Greetings to all from a springtime Constantinople,Continue reading on Medium » (https://hcibo.medium.com/my-pentest-log-16-a-little-tip-ea55447443ae?source=rss------bug_bounty-5)
___________________________
@hacking_Attack
@Hacking_Video
___________________________
@hacking_Attack
@Hacking_Video
Medium
My Pentest Log -16- (XS Size A Little Tip)
Greetings to all from a springtime Constantinople,
Hacking Articles Tips Tricks Videos Tutorials
Photo
Black Hat Ethical Hacking
Lapsus$ Hackers Target T-Mobile
Lapsus$ Hackers Target T-MobilePost Views: 38
Premium Content
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
T-Mobile confirmed that the extortion group Lapsus$ gains access to their system “several weeks ago”.
The telecom giant responded to a report by a journalist Brian Krebs, who accessed the internal chats from the private Telegram channel of the core Lapsus$ gang members. The company added that it has mitigated the breach by terminating the hacker’s group access to its network and disabled the stolen credentials that were used in the breach.
Lapsus$ is a cybergang that came into prominence when it waged a ransomware attack against the Brazilian Ministry of Health in Feb 2021, compromising the data of COVID 19 vaccination data of millions. More recently, in March, the City of London Police arrested seven people suspected of being connected to the gang.
Private chats uncovered by Krebs revealed that the Lapsus$ hacking group get hold of the T-Mobile VPN credentials on illicit platforms like the Russian Market. Using these credentials Lapsus$ members can get access to the company’s internal tools like – Atlas an internal T-Mobile tool for managing customer accounts. It would help them to conduct a “Sim-Swapping” Attack – In this attack, the hacker hijacks the victim’s number by transferring it to the device owned by the attacker, this enables the hackers to obtain sensitive information such as phone number or any message sent for multi-factor authentication.
After gaining access to ATLAS, Lapsus$ hackers also attempted to compromise the T-Mobile accounts associated with the FBI and Department of Defense but were unsuccessful as an additional verification method was linked to those accounts.
“Several weeks ago, our monitoring tools detected a bad actor using stolen credentials to access internal systems that house operational tools software,” said a spokesperson from T-Mobile.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
T-Mobile said that despite the access attempts to the internal system ‘Atlas’ no sensitive information was leaked. “The systems accessed contained no customer or government information or other similarly sensitive information, and we have no evidence that the intruder was able to obtain anything of value,” T-Mobile added.
“Our systems and processes worked as designed, the intrusion was rapidly shut down and closed off, and the compromised credentials used were rendered obsolete.”
Recently Lapsus$ attack increased and they primarily target the source code of big technology companies like Microsoft, Samsung, Okta, and Nvidia.
The attacks carried out by Lapsus$ are not sophisticated, usually initiated by the stolen credentials from underground marketplaces, such as the Russian Market, and then an attempt to bypass the multi-factor authentication using social-engineering schemes.
“From a security pro who fought LAPSUS$: It forces us to shift thinking about insider access. Nation states want longer, strategic access; ransomware groups want lateral movement. LAPSUS$ asks: What can this account get me in the next 6 hours? We haven’t optimized to defend that.” said Brian Krebs in a tweet on Mar 24, 2022.
From a security pro who fought LAPSUS$: It forces us to shift thinking about insider access. Nation states want longer, strategic access; ransomware groups want lateral movement. LAPSUS$ asks: What can this account get me in the next 6 hours? We haven’t optimized to defend that.
— briankrebs (@briankrebs) Mar[...]
___________________________
@hacking_Attack
@Hacking_Video
Lapsus$ Hackers Target T-Mobile
Lapsus$ Hackers Target T-MobilePost Views: 38
Premium Content
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/patreon-300x61.png https://www.blackhatethicalhacking.com/wp-content/uploads/2022/04/Patreon-2.png Subscribe to Patreon to watch this episode.
