By Deeba Ahmed
MaliBot Android Malware is also capable of bypassing 2FA (Two-factor authentication). F5 Labs researchers have discovered a new…
This is a post from HackRead.com Read the original post: New MaliBot Android Malware Found Stealing Personal, Banking Data

****MaliBot Android Malware is also capable of bypassing 2FA (Two-factor authentication).****

F5 Labs researchers have discovered a new Android malware family that can exfiltrate personal and financial data after compromising devices. According to researchers, the malware can not only bypass multi-factor authentication processes, but can also steal banking data, passwords, and cryptocurrency wallets.

It is worth noting that the malware is distributed through fraudulent websites and tricks victims into downloading it, thinking it is a popular cryptocurrency tracking app. It is also distributed through smishing.

Furthermore, researchers have identified two malicious sites distributing MaliBot. One of them is a fake version of TheCryptoApp that boasts over a million downloads on the Google Play Store.

**Details of MaliBot**

F5 Labs has dubbed the Android malware MaliBot. This powerful malware disguised as a cryptocurrency mining application may pretend to be another app or a Chrome browser. It asks the user for accessibility and launcher permissions when downloaded to monitor the device and carry out its malicious operations.

MaliBot uses a Virtual Network Computing (VNC) server implementation to gain control of the infected devices. Once it infects a device, it starts exfiltrating financial data and steals PII (personally identifiable information) and cryptocurrency wallet information.

Research revealed that the malware’s C2 server is based in Russia and the servers are the same that were previously used for distributing the Sality malware. From June 2020, the IP was used to launch different malware campaigns.

**MaliBot Capabilities**

MaliBot has diverse capabilities, such as it supports web injections and can be used in overlay attacks. It can run and delete applications and steal sensitive data such as MFA codes, cookies, SMS messages, etc.

It can remotely steal passwords and access text messages, crypto wallet information, web browser cookies, bank details, and capture screenshots from compromised devices. It can also bypass MFA protection.

It mainly abuses the Android Accessibility API that lets it perform specific actions without asking for user permission or interaction and maintain persistence on the infected device. It also bypasses 2FA processes by validating Google prompts via the Accessibility API and steals 2FA codes, which are later transferred to the attacker.

When distributed via SMS messages, the malware can log exceptions and registers itself as a launcher. Bypassing protections around crypto wallets lets the attackers steal bitcoins and other cryptocurrencies from the victim’s wallet linked to the infected device.

Lastly, like FluBot, MaliBot can send SMS messages to other users to spread the infection chain. Currently, this campaign is targeting Spanish and Italian bank customers, but the scope of infection may soon broaden, F5 Labs researcher Dor Nizar noted.

**More Android Malware News**

*   Authorities Take Down SMS-based FluBot Android Spyware
*   Predator Spyware Using Zero-day to Target Android Devices
*   Ginp Android trojan targets banking apps & threaten 2FA/SMS
*   HiddenMiner Android Monero Mining Malware Cause Device Failure
*   New Android banking malware Xenomorph found in Play Store apps

New MaliBot Android Malware Found Stealing Personal, Banking Data

By Owais Sultan
What is VPS? VPS can be a great solution for the web presence of your business, blog, e-commerce,…
This is a post from HackRead.com Read the original post: How to configure cPanel and WHM Panel on your VPS

**What is VPS?**

VPS can be a great solution for the web presence of your business, blog, e-commerce, or any other project, especially when you are just going to start or not going to use too many resources, a VPS provides you with a pretty much solid ground, that is to say, security and stability, uptime and fault resistance combined with relatively lower costs.

The reason for this is the virtualization technology that allows dividing the capacities of one single physical server into separate virtual machines with dedicated resources – storage, memory, CPU – as well as their own virtual system and IP address. This way you get the virtual server whose operation is not bothered by its neighbors and at the same time you pay less because you pay just for a part of a physical capacity.

If you’ve made up your mind to opt for a VPS as your hosting solution, you also have to think, about which kind of VPS you need, since VPS are rather customizable and there are many parameters that your choice can affect and that eventually may affect the productivity of your project: the choice of location is determined by the location of your target audience; the technical requirement of your website determines the number of resources you are going to set; the operating system determines, which software you are going to use and so on.

Another important aspect is the way you are going to manage your web server. To simplify and automate this process, usually, a control panel is used. Among available control panel apps perhaps the most often chosen is cPanel. 

**What is cPanel**

cPanel is probably the most popular web hosting control panel. It has a rather broad range of features combined with a user-friendly graphical user interface. cPanel is responsible for managing the server regarding particular tasks, like monitoring resources, file management, mailing, and database management.

