Black Hat Ethical Hacking
Hobby Lobby Exposes Customer Data in Cloud Misconfiguration

https://www.blackhatethicalhacking.com/wp-content/uploads/2017/11/black-hat-locks-and-electronics.jpg Hobby Lobby Exposes Customer Data in Cloud MisconfigurationPost Views: 21
style="display:block"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="8337846400"
data-ad-format="auto"
data-full-width-responsive="true">
Reading Time: 1 Minute
Arts-and-crafts retailer Hobby Lobby has suffered a cloud-bucket misconfiguration, exposing a raft of customer information, according to a report.
An independent security researcher who goes by the handle “Boogeyman” uncovered the issue and reported it to Motherboard in an online chat, according to a Vice writeup.

The researcher said that customer names, partial payment-card details, phone numbers, and physical and email addresses were all caught up in the leak – along with source code for the company’s app, and employee names and email addresses.

Boogeyman offered screenshots verifying the exposure of the data, which totaled 138GB and impacted around 300,000 customers. It was housed in an Amazon Web Services (AWS) cloud database that was misconfigured to be publicly accessible. The issue is now resolved, but it’s unclear if any malicious actors tapped the information before the database was secure.
See Also: Adobe Fixes Critical ColdFusion Flaw in Emergency Update “We identified the access control involved and have taken steps to secure the system,” Hobby Lobby told Motherboard. Threatpost has reached out to Hobby Lobby to independently confirm the issue. Cloud Misconfigurations: A Cyberthreat Attack VectorCloud misconfigurations are a common threat vector for organizations of all sizes. For instance, an analysis last fall found that 6 percent of all Google Cloud buckets are misconfigured and left open to the public internet, for anyone to access their contents.

“The Hobby Lobby incident is the latest example of why we need to take public cloud threat vectors so seriously,” said Douglas Murray, CEO at Valtix, told Threatpost. “In 2020, spend in public cloud exceeded spend in on-prem data centers for the first time. The hackers are doing their own version of ‘lift and shift’ and are aggressively moving to where the market is going. Just as concerning is that for every Hobby Lobby like leak that we learn about, there is another that goes undetected.”

Hank Schless, senior manager of security solutions at Lookout, noted that such misconfigurations are easy to do.
See Also: Offensive Security Tool: Skipfish
“Misconfigured cloud resources are frequently the cause of data breaches like this one,” he told Threatpost. “Organizations that have transitioned to the cloud have massive infrastructure that spans thousands of host servers and other services. Amazon’s S3 service is the base data storage offering for AWS, which means it’s simple to set up and integrate S3 buckets into cloud infrastructure. Unfortunately, that simplicity they offer and the speed at which organizations scale these services up and down oftentimes means the configuration of these buckets is overlooked and the data inside is left exposed.”

He added to mitigate the risk of a breach, organizations need to be sure they secure every aspect of their infrastructure from the individual endpoint all the way up to the cloud service itself. See Also: Hacking Stories: Albert Gonzalez & the ‘Get Rich or Die Trying’ Crew who stole 130 million credit-card numbers“Advanced cloud access security broker (CASB) technology helps secure access to these resources,” he said. “Coupling CASB with a security posture management tool ensures secure access and configuration of cloud [...]