Reading Time: 2 Minutes
T-Mobile confirmed that the extortion group Lapsus$ gains access to their system “several weeks ago”.
The telecom giant responded to a report by a journalist Brian Krebs, who accessed the internal chats from the private Telegram channel of the core Lapsus$ gang members. The company added that it has mitigated the breach by terminating the hacker’s group access to its network and disabled the stolen credentials that were used in the breach.
Lapsus$ is a cybergang that came into prominence when it waged a ransomware attack against the Brazilian Ministry of Health in Feb 2021, compromising the data of COVID 19 vaccination data of millions. More recently, in March, the City of London Police arrested seven people suspected of being connected to the gang.
Private chats uncovered by Krebs revealed that the Lapsus$ hacking group get hold of the T-Mobile VPN credentials on illicit platforms like the Russian Market. Using these credentials Lapsus$ members can get access to the company’s internal tools like – Atlas an internal T-Mobile tool for managing customer accounts. It would help them to conduct a “Sim-Swapping” Attack – In this attack, the hacker hijacks the victim’s number by transferring it to the device owned by the attacker, this enables the hackers to obtain sensitive information such as phone number or any message sent for multi-factor authentication.
After gaining access to ATLAS, Lapsus$ hackers also attempted to compromise the T-Mobile accounts associated with the FBI and Department of Defense but were unsuccessful as an additional verification method was linked to those accounts.
“Several weeks ago, our monitoring tools detected a bad actor using stolen credentials to access internal systems that house operational tools software,” said a spokesperson from T-Mobile.
See Also: Complete Offensive Security and Ethical Hacking Course
https://www.blackhatethicalhacking.com/wp-content/uploads/2022/03/Solutions-1.png
T-Mobile said that despite the access attempts to the internal system ‘Atlas’ no sensitive information was leaked. “The systems accessed contained no customer or government information or other similarly sensitive information, and we have no evidence that the intruder was able to obtain anything of value,” T-Mobile added.
“Our systems and processes worked as designed, the intrusion was rapidly shut down and closed off, and the compromised credentials used were rendered obsolete.”
Recently Lapsus$ attack increased and they primarily target the source code of big technology companies like Microsoft, Samsung, Okta, and Nvidia.
The attacks carried out by Lapsus$ are not sophisticated, usually initiated by the stolen credentials from underground marketplaces, such as the Russian Market, and then an attempt to bypass the multi-factor authentication using social-engineering schemes.
“From a security pro who fought LAPSUS$: It forces us to shift thinking about insider access. Nation states want longer, strategic access; ransomware groups want lateral movement. LAPSUS$ asks: What can this account get me in the next 6 hours? We haven’t optimized to defend that.” said Brian Krebs in a tweet on Mar 24, 2022.
From a security pro who fought LAPSUS$: It forces us to shift thinking about insider access. Nation states want longer, strategic access; ransomware groups want lateral movement. LAPSUS$ asks: What can this account get me in the next 6 hours? We haven’t optimized to defend that.
— briankrebs (@briankrebs) Mar[...]
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Lapsus$ Hackers Target T-Mobile | Black Hat Ethical Hacking
T-Mobile confirmed that the extortion group Lapsus$ gains access to their system “several weeks ago”.
Black Hat Ethical Hacking
Lapsus$ Hackers Target T-Mobile
___________________________
@hacking_Attack
@Hacking_Video
Lapsus$ Hackers Target T-Mobile
___________________________
@hacking_Attack
@Hacking_Video
Black Hat Ethical Hacking
Lapsus$ Hackers Target T-Mobile | Black Hat Ethical Hacking
T-Mobile confirmed that the extortion group Lapsus$ gains access to their system “several weeks ago”.
hacking: security in practice
Should I start with HacktheBox or TryHackMe?
Hello,
I've got some understanding of cybersecurity and concepts but next to no actual hands on. I'd like to run some of the modules from either of these websites while I am studying for my Sec+. Which one should I do first?
submitted by /u/jungle_dave
[link] [comments]
Should I start with HacktheBox or TryHackMe?