These tasks are performed via cPanel user accounts. What about the accounts, these are created and managed with the help of WHM (Web Host Manager), which is basically responsible for root access, that is administering the server on a deeper level.  
cPanel has a number of advantages which include:

*   **Compatibility**. With cPanel being such a popular control panel solution, many developers adapt their server software namely for cPanel. That’s why cPanel is compatible with various other programs that will help you manage your server.
*   **Graphical user interface (GUI).** cPanel is famous for its user-friendly graphical interface that will let you access the required settings fast and easily.
*   **Efficient server management.** cPanel will let you keep an eye on the various aspects of your server operation – files, mailing, DNS, databases, and server capacities so that you’ll always be able to provide your VPS’ brilliant performance. 

cPanel, like anything in this world, has a few drawbacks as well. 

*   It is still **not compatible** with some software solutions;
*   The **interface may seem counterproductive** for people who have a higher than average level of technical expertise and are more used to using the command line;
*   It is **not open-source** software, so it’s not as customizable as some people would like it to be;
*   It is **not free,** so you’ll have to consider whether you can afford it or not.

With all the above, cPanel is still one of the best control panels available for your server. That’s why we highly recommend checking Hostzealot hosting VPS cPanel. There you’ll be able to find the best VPS solution for your web presence, with a variety of locations to choose from, lightning-fast provisioning, and various web panels pre-installed.

In today’s article, we are going to have a look at the configuration process of these server management tools.

*   The first thing you need to do is to log on to your VPS server.
*   Then, you’ve got to install Perl. To do so, use the following command:  
    yum –y install perl 
*   After installing Perl, you will need to download WHM. Once the downloading is finished, use the following script to install WHM:  
    cd /home && curl -o latest -L https://securedownloads.cpanel.net/latest && sh latest
*   The next step is setting up WHM. First, access WHM by entering “https://your-server-ip:2087” into your browser’s address line. Don’t forget to type “https”!
*   Log in with your “root” username and the correspondent password.
*   On the next screen, you’ll see the license agreement. Read it through and accept its conditions. 
*   Enter your email address as well as other ways to contact you
*   Make sure to enter the DNS resolvers as well as the network device.
*   If you have purchased additional IP addresses, you can add them at this stage. If not, you can proceed.
*   Choose the configuration of your nameserver out of four possible variants. We recommend you choose BIND. Also, you can choose “disabled” if you aren’t going to use your local machine to run a DNS server.
*   Type the nameservers. They can look like this: “ns1.bobsdomain.com” and ns2.mydomain.com”. Make sure to add A entries for your hostname. 
*   Select the configuration for your FTP server. It’s best to choose PURE-FTPD.
*   Turn on cPHulk. Leave the settings standard. 
*    Select, whether you wish to use system quotas. We recommend to “use files system quotas”.
*   Finish setup wizard.
*   Select, which features you are going to need and “save settings”
*   Create a new cPanel account. Go to  “Home > Account Functions > Create a New Account.”
*   Use your domain, username, password, and email to log in. You don’t need to pay special attention to other items right now.
*   Go to your-server-ip:2083 and log in to your cPanel
*   Feel free to use your cPanel VPS!

**Conclusion**

cPanel and WHM are powerful tools to manage your virtual private server. We hope that this guide was clear and helpful and now you can use your cPanel to manage your VPS for whatever reason you’ve purchased it. Thank you for your attention and have a nice day!

**More VPS News**

*   6 ways to enhance your VPS hosting
*   What is VPS Hosting? How Does it Work?
*   VPS Hosting Vs. Dedicated Servers – Which Is Better?
*   How to Secure Your VPS and Dedicated Servers from Hackers
*   Managed vs. Unmanaged VPS hosting -What are the Differences?

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

How to configure cPanel and WHM Panel on your VPS

By Owais Sultan
Microsoft is a global leader in cloud storage and data protection. They prove that even the most respected…
This is a post from HackRead.com Read the original post: How Data Landlords Put Their Tenants at Risk

****Microsoft is a global leader in cloud storage and data protection. They prove that even the most respected cloud databases offer weak security.****

Today’s microservice architecture is highly dependent on the fluid and interconnected transference of data. SQL is a coding language perfect for storing data in relational databases, rapidly and securely supplying data when asked. It’s also a highly reliable coding language, capable of maintaining the integrity of databases over the globe.

Unfortunately, the constant pressure to iterate and produce has forced many developers to rely on third-party platforms; cloud providers have also started over-optimizing, cramming multiple customers together on one cloud instance. This has opened up brand new attack surfaces within cloud data protection, as unknown and untrusted companies must rely only on thin walls of protection.