infrastructure. Cloud providers offer countless supporting services and integrations that help teams build a well-architected infrastructure. Leveraging these services should be done in tandem with security teams to ensure there aren’t any misconfigurations that leave data exposed or violate compliance policies.”
Source: https://threatpost.com (Click Link)style="display:block"
data-ad-client="ca-pub-6620833063853657"
data-ad-slot="8337846400"
data-ad-format="auto"
data-full-width-responsive="true"> Recent News* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/adobe_coldfusion-700x412-e1542041238507-90x90.jpg Adobe Fixes Critical ColdFusion Flaw in Emergency Update1 day ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Clubhouse-e1614022265127-90x90.jpg Bogus Android Clubhouse App Drops Credential-Swiping Malware2 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/apple-security-90x90.jpg Trojanized Xcode Project Slips MacOS Malware to Apple Developers5 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Cisco_Systems_Sign-90x90.jpg Cisco Plugs Security Hole in Small Business Routers6 days ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/JPG-Malicious-Two-90x90.jpg Magecart Attackers Save Stolen Credit-Card Data in JPG Files1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Google-Chrome-Browser-1-90x90.jpg Google Warns Mac, Windows Users of Chrome Zero-Day Flaw1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/internet-of-things-90x90.jpg Critical Security Hole Can Knock Smart Meters Offline1 week ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/Linux-kernel-vulnerability-90x90.png Linux Systems Under Attack By New RedXOR Malware2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/security-camera-90x90.jpg Breach Exposes Verkada Security Camera Footage at Tesla, Cloudflare2 weeks ago
* https://www.blackhatethicalhacking.com/wp-content/uploads/2021/03/ezgif.com-gif-maker-1-90x90.jpg Apple’s Device Location-Tracking System Could Expose User Identities2 weeks ago
The post Hobby Lobby Exposes Customer Data in Cloud Misconfiguration first appeared on Black Hat Ethical Hacking.

hacking: security in practice
Is Jim Browning Real?

I’ve been hooked to Jim Brownings Channel on youtube where he gets into scammers computers and save victims, take down scam centers and even see them on their cameras. Is this actually possible? Let me ask the real question: Is this Real?

submitted by /u/imtrecasso
[link] [comments]

hacking: security in practice
iCloud unlock

Does anyone know how to unlock an iCloud? Message me is you do please!

submitted by /u/Lilahgirl99
[link] [comments]

Bypass rate limit to enumeration users through Google Drive

Hi everyone, today I’m gonna took about vulnerability that I found it in Google. In fact, when I sent the report to Google, it wasn’t a…Continue reading on Medium »
Read more...

Kali Linux Tutorials
Invoke SocksProxy : Socks Proxy & Reverse Socks Server Using Powershell

Invoke SocksProxy is a tool that creates a local or “reverse” Socks proxy using powershell. The local proxy is a simple Socks 4/5 proxy. The reverse proxy creates a tcp tunnel by initiating outbond SSL connections that can go through the system’s proxy. The tunnel can then be used as a socks proxy on the […]

The post Invoke SocksProxy : Socks Proxy & Reverse Socks Server Using Powershell appeared first on Kali Linux Tutorials.

Hacking on Medium
不正利用を遮断する、STARLIONPAYの決済方法

https://cdn-images-1.medium.com/max/656/1*eD18R7VJV305rA1hQN5oag.png
浸透するスマホ決済

Continue reading on Medium »

Bypass rate limit to enumeration users through Google Drive
https://3bodymo.medium.com/bypass-rate-limit-to-enumeration-users-through-google-drive-ed64e07c879c?source=rss------bug_bounty-5

Hi everyone, today I’m gonna took about vulnerability that I found it in Google. In fact, when I sent the report to Google, it wasn’t a…Continue reading on Medium » (https://3bodymo.medium.com/bypass-rate-limit-to-enumeration-users-through-google-drive-ed64e07c879c?source=rss------bug_bounty-5)

Kraker - Distributed Password Brute-Force System That Focused On Easy Use
http://www.kitploit.com/2021/03/kraker-distributed-password-brute-force.html

Kraker is a distributed (https://www.kitploit.com/search/label/Distributed) password brute-force (https://www.kitploit.com/search/label/Brute-force) system that allows you to run and manage the hashcat on different servers and workstations, focused on easy of use. There were two main goals during the design and development: to create the most simple tool for distributed hash cracking (https://www.kitploit.com/search/label/Cracking) and make it fault-tolerant. Kraker consists of two main components - a server and an agent, which communicate through a REST API. You can read about their installation and configuration below. Kraker continues to be in development, so the new functionality, documentation, and updates will be released as they become available. If you have suggestions for improvement or want to participate in the development or find bugs - feel free to open issues, pull requests, or contact us: @_w34kp455 (https://twitter.com/w34kp455) and @_asSheShouldBe (https://twitter.com/asSheShouldBe).
Setup
Here you can find a manual on how to setup your own server, build an agent from the source and run it. You always can download a Release that is already built and run it.
Server
Server is written on Laravel and provides a web interface for creating brute force (https://www.kitploit.com/search/label/Brute%20Force) tasks and also serves for managing agents.
Setup
sudo apt update
curl -fsSL https://get.docker.com -o get-docker.sh
sh get-docker.sh
rm get-docker.sh
sudo curl -L "https://github.com/docker/compose/releases/download/1.25.3/docker-compose-$(uname -s)-$(uname -m)" -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
sudo systemctl enable docker

