New “GnatSpy” Mobile Malware Stealing data Such as Images, Text messages, Contacts, and Call History

A newly emerging mobile malware GnatSpy capable of abusing infected mobile and stealing various type of data such Images, Text messages, Contacts, and Call History.
GnatSpy is a new variant of VAMP which is dangerous Google Android malware family that mainly targeting mobiles to stealing sensitive data.

Many of old VAMP command and control server has been reused by the GnatSpy malware and it openly indicates that these attackers are connected.
This malware family detected as ANDROIDOS_GNATSPY. since distribution actor has not cleared identified, though researchers believe that threat actors sent them directly to users to download and install on their devices.
GnatSpy mobile malware mimics as “Android Setting” or “Facebook Update” to make users believe they were legitimate.

VAMP is an earlier version of this GnatSpy and its behavior altered by Gnatspy mobile malware and adding some sophisticated future later it spreading across to specific targeted groups or individuals.

GnatSpy Mobile Malware Improved capabilities and Working Function

some of the futures are very similar to VAMP variant but it newly evolved with some sophisticated threat actor and behavior.
GnatSpy’s app structure has completely improved and More receivers and services have been added by this malware author and researchers believe that malware author is sound knowledge of software design practices.


  
Old and new receivers and services
To perform an evasion technique to avoid detection, this malware using Java annotations and reflection methods.
Earlier versions of VAMP contained the C&C server used in a simple plain text, making detection by static analysis tools easier..but new variant using hardcoded in the malicious app’s code.

                                                         Hardcoded C&C Server

Here, hardcoded URL  malware is not the final C&C server but it again sends back to the original location of the actual C&C server.

Request and response pair for C&C server

In this case, many of GnatSpy used servers are a newly registered server. and registered person names appear to have been directly taken from various television shows.

An earlier version of this malware makes System Manager on Huawei devices to grant permissions to itself and similarly, Xiaomi devices also granted permission.
But the new version has spread with highly sophisticated techniques and it targets including several function calls targeting newer Android versions (Marshmallow and Nougat).

Code for Marshmallow and Nougat Android versions

“More information about the device is stolen as well, including information about the battery, memory and storage usage, and SIM card status. Curiously, while previous samples collected information about the user’s location via OpenCellID, this is no longer done by GnatSpy.” Trend Micro said.

“Ransomware as a Service” Provide SATAN Ransomware in Dark web to Make Money

 

Security researcher Xylitol Discovered a new Ransomware as a Service, or RaaS, called Satan.This administration permits any wannabe criminal to enroll a record and make their own one of a kind tweaked variant of the Satan Ransomware.
Once the ransomware is made, it is then up to the criminal to decide how they will disperse the ransomware, while the RaaS will handle the payoff installments and including new components.
Dark web Link :” http://satan6dll23napb5.onion “

For this administration, the RaaS designer takes a 30% cut of any installments that are made by casualties. As indicated by the ad for the Satan RaaS, the designer will diminish their cut contingent upon the volume of installments got by a partner.
It’s all very business as usual, apparently, with the Satan RaaS system going as far as to offer record-keeping functionality like fee payment records and transaction tracking.
Satan RaaS customers even have access to customer-relationship management (CRM) features like the ability to attach notes to victim records, and technical support in the way training and instructions.

Satan RaaS customers agree to pay its developers up to 30 percent of the “revenues” generated from ransom payments. According to the Satan sign-up page, “Now, the most important part: the bitcoin paid by the victim will be credited to your account. We will keep a 30 percent fee of the income,
so, if you specified a 1 BTC ransom, you will get 0.7 BTC and we will get 0.3 BTC. The fee will become lower depending on the number of infections and payments you have.”

The Satan RaaS

When a person first goes to the Satan RaaS they will be greeted with a home page that describes what the service is and how a criminal can make money with it.
Once a user registers an account and logs in, they will be greeted with an affiliate console that contains various pages that they can use to help distribute their ransomware.

These pages are the Malwares, Droppers, Translate, Account, Notices, and Messages pages.
The first page that is shown when someone logs in is the Malwares page, which allows a criminal to configure various settings of their very customized version of the Satan Ransomware. In terms of customization, there is not really many options.
A user can specify the ransom amount, how much it goes up after a certain amount of the days, and the amount of days that the ransom payment should increase.
The Satan platform contains a number of other features including fee payment records, transaction tracking, Satan version releases, and dropper creation.
Users can also create “notes” related to their victims, learn about how to set up gateway proxies, and are given instructions on how to test their malware on a physical machine.
Lastly, Satan’s creators warn users not to upload their malware to VirusTotal or other online scanners — as doing so will give white-hat researchers the code sample required to update and protect Windows machines from the threat.