**The Importance of PostgreSQL**

PostgreSQL is the world’s most advanced open-source library for SQL, with a specific focus on stability, high availability, and scalability. Developed over 30 years ago, the database has the goal of streamlining and cleaning community-developed code. This is then published and re-usable with or without a commercial license. 

This SQL code makes use of cloud-stored data; it only makes sense to store the code itself also on a cloud. This is where the Microsoft Azure platform is a godsend for many development firms; this platform is a (mostly) secure and managed database.

Cloud platform offerings are hassle-free foundations for applications and services. From this reliable foundation, app developers can rapidly design and create apps without the need to focus on nitty-gritty platform management_._ Microsoft offers the Azure Database for PostgreSQL service in three deployment variations: Single Server, Flexible Server, and Hyperscale. 

Cloud storage is beneficial in a number of major ways; scalability is an inherent strength of the cloud, as businesses will only need to pay enough for their own storage. Any storage will require a set amount of computational power; however, from a business perspective, flexibility flies in the face of reliability.

Microsoft fixes this with an ingenious method: given a set amount of server space, multiple clients can ‘inhabit’ this cloud, optimizing both customer demand and computation power.

**How Multi-Tenancy Architecture Works**

This multi-tenant layout sees different customers share system resources like storage, memory, and operating systems. Bundled together, these are all powered by a single set of physical hardware. 

Customer instances are separated by virtualization. The second layer of software encompasses the cloud environment, simulating hardware functionality to create a singular virtual computer system. There is one instance per client allowing for logical separation, and further helping to separate and track resource usage. 

**The PostgreSQL Attack**

In 2022, researchers discovered a critical vulnerability within the PostgreSQL Microsoft Azure platform.

When validating the authorization of a server and validating a connection, Azure’s source code checks the client’s certificate. It searches for a predefined common name. However, an oversight in the validation process meant that slipping in extra characters between the beginning and end of the fake certificate allowed access anyway.

The next step in the attacker’s to-do list is to establish which elements of a user’s database contain valuable info.

External to every client’s virtual environment, the clients all share a level 3 memory cache. Put simply, this mirrors the system memory across all client instances. An attacker could manipulate this cache to a known state. When a user logs on and uses the platform, the attacker can then look at the changes present in the cache, pinpoint it to a victim’s activity, and trace it back to where the user stores their sensitive data.

With a chain of attack suitably established, the final step is to find a victim.

The researchers have clarified that this attack only works against databases from the same region. However, finding the region of a pre-existing database is a relatively easy task; it’s evident from the IP address of its hosting server. Once this is known, it’s a relatively simple task to set up an account and start exploiting other users on the same cloud.

So, how can you protect yourself from malicious neighbors?

**Keeping Your Cloud Secure **

Whereas many coding libraries are publicly shared and open source, multi-million-dollar companies have no such obligation to publish their own code and architectures. Though this makes complete sense from a patent perspective, it comes at the detriment of your own security choices.

More researchers are beginning to ask cloud providers to give a better overview of their isolation architectures; always ask for relevant documentation before choosing a provider.

CVE provides a global documentation process for vulnerabilities and misconfigurations. When code is mishandled and exploited, it is given a CVE ID. This aids in researching, tracking, and ultimately preventing those vulnerabilities.

However, the issue with cloud providers is that software security flaws and misconfigurations do not receive CVE IDs. This makes it far more difficult to establish a cloud provider’s track record. There is good news on this front, however – a hard-working team of security professionals is creating a Github database of cloud security incidents. 

If you’re already in a multi-year contract with a cloud provider, then your options are slightly more limited. It’s important to remember that relying on the properties of a single program, or virtual machine is not sufficient; vulnerability in any component of service can compromise the security of the entire service. The bottom line is that – if data is exposed to the internet – then it is vulnerable.

Managing this risk is an important part of operating a secure company. 

Any critical data – that is, data that could do irreparable damage if stolen from your organization – should not be stored in any third-party cloud environment; multi-tenant or not. Instead of relying on an un-transparent third party’s architecture, critical data should be stored on an ultra-secure local server. This should have no direct access to the public internet.

For your uncritical data, cloud storage is a convenient and scalable solution, as long as you put further barriers between any attackers and your data. Encrypting your data once it’s in the cloud means that – even if an attacker does gain access – the data is functionally useless for them.

How Data Landlords Put Their Tenants at Risk

By Deeba Ahmed
The apps were loaded with info-stealing malware that can extract victims’ Facebook credentials and download other software, etc.…
This is a post from HackRead.com Read the original post: Play Store Apps Caught Spreading Android Malware to Millions

****The apps were loaded with info-stealing malware that can extract victims’ Facebook credentials and download other software, etc.****

According to researchers at Dr. Web, at least a dozen mobile apps on Google Play Store contain info-stealing malware, adware, and other types of malicious software. Most of the apps are Android\-based and collectively boast over 2 million downloads. Based on the app reviews, users aren’t too happy with these apps because of their shady functioning.