Hello,
I've got some understanding of cybersecurity and concepts but next to no actual hands on. I'd like to run some of the modules from either of these websites while I am studying for my Sec+. Which one should I do first?
submitted by /u/jungle_dave
[link] [comments]
reddit
Should I start with HacktheBox or TryHackMe?
Hello, I've got some understanding of cybersecurity and concepts but next to no actual hands on. I'd like to run some of the modules from either...
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
Quantum ransomware seen deployed in rapid network attacks. The threat actors are using the IcedID malware as one of their initial access vectors, which deploys Cobalt Strike for remote access and leads to data theft and encryption using Quantum Locker.
https://external-preview.redd.it/kxUPaf4zLZwpqfmNDzou8dwLWcpZvg99gPz_ET9paPU.jpg?width=640&crop=smart&auto=webp&s=3b286ebb2596c93e5c80e6d8c6d268d74d86fea9 submitted by /u/Late_Ice_9288
[link] [comments]
Quantum ransomware seen deployed in rapid network attacks. The threat actors are using the IcedID malware as one of their initial access vectors, which deploys Cobalt Strike for remote access and leads to data theft and encryption using Quantum Locker.
https://external-preview.redd.it/kxUPaf4zLZwpqfmNDzou8dwLWcpZvg99gPz_ET9paPU.jpg?width=640&crop=smart&auto=webp&s=3b286ebb2596c93e5c80e6d8c6d268d74d86fea9 submitted by /u/Late_Ice_9288
[link] [comments]
Hacking Articles Tips Tricks Videos Tutorials
Photo
Hacking on Medium
How can I secure my Linux Server to Prevent Hackers from compromising it?
https://cdn-images-1.medium.com/max/1280/1*_M1IVSp51h0KnafNrgeU4Q.png
Research indicates that every 39 seconds, Hackers are always trying to hack any computer connected to the internet. Servers are also a…
Continue reading on Medium »
How can I secure my Linux Server to Prevent Hackers from compromising it?
https://cdn-images-1.medium.com/max/1280/1*_M1IVSp51h0KnafNrgeU4Q.png
Research indicates that every 39 seconds, Hackers are always trying to hack any computer connected to the internet. Servers are also a…
Continue reading on Medium »
Bore - Simple CLI Tool For Making Tunnels To Localhost
http://www.kitploit.com/2022/04/bore-simple-cli-tool-for-making-tunnels.html
http://www.kitploit.com/2022/04/bore-simple-cli-tool-for-making-tunnels.html
A modern, simple TCP tunnel in Rust that exposes local ports to a remote server, bypassing (https://www.kitploit.com/search/label/Bypassing) standard NAT connection firewalls. That's all it does: no more, and no less.