 

320,000 Financial Records Apparently Stolen From Payment Processor,leaked online

More than 320,000 financial records have been leaked, and while the information appears to have been stolen either from payment processor BlueSnap or its customer Regpack, neither of them admit suffering a data breach.
BlueSnap is a payment payment which allows websites to take payments from customers by offering merchant facilities, whereas RegPack is a global online enrollment platform that uses BlueSnap to process the financial transactions for its online enrollments.

Australian security expert Troy Hunt, the owner of the Have I Been Pwned breach notification service, has analyzed the data and, after reaching out to some of the impacted individuals, he determined that the leaked records are most likely genuine. The compromised information includes names, physical addresses, email addresses, IP addresses, phone numbers, invoices containing purchase details, the last four digits of credit card numbers, and even CVV codes.


As Hunt has highlighted, despite the fact that full card data has not been leaked, the compromised information is still highly valuable for cybercriminals, particularly the CVVs, which can be used to conduct card-not-present transactions, and the last four digits of credit cards, which is considered identity verification data and which can be very useful for social engineering attacks.
Although the payment data does not contain full credit card numbers, as Hunt stressed, cyber criminals can still misuse the compromised information, particularly the CVV codes that are highly valuable payment data, which can be used to conduct “card not present” transactions.

Also, the last four digit of any user’s credit card number can also be used for identity verification that’s very useful in conducting social engineering attacks.
Hunt contacted BlueSnap as well as Regpack, but they both denied suffering a data breach. He has also loaded as many as 105,000 email addresses into Have I Been Pwned, so you can search for your address on the site to check whether you are impacted by the breach.

200 Million Downloaded video players including VLC Player are vulnerable to Malicious subtitles Attack -A Complete Takeover Attack

 

A new Cyber Attack Spreading through Vulnerable Subtitles which Downloaded by  Victims Media Player and threatens more than 200 Millions of vulnerable Machine in worldwide which leads to  complete take over to the infected machine .
This cyber attack is delivered when movie subtitles are loaded by the user’s media player which is  delivering by tricks victims.

Attackers  used two Major Attack Vectors to spreading crafting malicious subtitle files into Victims Media Player.

1. Attackers Forced victims to Visit Malicious Website to Download Subtitles
2. Tricks victims   into running a malicious file on his computer.

Vulnerable  Media Players are wildly used Media players including VLC, Kodi, Popcorn Time and Stremio.
Currently this Malicious subtitles repositories are Treated as Trusted Source by the Vulnerable Media Players.


According  to Checkpoint Researchers, This method requires little or no deliberate action on the part of the user, making it all the more dangerous.
Also Researchers Said,Unlike traditional attack vectors, which security firms and users are widely aware of, movie subtitles are perceived as nothing more than benign text files. This means users, Anti-Virus software, and other security solutions vet them without trying to assess their real nature, leaving millions of users exposed to this risk.

 Attack Vector used for Spreading

Many websites are serving Subtitles to Download and import into Media Players which is the potential Attack method to easily spread this Malicious Subtitles links.
Checkpoint Researchers  Revealed ,manipulating the website’s ranking algorithm, we could guarantee crafted malicious subtitles would be those automatically downloaded by the media player, allowing a hacker to take complete control over the entire subtitle supply chain, without resorting to a Man in the Middle attack or requiring user interaction.

 

Infect into IOT Devices

This Critical subtitles Attack may perform into PC, a smart TV, devices which infected by this Malicious Subtitles .

infected Media Players VLC has over 170 million downloads of its latest version alone, which was released June 5, 2016. Kodi (XBMC) has reached over 10 million unique users per day, and nearly 40 million unique users each month.
This Attack will leads to stealing sensitive information, installing ransomware, mass Denial of Service attacks, and much more. Checkpoint said.

Proof Of Concepts Video:

Here Checkpoint Submitted a Proof of Concepts for Complete take over  of the the Victims  Machine by the attacker via the infected media Players.
Once Malicious Subtitles loaded into the Victims Media Player ,then it will execute the Remote code and take over the entire Victims Machine.

How to make your own hacking lab

We all have some passion about hacking. First thing, we need to make our stuffs for hacking.

Thats mean, we need our own hacking lab...