**Details of Malicious Apps**

Researchers noted that five infected apps were available for download on Play Store. These include:

1.  **Wild & Exotic Animal Wallpaper:** It contains adware that replaces its name with SIM Tool Kit soon after downloading. It has 500,000 downloads so far.
2.  **PIP Pic Camera Photo Editor**– This app appears as an image editor, but in reality, it steals the Facebook credentials of its users. This app has over 100,000 downloads.
3.  **ZodiHoroscope – Fortune Finder-** This is another malicious app designed to steal Facebook credentials. It has 500,000 downloads.
4.  **PIP Camera 2022**– This app showcases various camera effects but actually steals your Facebook profile information. Around 50,000 users have downloaded it.
5.  **Magnifier Flashlight:** This malicious app contains adware and has around 10,000 downloads.

According to Dr.Web’s report, researchers identified four additional malicious apps that aren’t available on the platform anymore. The apps included a racing game, an app offering deleted photos recovery, a state compensation app for Russians, and an app for free access to OnlyFans.

Though these apps are no longer available to the general public, the risk posed to users who have downloaded them already cannot be overlooked. The worrying aspect is that the malicious apps can steal data from other apps installed on your phone.

Malicious apps pointed out by Dr.Web

**Lesson**

When this article was published, all apps highlighted by Dr. Web were removed from Google Play Store. However, the lesson for smartphone users is that they must not download unnecessary apps from Official or third-party app stores.

Furthermore, always read reviews and feedback in the app’s review section. Although some reviews can be fake or published by developers to promote their app, primarily, the review section plays a vital role in keeping users secure by avoiding downloading malicious apps.

**More Android Malware News**

*   Play Store apps plagued with malware have 700,000 downloads
*   BRATA Android malware factory resets phones after stealing funds
*   New Android banking malware Xenomorph found in Play Store apps
*   Web3 Backdoor Wallets Stealing Seed Phrases from iOS/Android Users
*   New Russian Android Malware Tracks GPS Location and Spies on Victims

Play Store Apps Caught Spreading Android Malware to Millions

By Deeba Ahmed
The DDoS attack originated from 121 countries and was powered by a small botnet of only 5,067 hacked…
This is a post from HackRead.com Read the original post: Cloudflare Thwarted Largest Ever HTTPS DDoS Attack

****The DDoS attack originated from 121 countries and was powered by a small botnet of only 5,067 hacked IoT devices.****

Cloudflare has reported stopping a record-breaking HTTPS DDoS attack (distributed denial of service attack) this month. The company claims this attack peaked at 26 million requests per second (RPS), making it the largest ever HTTPS DDoS flood recorded.

It is worth noting that in April 2022, Cloudflare reported stopping a similar attack that peaked at 15.3 million rps. Evidently, the latest attack is significantly larger than the previous one. Cloudflare is an American DDoS mitigation, SSL certificate service, and content delivery network. 

**An Unusual Attack**

Cloudflare’s product manager, Omer Yoachimik, noted that the target was a customer using a Free plan. The previous largest DDoS attack reported by the company was also targeted against one of its customers.

The latest attack is far more unusual than the one it mitigated in April. That’s because of several factors, such as the size and the fact that attackers used junk HTTPS requests. 

Moreover, the attack came from Cloud Service Providers instead of Residential ISPs, and virtual servers and machines were hijacked to launch this attack rather than low-bandwidth, infected IoTs (internet of things) devices.

The company reaffirmed that all the customers using its Free and Pro plans are protected against DDoS and similar attacks regardless of the attack duration or size.

**Further Details**

Cloudflare explained that a relatively tiny but powerful botnet was used to carry out this DDoS attack. Surprisingly, the botnet comprised only 5,067 devices. The attack originated from 121 countries, and each node made 5,200 rps at its peak moment. 

Within 30 seconds, the botnet generated 212 million requests over 1,500 networks, which is more powerful than other botnets the company has tracked so far, some of which even comprised over 730,000 devices at an average of 1.3rps/device. 

Most requests came from Indonesia, Brazil, the USA, and Russia. Conversely, around 3% of this attack was carried through TOR connections. Since the attack involved HTTPS, it cost attackers more money to launch it, and the company bore a massive financial burden for mitigating it.