# Installation (requires Rust)
cargo install bore-cli
# On your local machine
bore local 8000 --to bore.pub This will expose your local port at localhost:8000 to the public internet at bore.pub:, where the port number is assigned randomly. Similar to localtunnel (https://github.com/localtunnel/localtunnel) and ngrok (https://ngrok.io/), except bore is intended to be a highly efficient, unopinionated tool for forwarding TCP traffic (https://www.kitploit.com/search/label/Traffic) that is simple to install and easy to self-host, with no frills attached. (bore totals less than 400 lines of safe, async Rust code and is trivial to set up — just run a single binary (https://www.kitploit.com/search/label/Binary) for the client (https://www.kitploit.com/search/label/Client) and server.) Installation You can build the bore CLI command from source using Cargo (https://doc.rust-lang.org/cargo/), the Rust package manager. This command installs the bore binary at a user-accessible path. cargo install bore-cli We also publish versioned Docker images for each release. Each image is built for AMD 64-bit and Arm 64-bit architectures. They're tagged with the specific version and allow you to run the statically-linked bore binary from a minimal "scratch" container. docker run -it --init --rm --network host ekzhang/bore Detailed Usage This section describes detailed usage for the bore CLI command. Local Forwarding You can forward a port on your local machine by using the bore local command. This takes a positional argument, the local port to forward, as well as a mandatory --to option, which specifies the address of the remote server. bore local 5000 --to bore.pub You can optionally pass in a --port option to pick a specific port on the remote to expose, although the command will fail if this port is not available. Also, passing --local-host allows you to expose a different host on your local area network besides the loopback address localhost. The full options are shown below. ARGS: The local port to expose OPTIONS: -h, --help Print help information -l, --local-host The local host to expose [default: localhost] -p, --port Optional port on the remote server to select [default: 0] -s, --secret Optional secret for authentication [env: BORE_SECRET] -t, --to Address of the remote server to expose local ports to -V, --version Print version information">bore-local 0.3.0
Starts a local proxy to the remote server
USAGE:
bore local [OPTIONS] --to
ARGS:
The local port to expose
OPTIONS:
-h, --help Print help information
-l, --local-host The local host to expose [default: localhost]
-p, --port Optional port on the remote server to select [default: 0]
-s, --secret Optional secret for authentication [env: BORE_SECRET]
-t, --to Address of the remote server to expose local ports to
-V, --version Print version information Self-Hosting As mentioned in the startup instructions, there is a public instance of the bore server running at bore.pub. However, if you want to self-host bore on your own network, you can do so with the following command: bore server That's all it takes! After the server starts running at a given address, you can then update the bore local command with option --to to forward a local port to this remote server. The full options for the bore server command are shown below. Minimum TCP port number to accept [default: 1024] -s, --secret Optional secret for authentication [env: BORE_SECRET] -V, --version Print version information">bore-server 0.3.0
# Installation (requires Rust)
cargo install bore-cli
# On your local machine
bore local 8000 --to bore.pub This will expose your local port at localhost:8000 to the public internet at bore.pub:, where the port number is assigned randomly. Similar to localtunnel (https://github.com/localtunnel/localtunnel) and ngrok (https://ngrok.io/), except bore is intended to be a highly efficient, unopinionated tool for forwarding TCP traffic (https://www.kitploit.com/search/label/Traffic) that is simple to install and easy to self-host, with no frills attached. (bore totals less than 400 lines of safe, async Rust code and is trivial to set up — just run a single binary (https://www.kitploit.com/search/label/Binary) for the client (https://www.kitploit.com/search/label/Client) and server.) Installation You can build the bore CLI command from source using Cargo (https://doc.rust-lang.org/cargo/), the Rust package manager. This command installs the bore binary at a user-accessible path. cargo install bore-cli We also publish versioned Docker images for each release. Each image is built for AMD 64-bit and Arm 64-bit architectures. They're tagged with the specific version and allow you to run the statically-linked bore binary from a minimal "scratch" container. docker run -it --init --rm --network host ekzhang/bore Detailed Usage This section describes detailed usage for the bore CLI command. Local Forwarding You can forward a port on your local machine by using the bore local command. This takes a positional argument, the local port to forward, as well as a mandatory --to option, which specifies the address of the remote server. bore local 5000 --to bore.pub You can optionally pass in a --port option to pick a specific port on the remote to expose, although the command will fail if this port is not available. Also, passing --local-host allows you to expose a different host on your local area network besides the loopback address localhost. The full options are shown below. ARGS: The local port to expose OPTIONS: -h, --help Print help information -l, --local-host The local host to expose [default: localhost] -p, --port Optional port on the remote server to select [default: 0] -s, --secret Optional secret for authentication [env: BORE_SECRET] -t, --to Address of the remote server to expose local ports to -V, --version Print version information">bore-local 0.3.0