sudo docker-compose build app
sudo docker-compose up -d
sudo docker-compose exec app composer install
sudo docker-compose exec app php artisan key:generate
sudo docker-compose exec app php artisan migrate
sudo docker-compose exec app php artisan db:seed --class=HashtypeSeeder
sudo docker-compose exec app php artisan db:seed --class=UserSeeder

Navigate the server IP address and enter the next credentials: Login: admin Password: kraker
Agent
It is written in .NET Core 5 and works on any OS where this framework is available - Linux, Windows, MacOS (not tested yet). The agent is responsible for performing brute-force tasks that it receives from the server.
Setup
For the agent to work on the host, you need to install .NET Core 5, which can be downloaded from the following link: https://dotnet.microsoft.com/download/dotnet/5.0 Linux - https://docs.microsoft.com/ru-ru/dotnet/core/install/linux Windows -https://dotnet.microsoft.com/download/dotnet/thank-you/runtime-5.0.4-windows-x64-installer
Build from source
Install .NET Core 5 SDK. Linux example: wget https://packages.microsoft.com/config/debian/10/packages-microsoft-prod.deb -O packages-microsoft-prod.deb
sudo dpkg -i packages-microsoft-prod.deb
sudo apt-get update
sudo apt-get install -y apt-transport-https
sudo apt-get update
sudo apt-get install -y dotnet-sdk-5.0

To compile agent from source code, go to agent folder and run the next command: dotnet build --configuration Release. After that in Kracker.App/bin/Release/net5.0 folder you will get the built project. You need to download hashcat from the official page at https://hashcat.net/hashcat/, unpack it into the agent's folder. Modify appsettings.json in Kracker.App/bin/Release/net5.0 and put ServerURL and Hashcat.Path like: {
"HashCat":{
"Path": "/home/admin/Kraker/agent/Kracker.App/bin/Release/net5.0/hashcat/hashcat.bin", //hashcat path
"SilencePeriodBeforeKill": 5, //default - 60 minutes
"RepeatedStringsBeforeKill": 100, //defaut 1000 strings
"NeedForce": true,
"Options": "--quiet --status --status-timer=1 --machine-readable --logfile-disable --restore-disable --outfile-format=2"
},
"ServerUrl": "http://8.8.8.8/", //server url
"InventoryCheckPeriod": 600,
"HearbeatPeriod": 15
}

Create a folder wordlist and rule and put there your favorite wordlist (https://www.kitploit.com/search/label/Wordlist) and rules. Run Kraker.app.exe or use command dotnet run Kraker.app.dll You can copy-paste the agent folder from server to server for easy setup. Happy cracking!

Using release
In release you can find: pre-installed hashcat https://hashcat.net/hashcat/ rules from https://github.com/ttmyst/tmyst_rules Running agent from release: Install .NET Core 5 runtime. Modify appsettings.json in Kracker.App/bin/Release/net5.0 and put ServerURL and Hashcat.Path. Put your favorite wordlist and rules in wordlist and rule folders. You can find lots of wordlists on https://weakpass.com (https://weakpass.com/). Run Kraker.app.exe or use command dotnet Kraker.app.dll
Contacts
@_w34kp455 (https://twitter.com/w34kp455) @_asSheShouldBe (https://twitter.com/asSheShouldBe) https://weakpass.com (https://weakpass.com/)

Download Kraker (https://github.com/zzzteph/kraker)