> “HTTPS DDoS attacks are more expensive in terms of required computational resources because of the higher cost of establishing a secure TLS encrypted connection. Therefore, it costs the attacker more to launch the attack, and for the victim to mitigate it. We’ve seen very large attacks in the past over (unencrypted) HTTP, but this attack stands out because of the resources it required at its scale.”
> 
> Cloudflare – Blog post 

**More DDoS Attack News**

*   Imperva mitigated a series of massive ransom DDoS attacks
*   DDoS Attacks by Hacktivists Disrupted Russian Alcohol Supply Chain
*   Growing Threat of Ransom DDoS Attacks Requires Effective Mitigation
*   Pro-Iran Group ALtahrea Hits Port of London Website by DDoS Attacks
*   Admin of DDoS-For-Hire Service “DownThem” Gets 2 Years Prison Sentence

Cloudflare Thwarted Largest Ever HTTPS DDoS Attack

By Deeba Ahmed
The misconfigured Elasticsearch database apparently belonged to the US-based software solution provider Transact Campus. SafetyDetectives’ cybersecurity research team…
This is a post from HackRead.com Read the original post: Elasticsearch Database Mess Up Exposed Login, PII Data of 30,000 Students

****The misconfigured Elasticsearch database apparently belonged to the US-based software solution provider Transact Campus.****

SafetyDetectives’ cybersecurity research team led by Anurag Sen identified a misconfigured Elasticsearch server that exposed the data of Transact Campus app. According to their analysis, the server was internet-connected and didn’t need a password to allow access to data.

Resultantly, around 1 million records were leaked, revealing personally identifiable information of over 30,000 to 40,000 students.

**About Transact Campus**

Transact Campus is an American payment software provider headquartered in Phoenix, Arizona. The company offers technological solutions for integrating versatile payment functions into a single mobile platform.

Its software solutions are mainly used to facilitate student purchases at higher education institutes and streamline payment processes for institutions and students.

**What was Exposed?**

SafetyDetectives wrote in the report that the 5GB worth of database leaked by the server contained details of students who are account holders at Transact Campus. Most of the impacted individuals are US nationals.

The exposed data included students’

*   Full names
*   Phone numbers
*   Email addresses
*   Credit card details
*   Transaction details
*   Login information (username and passwords), etc.

It is worth noting that the login data, including username and password, was stored in plain text format. On the other hand, the credit card details included the banking identification number, which comprises the first six and last four digits of the credit card number, bank information, and the card’s expiration date. Furthermore, the students’ purchased meal plans and meal plan balance were also part of the leaked data.

Plaintext log in details and PII data (Image credit: SafetyDetectives)

**Transact Campus’ Response**

SafetyDetectives informed Transact Campus about the exposed database in December 2021, and the company replied after over a month in January 2022. However, the details of the incident were only published last week.

During this time, researchers made several attempts to contact them and also contacted US-CERT, after which it was secured. Transact Campus claimed that the leaked server wasn’t under their control and that the data was fake.

> “Apparently this was set up by a third party for a demo and was never taken down. We did confirm that the dataset was filled with a fake data set and not using any production data.”
> 
> Transact Campus

However, SafetyDetectives claim that the server in question was continuously being updated even when it was discovered. They checked the data using publicly available tools and found that it belonged to real people.

Nevertheless, SafetyDetectives and Anurag Sen have a proven track record of identifying and reporting exposed databases and servers to affected parties. Some of their previous reports include the following:

1.  Cosmetic Giant Natura
2.  Calgary Parking Authority
3.  Uganda Security Exchange
4.  German Shopping Giant Windeln
5.  Australian Trading Giant ACY Securities
6.  Brazilian Marketplace Integrator Hariexpress

_The list goes on…_

**Possible Dangers**

Researchers couldn’t identify whether or not unauthorized third parties and malicious actors accessed the database before being secured. In case it was accessed, cybercriminals can target students in various attacks, from scams to phishing and spam marketing, or even carry out account takeover since login credentials were stored in unencrypted form on the server.

**More Misconfigured Servers News**

*   Misconfigured baby monitors exposing video stream online
*   Anonymous hacked 90% of Russian misconfigured databases
*   Misconfigured AWS bucket exposed 421GB of Artwork Archive data
*   350 million email addresses exposed on misconfigured AWS S3 bucket
*   Exposed ElasticSearch Servers Exposed 579GB of Users’ Website Activity

Elasticsearch Database Mess Up Exposed Login, PII Data of 30,000 Students

By Owais Sultan
What occurs to your mind when you hear of 3D printing? The latest advent in technology? Well, truth…
This is a post from HackRead.com Read the original post: How 3D Printing Has Become a Global Trend With Time

What occurs to your mind when you hear of 3D printing? The latest advent in technology? Well, truth be told, 3D printing shares a pristine history and became a force changer for many industries across the globe in the 1980s.