Starts a local proxy to the remote server
USAGE:
bore local [OPTIONS] --to
ARGS:
The local port to expose
OPTIONS:
-h, --help Print help information
-l, --local-host The local host to expose [default: localhost]
-p, --port Optional port on the remote server to select [default: 0]
-s, --secret Optional secret for authentication [env: BORE_SECRET]
-t, --to Address of the remote server to expose local ports to
-V, --version Print version information Self-Hosting As mentioned in the startup instructions, there is a public instance of the bore server running at bore.pub. However, if you want to self-host bore on your own network, you can do so with the following command: bore server That's all it takes! After the server starts running at a given address, you can then update the bore local command with option --to to forward a local port to this remote server. The full options for the bore server command are shown below. Minimum TCP port number to accept [default: 1024] -s, --secret Optional secret for authentication [env: BORE_SECRET] -V, --version Print version information">bore-server 0.3.0
Runs the remote proxy server
USAGE:
bore server [OPTIONS]
OPTIONS:
-h, --help Print help information
--min-port Minimum TCP port number to accept [default: 1024]
-s, --secret Optional secret for authentication [env: BORE_SECRET]
-V, --version Print version information Protocol There is an implicit control port at 7835, used for creating new connections on demand. At initialization, the client sends a "Hello" message to the server on the TCP control port, asking to proxy a selected remote port. The server then responds with an acknowledgement and begins listening for external TCP connections. Whenever the server obtains a connection on the remote port, it generates a secure UUID (https://en.wikipedia.org/wiki/Universally_unique_identifier) for that connection and sends it back to the client. The client then opens a separate TCP stream to the server and sends an "Accept" message containing the UUID on that stream. The server then proxies the two connections between each other. For correctness reasons and to avoid memory leaks, incoming connections are only stored by the server for up to 10 seconds before being discarded if the client does not accept them. Authentication On a custom deployment of bore server, you can optionally require a secret to prevent the server from being used by others. The protocol requires clients to verify possession of the secret on each TCP connection by answering random challenges in the form of HMAC codes. (This secret is only used for the initial handshake, and no further traffic is encrypted by default.) --to --secret my_secret_string"># on the server
bore server --secret my_secret_string
# on the client
bore local --to --secret my_secret_string If a secret is not present in the arguments, bore will also attempt to read from the BORE_SECRET environment variable. Acknowledgements Created by Eric Zhang (@ekzhang1 (https://twitter.com/ekzhang1)). Licensed under the MIT license (https://github.com/ekzhang/bore/blob/main/LICENSE). The author would like to thank the contributors and maintainers of the Tokio (https://tokio.rs/) project for making it possible to write ergonomic and efficient network services in Rust.
Download Bore (https://github.com/ekzhang/bore)
USAGE:
bore server [OPTIONS]
OPTIONS:
-h, --help Print help information
--min-port Minimum TCP port number to accept [default: 1024]
-s, --secret Optional secret for authentication [env: BORE_SECRET]
-V, --version Print version information Protocol There is an implicit control port at 7835, used for creating new connections on demand. At initialization, the client sends a "Hello" message to the server on the TCP control port, asking to proxy a selected remote port. The server then responds with an acknowledgement and begins listening for external TCP connections. Whenever the server obtains a connection on the remote port, it generates a secure UUID (https://en.wikipedia.org/wiki/Universally_unique_identifier) for that connection and sends it back to the client. The client then opens a separate TCP stream to the server and sends an "Accept" message containing the UUID on that stream. The server then proxies the two connections between each other. For correctness reasons and to avoid memory leaks, incoming connections are only stored by the server for up to 10 seconds before being discarded if the client does not accept them. Authentication On a custom deployment of bore server, you can optionally require a secret to prevent the server from being used by others. The protocol requires clients to verify possession of the secret on each TCP connection by answering random challenges in the form of HMAC codes. (This secret is only used for the initial handshake, and no further traffic is encrypted by default.) --to --secret my_secret_string"># on the server
bore server --secret my_secret_string
# on the client
bore local --to --secret my_secret_string If a secret is not present in the arguments, bore will also attempt to read from the BORE_SECRET environment variable. Acknowledgements Created by Eric Zhang (@ekzhang1 (https://twitter.com/ekzhang1)). Licensed under the MIT license (https://github.com/ekzhang/bore/blob/main/LICENSE). The author would like to thank the contributors and maintainers of the Tokio (https://tokio.rs/) project for making it possible to write ergonomic and efficient network services in Rust.
