process to warm enough bottled milk and then send to baby mouth with same technique as soother inserter. in this device milk uantity need to be controlled.

Cry activated messanger service: Most baby monitors are dependent on wifi connection or master slave device with short rang . imagine you left your baby with a day care rpovider how do u monitor if care provider doing good job ? a device which will recognoze baby cry and send message if it don't stop in certain time so parents ca call back to check thee loved once wellbeing.

Oopss! HBO Itself Accidentally Leaked 'Game of Thrones' Season 7 Episode 6

Oopss! HBO Itself Accidentally Leaked 'Game of Thrones' Season 7 Episode 6

HBO Spain appeared to have accidentally broadcast the next episode—Episode 6—of Game of Thrones season 7 five days before its official premiere.

And as expected, the GoT episode 6 quickly began circulating online.



ere's what HBO has to say about the latest leak:

"We have learned that the upcoming episode of Game of Thrones was accidentally posted for a brief time on the HBO Nordic and HBO España platforms." 

"The error appears to have originated with a third-party vendor, and the episode was removed as soon as it was recognized. This is not connected to the recent cyber incident at HBO in the US."

Short footage and GIFs from the GOT S07E06 was started circulating on YouTube, Reddit, Instagram, Twitch and other streaming services.

The episode 6 of "Game of Thrones" will officially be premiered on Sunday at 9 p.m. on HBO.

3 New CIA-developed Hacking Tools For MacOS & Linux Exposed

3 New CIA-developed Hacking Tools For MacOS & Linux Exposed

Achilles — Tool to Backdoor Mac OS X Disk Images

Dubbed Achilles, the hacking tool allows CIA operators to combine malicious Trojan applications with a legitimate Mac OS app into a disk image installer (.DMG) file.

The binding tool, the shell script is written in Bash, gives the CIA operators "one or more desired operator specified executables" for a one-time execution.

As soon as an unsuspecting user downloads an infected disk image on his/her Apple computer, opens and installs the software, the malicious executables would also run in the background.

Afterwards, all the traces of the Achilles tool would be "removed securely" from the downloaded application so that the file would "exactly resemble" the original legitimate app, un-trojaned application, making it hard for the investigators and antivirus software to detect the initial infection vector.

Achilles v1.0, developed in 2011, was only tested on Mac OS X 10.6, which is Apple's Snow Leopard operating system that the company launched in 2009.

SeaPea — Stealthy Rootkit For Mac OS X Systems

The second hacking tool, called SeaPea, is a Mac OS X Rootkit that gives CIA operators stealth and tool launching capabilities by hiding important files, processes and socket connections from the users, allowing them to access Macs without victims knowledge.

Developed in 2011, the Mac OS X Rootkit works on computers running then-latest Mac OS X 10.6 (Snow Leopard) Operating System (32- or 64-bit Kernel Compatible) and Mac OS X 10.7 (Lion) Operating System.

The rootkit requires root access to be installed on a target Mac computer and cannot be removed unless the startup disk is reformatted or the infected Mac is upgraded to the next version of the operating system.

Aeris — An Automated Implant For Linux Systems

The third CIA hacking tool, dubbed Aeris, is an automated implant written in C programming language that is specifically designed to backdoor portable Linux-based Operating Systems, including Debian, CentOS, Red Hat — along with FreeBSD and Solaris.

Aeris is a builder that CIA operators can use to generate customised impacts, depending upon their covert operation.

"It supports automated file exfiltration, configurable beacon interval and jitter, stand-alone and Collide-based HTTPS LP support and SMTP protocol support — all with TLS encrypted communications with mutual authentication," 

"It's compatible with the NOD Cryptographic Specification and provides structured command and control that's similar to that used by several Windows implants."

Adobe is Finally Killing FLASH — At the End of 2020!

Adobe is Finally Killing FLASH — At the End of 2020!



Adobe announced Tuesday that the company would stop providing updates and stop distributing Flash Player at the end of 2020.

The move has been applauded by many, as Adobe Flash has been infamous for frequent zero-day attacks, which is why it has long been one of the favourite tools for hackers and cyber criminals.



To put a full stop on Flash, many major tech companies like Apple, Facebook, Youtube, Google Chrome, Firefox had been magnetised towards the new substitutor - HTML 5.

• Microsoft just announced its plans to disable Flash Player by default in Edge and Internet Explorer in 2019, with a full removal from all supported versions of Windows by 2020.
• Google will continue phasing out Flash over the next few years by blocking auto-playing of Flash ads by default on its browser.
• In January last year, YouTube moved away from Flash for delivering videos.
• Mozilla also blocked the Flash plugin entirely from Firefox and will allow Firefox Extended Support Release (ESR) users to keep using Flash until the end of 2020.
• Apple's Safari currently requires explicit permission on each website even when Mac users opt to install Flash.