Now, the capabilities of 3D printing technology have diversified with time. Especially with the 3D printer equipment manufacturers devoting time to allocating and using various resources, every industry is making the most out of this benefit. 

Thus, with the portfolio of compatible materials, users demand and rightfully receive high-quality products and have greater choice in everything. It is important to note that the growth potential in 3D printing materials is different from printing equipment. After all, the legacy printers are still functional and continue to consume all kinds of materials.

Therefore, the 3D printing value chain has shown tremendous growth in the last few years. According to various experts, the net worth of 3D printing materials is all set to cross the $30 billion mark in the future. 

**Technology and Applications**

Today, seldom will you find an industry that is not making the most out of 3D printing. In reality, the 3D printing market offers broad materials for every industry globally. And the sales of 3D printers are growing since this tool has become a trendsetter across the globe.

The majority of which are still purchased by various companies and academic institutions. According to recent research, the sales of 3D printers skyrocketed last year, after companies and schools opened again. As of now, the sales of desktop 3D printers are at an all-time high and booming. 

The worldwide revenue from the additive manufacturing and 3D printing industry is already impressive. Yet, it has miles to go since 3D printing is steadily finding pace in every company across the globe. Every country has shown impressive growth in terms of 3D printing. For example, if we take China for discussion, it is fair enough to say that China stands for concrete as the world’s center of mass manufacturing.

Now, it has embraced the power of 3D printing and is making the most out of it. According to a new report, it has been revealed that China will soon take over the US in terms of 3D printer sales anytime soon.

The sheer size of the country’s population is an answer to many questions. China itself is a market for brands that want to reach a larger audience. Last year, around a 0.25million printers, were sold in the country. But this number is expected to grow and bloom with time. This number is expected to cross the 1 million mark by 2025. Just like China, the printing market everywhere across the globe has shown tremendous change in revenue. 

**How is 3D Printing Better?**

Long story cut short, 3D printing has tons of benefits to offer. First of all, you don’t have to invest a lot of resources. This eventually helps in saving finances and major expenses in the long run.

Secondly, since 3D printing helps make the environment greener, it reduces the carbon footprint. This is enough reason why millions of companies globally are investing in 3D printing. The most recent one is the logistics industry, wherein it is crucial. Even large-format companies such as Massivit 3D are making the most out of this technology to save a lot of money in the long run. 

The shift to digital printing raises questions, but this technology has stood the test of time and is better than the conventional methods. More than contributing to a greener environment, it is helping revolutionize modern manufacturing methods. Now that customized 3D printing has been introduced, it has become an instant rage. 

According to recent research, small desktop printers are in higher demand than large industrial ones. The slight revenue growth in the industry has been the result of the demand by academic institutions. Even the 3D printing companies are focusing on providing diverse services to the clients since the demand of every firm is different.

Although the pandemic halted the growth, yet when everything returned to normal, the 3D printing industry witnessed larger-than-life growth. Therefore, it is fair enough for 3D printing firms to claim a fair share in the industrial market where the competition is at an all-time high. 

**More 3D Printing Technology News**

*   3D Printing and Engineering; an Overview
*   Prognosis On The Future Of 3D Typography
*   Injured Girl Gets 1st-ever 3D Printed Titanium Skull Implant
*   Here’s a 3D Printed Remaking of ‘Ear of Hell’ Classic Audio Speakers
*   3D-printed fingerprints can unlock your device with an 80% success rate

Owais takes care of Hackread's social media from the very first day. At the same time He is pursuing for chartered accountancy and doing part time freelance writing.

How 3D Printing Has Become a Global Trend With Time

By Deeba Ahmed
A Chinese-speaking, technically skilled threat actor distributes backdoored applications to extract cash from victims in the newly discovered…
This is a post from HackRead.com Read the original post: Hackers Using Web3 Backdoor Wallets to Steal Seed Phrases from iOS/Android Users

Confiant security researchers have shared details of a large-scale operation launched by a technically advanced, sophisticated threat actor. The actor distributes backdoored applications through fake versions of authentic cryptocurrency wallet websites to drain funds. The activity cluster is dubbed SeaFlower, reportedly targeting iOs and Android users.

Confiant researchers noted that the trojanized cryptocurrency apps are identical to their real versions. However, they contain a backdoor that can steal a user’s security phase, allowing attackers to access their digital assets.

**Attack Method**

The SeaFlower operation leverages website cloning, SEO poisoning, and black SEO techniques to distribute trojanized apps to a broader range of users. Targeted applications include iOS and Android versions of MetaMask, Coinbase wallet, imToken, and TokenPocket.

These apps are distributed through Chinese search engines such as Sogou and Baidu. The search terms are rigged, so when someone searches for Download MetaMask iOS, the drive-by download pages appear on the top of the results first page.