Download Bore (https://github.com/ekzhang/bore)
How could I fight back?
https://www.reddit.com/r/Pentesting/comments/ucbtyr/how_could_i_fight_back/
<!-- SC_OFF -->I've written an HTTPS web server in C++ from scratch. I've finally fixed all the bugs where incoming hostile connection could crash the server (and there are plenty of bots on the web). My code needs to be more 'robust' than pen-tester code in the sense that it needs to protect data all the time not just break in once. What deficiencies in pen-testing tools exist that I could try to counter-attack when someone connects to my server? Slow lorising, and sending undecryptable TLS records are what I am trying so far... <!-- SC_ON --> submitted by /u/XiPingTing (https://www.reddit.com/user/XiPingTing)
[link] (https://www.reddit.com/r/Pentesting/comments/ucbtyr/how_could_i_fight_back/) [comments] (https://www.reddit.com/r/Pentesting/comments/ucbtyr/how_could_i_fight_back/)
https://www.reddit.com/r/Pentesting/comments/ucbtyr/how_could_i_fight_back/
<!-- SC_OFF -->I've written an HTTPS web server in C++ from scratch. I've finally fixed all the bugs where incoming hostile connection could crash the server (and there are plenty of bots on the web). My code needs to be more 'robust' than pen-tester code in the sense that it needs to protect data all the time not just break in once. What deficiencies in pen-testing tools exist that I could try to counter-attack when someone connects to my server? Slow lorising, and sending undecryptable TLS records are what I am trying so far... <!-- SC_ON --> submitted by /u/XiPingTing (https://www.reddit.com/user/XiPingTing)
[link] (https://www.reddit.com/r/Pentesting/comments/ucbtyr/how_could_i_fight_back/) [comments] (https://www.reddit.com/r/Pentesting/comments/ucbtyr/how_could_i_fight_back/)
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
SecurityScorecard Launches Cyber Risk Quantification Portfolio
SecurityScorecard's Cyber Risk Quantification portfolio helps customers understand the financial impact of a cyber-attack.
SecurityScorecard Launches Cyber Risk Quantification Portfolio
SecurityScorecard's Cyber Risk Quantification portfolio helps customers understand the financial impact of a cyber-attack.
Hacking Articles Tips Tricks Videos Tutorials
Photo
Dark Reading: Attacks/Breaches
Introducing Apostro: A Risk Management Platform for Web3 Security
Apostro's system will monitor all transactions to identify malicious behavior that can cause damage to DeFi protocols.
Introducing Apostro: A Risk Management Platform for Web3 Security
Apostro's system will monitor all transactions to identify malicious behavior that can cause damage to DeFi protocols.
Hacking Articles Tips Tricks Videos Tutorials
Photo
hacking: security in practice
FBI Warns of Potential Ransomware Attacks on Food Plants from Groups of Known Hackers
https://external-preview.redd.it/exGGEbMyl5ZxLPNDZu1U1AnBM_M4vPdn3igfD6YbimQ.jpg?width=640&crop=smart&auto=webp&s=86b3d3ea7111efe7438dd1ecbdb9248a945023d7 submitted by /u/FuckIt4Verticals
[link] [comments]
FBI Warns of Potential Ransomware Attacks on Food Plants from Groups of Known Hackers
https://external-preview.redd.it/exGGEbMyl5ZxLPNDZu1U1AnBM_M4vPdn3igfD6YbimQ.jpg?width=640&crop=smart&auto=webp&s=86b3d3ea7111efe7438dd1ecbdb9248a945023d7 submitted by /u/FuckIt4Verticals
[link] [comments]