Critical Code Injection Flaw In Gnome File Manager Leaves Linux Users Open to Hacking

Critical Code Injection Flaw In Gnome File Manager Leaves Linux Users Open to Hacking





Dubbed Bad Taste, the vulnerability (CVE-2017-11421) code injection vulnerability resides in "gnome-exe-thumbnailer" — a tool to generate thumbnails from Windows executable files (.exe/.msi/.dll/.lnk) for GNOME, which requires users to have Wine application installed on their systems to open it.

Moskopp discovered that while navigating to a directory containing the .msi file, GNOME Files takes the filename as an executable input and run it in order to create an image thumbnail.

For successful exploitation of the vulnerability, an attacker can send a crafted Windows installer (MSI) file with malicious VBScript code in its filename, which if downloaded on a vulnerable system would compromise the machine without further user interaction.

"Instead of parsing an MSI file to get its version number, this code creates a script containing the filename for which a thumbnail should be shown and executes that using Wine," Moskopp explains while demonstrating his PoC. 

"The script is constructed using a template, which makes it possible to embed VBScript in a filename and trigger its execution."

Moskopp advised users to:

• Delete all files in /usr/share/thumbnailers.
• Do not use GNOME Files.
• Uninstall any software that facilitates automatically execution of filenames as code.

Critical RCE Vulnerability Found in Cisco WebEx Extensions, Again — Patch Now!

Critical RCE Vulnerability Found in Cisco WebEx Extensions, Again — Patch Now!

Discovered by Tavis Ormandy of Google Project Zero and Cris Neckar of Divergent Security, the remote code execution flaw (CVE-2017-6753) is due to a designing defect in the WebEx browser extension.

To exploit the vulnerability, all an attacker need to do is trick victims into visiting a web page containing specially crafted malicious code through the browser with affected extension installed.

Successful exploitation of this vulnerability could result in the attacker executing arbitrary code with the privileges of the affected browser and gaining control of the affected system.

Chrom & Firefox were affected.

Wikileaks Reveals CIA Malware that Hacks & Spy On Linux Computers

Wikileaks Reveals CIA Malware that Hacks & Spy On Linux Computers



The OutlawCountry Linux hacking tool consists of a kernel module, which the CIA hackers load via shell access to the targeted system and create a hidden Netfilter table with an obscure name on a target Linux user.

"The new table allows certain rules to be created using the "iptables" command. These rules take precedence over existing rules, and are only visible to an administrator if the table name is known. When the Operator removes the kernel module, the new table is also removed," CIA's leaked user manual reads.

Petya Ransomware Spreading Rapidly Worldwide, Just Like WannaCry

Petya Ransomware Spreading Rapidly Worldwide, Just Like WannaCry

According to multiple sources, a new variant of Petya ransomware, also known as Petwrap, is spreading rapidly with the help of same Windows SMBv1 vulnerability that the WannaCry ransomware abused to infect 300,000 systems and servers worldwide in just 72 hours.

Petya reboots victims computers and encrypts the hard drive's master file table (MFT) and rendering the master boot record (MBR) inoperable, restricting access to the full system by seizing information about file names, sizes, and location on the physical disk.

Petya replaces the computer's MBR with its own malicious code that displays the ransom note and leaves computers unable to boot.

Oops: Microsoft's "Super-secure" Windows 10 S Hacked In 3 Hours

Oops: Microsoft's "Super-secure" Windows 10 S Hacked In 3 Hours



With the launch of Windows 10 S, Microsoft claimed that it’s an extra-secure operating system that’s protected against all kinds of ransomware. To test the claims, folks at ZDNet hired a security firm. As a result, the hackers were able to breach Windows 10 S within 3 hours by using Microsoft Word’s handling of macros.

Create macro based word file

put it on windows share

Access it from victims computer 

MS10 S pawnd 

32TB of Windows 10 internal builds, core source code leak online

32TB of Windows 10 internal builds, core source code leak online

The data – some 32TB of official and non-public installation images and software blueprints that compress down to 8TB – were uploaded to betaarchive.com, the latest load of files provided just earlier this week. It is believed the confidential data in this dump was exfiltrated from Microsoft's in-house systems around March this year.

The leaked code is Microsoft's Shared Source Kit: according to people who have seen its contents, it includes the source to the base Windows 10 hardware drivers plus Redmond's PnP code, its USB and Wi-Fi stacks, its storage drivers, and ARM-specific OneCore kernel code.

Anyone who has this information can scour it for security vulnerabilities, which could be exploited to hack Windows systems worldwide. The code runs at the heart of the operating system, at some of its most trusted levels.

I would suggest people to move on from windows 10 to other Operating system before it's too late

Brutal Kangaroo: CIA-developed Malware for Hacking Air-Gapped Networks Covertly

Brutal Kangaroo: CIA-developed Malware for Hacking Air-Gapped Networks Covertly



It has been created for Microsoft Windows that targets "closed networks by air gap jumping using thumb drives," mainly implemented in enterprises and critical infrastructures.



The newer version was using "unknown link file vulnerability (Lachesis/RiverJack) related to the library-ms functionality of the operating system."