Unsuspecting users stumble upon the suspicious sites, which serve as a conduit for luring victims into downloading trojanized versions of wallet apps. These apps have been modified to appear the same as the original versions but have additional code to extract and send the seed phrase to a remote domain.

The attackers may promote the backdoored apps on social media platforms and forums and use malvertising, but the leading distribution channel is search engines.

**SeaFlower Objective**

According to a blog post by Confiant’s Taha Karim, the main objective behind this campaign appears to be modifying Web3 wallets with backdoor code to exfiltrate the seed phrase. SeaFlower operators have also engineered the activity for targeting iOS users through provisioning profiles to enable apps for sideloading onto the devices.

For your information, provision profiles help tie devices and developers to an unauthenticated development team. This way, devices can be used for testing app code and adding malicious apps to devices.

**The Chinese Connection**

The analysis of the source code comments in the backdoored coding, the macOS usernames, and the involvement of Alibaba’s CDN (content delivery network) links this campaign with a yet-to-be-revealed Chinese-speaking organization.

Researchers claim they discovered the campaign in March 2022 and refer to SeaFlower as “the most technically sophisticated threat targeting Web3 users, right after the infamous Lazarus Group.”

**Why SeaFlower?**

Regarding why Confiant researchers dubbed the activity SeaFlower, they noted that one of the .dylib files injected in the trojanized MetaMask app’s Mach-O leaked a macOS username “Zhang Haike.” When they Googled the term, many Chinese language references appeared, one of which was a character in the Chinese novel “Tibetan Sea Flower.”

**Security Measures**

Chinese hackers are always considered dangerous and highly sophisticated. It could be because of unlimited resources backed by the government or they are just good at it. Nevertheless, strictly refrain from downloading apps and software from third-party markets.

> Always download mobile apps from official stores: Apple AppStore & Play Store. Never install or accept random provisioning profiles on your iPhone, as you saw in this blog post, they allow the download of unverified software that could potentially steal your crypto.
> 
> Taha Karim – Confiant

**More Chinese Hackers in News**

1.  Irani and Chinese State Hackers Exploiting Log4j Vulnerability
2.  Russian language hacking forums warming up to Chinese hackers
3.  Chinese APT group spying on Vietnam military with FoundCore RAT
4.  Microsoft disrupts the activity of Chinese hackers by seizing 42 websites
5.  Unofficial Micropatch for Follina Released as Chinese Hackers Exploit 0-day

Hackers Using Web3 Backdoor Wallets to Steal Seed Phrases from iOS/Android Users

By Waqas
Matthew Gatrel was arrested after an extensive crackdown by the FBI and other agencies against 15 booter service…
This is a post from HackRead.com Read the original post: Admin of DDoS-For-Hire Service “Downthem” Gets 2 Years Prison Sentence

****Matthew Gatrel was arrested after an extensive crackdown by the FBI and other agencies against 15 booter service domains in 2018.****

A 33-year-old St. Charles, Illinois resident, identified as Matthew Gatrel, is sentenced to two years in prison after being convicted last year for facilitating the DDoS-for-hire service. According to the US Department of Justice, Gatrel helped customers launch powerful DDoS attacks against thousands of websites and innocent users.

The accused was found guilty of violating the Computer Fraud and Abuse Act (CFAA) for operating two DDoS-for-hire services through downthemorg and ampnodecom. Through these websites, the accused facilitated people to launch over 200,000 attacks in exchange for money.

Site seized

**Case Details**

Initially, Gatrel admitted to operating these “booter” services and even provided “incriminating evidence” to the authorities. However, he opted to take the case to trial and used public defenders to defend the case.

Before the trial started, his business partner and co-accused, Juan Severon Martinez had already pleaded guilty. Prosecutors alleged that the accused sold subscriptions through Downthem and AmpNode helped provide bulletproof server hosting service to customers, focusing more on spoofing servers pre-configured with DDoS attack scripts.

Dashboard of DownThem

Furthermore, the servers contained lists of vulnerable attack amplifiers used to launch repeated cyberattacks against targets. Prosecutors also claimed that Martinez and Gatrel continuously scanned the web for misconfigured devices and sold lists of their internet addresses to other Booter service providers.

The trial continued for nine days in the Central District of California. Eventually, the court found Gatrel guilty of all three counts, including conspiracy to commit wire fraud, conspiracy to commit unauthorized impairment of a protected computer, and unauthorized impairment of a protected computer.

**More DDoS and Cyber Crime News**

1.  Imperva mitigated a series of massive ransom DDoS attacks
2.  DDoS booter customers received warning letters from Dutch police
3.  Teen arrested for 8 DDoS attacks that disrupted school’s online classes
4.  Teen arrested for DDoS attack on ProtonMail & making fake bomb threats
5.  Hacker arrested for Jamming 911 Emergency Call System with DDoS Attack

**Previous Coverage**

In 2018, the FBI, Dutch Police, National Crime Agency of UK, tech giant Google, cybersecurity firm Flashpoint, and Cloudflare joined hands to launch an operation to take down fifteen popular DDoS-for-hire websites.

These sites were used to launch DDoS attacks against private individuals and businesses such as email service providers, gaming services, and hosting sites.

Resultantly, all the websites were seized and shut down. Criminal charges were filed against three facilitators of these services. One of the defendants operated two of the seized websites, AmpNode and Downthem.

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Admin of DDoS-For-Hire Service “Downthem” Gets 2 Years Prison Sentence

By Waqas
Apart from personal and financial records, the data also included plain-text login credentials including usernames and passwords of…
This is a post from HackRead.com Read the original post: Scoop: Uganda Security Exchange Caught Leaking 32GB of Sensitive Data

****Apart from personal and financial records, the data also included plain-text login credentials including usernames and passwords of customers and businesses using the Easy Portal of the Uganda Security Exchange.****

The Uganda Securities Exchange (USE) aka principal stock exchange in Uganda has been caught leaking highly sensitive financial and sensitive data of its customers and business entities across the globe.

This was revealed to Hackread.com by Anurag Sen, a prominent IT security researcher who has been known for identifying exposed servers and alerting relevant authorities before it’s too late. Anurag is the same researcher who discovered Australian trading giant ACY Securities to be exposing 60GB worth of data earlier this month.

**What Happened**

It all started with Anurag scanning for misconfigured databases on Shodan and noted a server exposing more than 32GB worth of data to public access. According to Anurag, the server belonged to the Uganda Security Exchange’s Easy Portal. For your information, Easy Portal is an online self-service portal that lets users and trading entities view stock performance, view statements, and monitor their account balance.

> “There are other ports running on the server which opened the link to the bank of Baroda – which is Indian based company operating in Uganda. Also, it is registered under the Uganda security exchange.”
> 
> Anurag told Hackread.com

**What Data was Leaked**

Upon further digging into the humongous dataset Anurag concluded that the exposed records were of sensitive nature. The worse part of the data leak is the fact that the server was left exposed without any security authentication.

This means anyone with a slight bit of knowledge about finding unsecured databases on Shodan and other such platforms would have complete access to USE’s data including the following:

*   Full Name
*   Usernames
*   Full Address
*   Date of Birth
*   Access tokens
*   Phone Number
*   Email Address
*   Plaintext passwords
*   ID number of Users
*   Bank details including ID, and account number
*   Details on Foreign citizens and companies including citizens based in Uganda

The screenshot below shows the type of data exposed by the USE:

Image provided to Hackread.com by the IT security researcher Anurag Sen

**No Response from Uganda CERT or USE**

Although exposing sensitive data of unsuspecting users and businesses to cybercriminals is itself a blunder, not responding to researchers and not caring about the mess up is simply irresponsible.

Anurag and Hackread.com contacted Uganda Securities Exchange, Uganda CERT (Computer emergency response team), and several other government institutions via Twitter, phone, and email however none of the authorities ever responded.

Amid this, the server remained exposed for days.

**Server Secured**

On June 12th, 2022, the 32GB worth of data was reduced to MBs. It could be that authorities wanted to keep the incident under wraps to avoid criticism from local media and entities affected by the breach. Nevertheless, at the time of publishing this article, the exposed server was secured and its IP addresses were no longer accessible to the public.

**Impact on the company and clients**

It is yet unclear whether a third party accessed the database with malicious intent such as ransomware gangs or threat actors. But in case it did, it would be devastating for the USE, its customers, and its clients including local and foreign businesses.

Furthermore, considering the extent and nature of exposed data, the incident could have far-reaching implications. Such as bad actors could download the data, sign in to Easy Portal, and carry out identity theft, phishing, or trading scams.

If you use Easy Portal, it is time to contact Uganda Securities Exchange and inquire about the incident.

**More Misconfigured Servers News**

1.  Misconfigured baby monitors exposing video stream online
2.  Anonymous hacked 90% of Russian misconfigured databases
3.  Misconfigured AWS bucket exposed 421GB of Artwork Archive data
4.  350 million email addresses exposed on misconfigured AWS S3 bucket
5.  Exposed ElasticSearch Servers Exposed 579GB of Users’ Website Activity

I am a UK-based cybersecurity journalist with a passion for covering the latest happenings in cyber security and tech world. I am also into gaming, reading and investigative journalism

Source

HackRead