For make a best haching lab, we need below things

• Computer
• High speed data package
• Backtrack or Linux
• Vmware player
• Wireless network card

With above items, we can make a superb hacking lab. As a guidenece, you can watch below video

Best hackers in the world

The most wanted hackers in the world

In the world of web where we get the global connectivity, it is far easier to break into someone’s personal zone. By personal, we do not just mean the social media. The world wide web which has become the hub of storing and restoring information, considered to be the safest vault, is a mere toy in the hands of a few computer geniuses. Hackers, Black Hat Hackers, villains, crackers, cyber-criminals, cyber pirates as they are well-known, throw a malicious software or virus at a system to gain the access to the desired information. Piqued by curiosity, they may perhaps break into your system too. Here are top 10 hackers or the whiz kids who put the world in awe with their dexterity.

1. Gary McKinnon

Gary McKinnon must’ve been a curious, restless child, for to gain information on UFOs, he thought it better to get a direct access into the channels of NASA. He infiltrated 97 US military and NASA computers, by installing virus and deleting a few files. All the efforts to satisfy his curiosity, but, alas, curiosity killed the cat. It was soon found that McKinnon was guilty of having hacked the military and NASA websites from his girlfriend’s aunt’s house in London. While entering and deleting the files from these websites wasn’t enough, McKinnon thought of shaming the security forces by putting out a notice on the website that said, “Your security is crap.” Well, looks like McKinnon was something, if he could shut down the US Military’s Washington Network of about 2000 computers for 24 hours, making the hack, the biggest military computer hack of all time!

2. LulzSec

LulzSec or Lulz Security, a high profile, Black Hat hacker group, gained credentials for hacking into Sony, News International, CIA, FBI, Scotland Yard, and several noteworthy accounts. So notorious was the group that when it hacked into News Corporations account, they put across a false report of Rupert Murdoch having passed away. While the group claims to have retired from their vile duties, the motto of the group, “Laughing at your security since 2011!” stays alive. There are assertions of the group having hacked into the websites of the newspapers like The Times and The Sun to post its retirement news. Many, however, claim that this group had taken it upon itself to create awareness about the absence of efficient security against hackers.

3. Adrian Lamo

Adrian Lamo decided to switch careers when he realized the potentials of his skills. He became a news when he hacked into Yahoo!, Microsoft, Google, and The New York Times. This, although culminated into his arrest, it later helped him gain the batch of an American Threat Analyst. A guy who would hack into top-notch accounts sitting in the spacious and comforting cafeterias, libraries, internet cafes, soon turned Wikileaks suspect Bradley Manning over to FBI. While Manning was arrested for leaking several hundred sensitive US government documents, Lamo went hiding or should we presume, undercover?

4. Mathew Bevan and Richard Pryce

Targeting the over-sensitive nerves, what Mathew Bevan along with his alleged partner Richard Pryce did, could have triggered great many issues between USA and North Korea. The duo hacked the US military computers and used it as a means to infiltrate the foreign systems. The crucial contents of Korean Atomic Research Institute were dumped into USAF system. However, the contents were majorly relevant to South Korea and hence, less volatile. But this, nonetheless, could have led to a huge international issue.

5. Jonathan James

The first juvenile to be imprisoned for a cyber-crime at the age of 16, Jonathan James or better known as c0mrade, hacked into Defense Threat Reduction Agency of US department. Further, he installed a sniffer that scrutinized the messages passed on between the DTRA employees. Not only did he keep a check on the messages being passed around, in the process, he collected the passwords and usernames and other such vital details of the employees, and further even stole essential software. All this cost NASA to shut down its system and to pay from its pocket $41,000. c0mrade, however, had a bitter ending as James committed suicide in 2008.

6. Kevin Poulsen

How far would you go to win your dream car or a dream house? How far will you go to win an online contest or a radio show contest? Perhaps, you shall keep trying your luck, unless you are Kevin Poulsen! Poulsen infiltrated a radio shows call-in contest just so he could win a Porsche. Dark Dante, as he was better known, went underground after FBI started pursuing him. He, later, was found guilty of seven counts of mail, wire and computer fraud, money laundering and the likes. What turned out to be rewarding in Dark Dante’s case is – his past crafted his future. Poulsen now serves as a Senior Editor at Wired.

7. Kevin Mitnick

Clad in an Armani suit, when a bespectacled face in his mid-40s smiles at you from the computer screen, you can hardly consider the man a cyber-criminal. Such is the case with Kevin David Mitnick. Once upon a time, the most wanted cyber-criminal of US, now is an affluent entrepreneur. Kevin, who is now a security consultant, was convicted of hacking Nokia, Motorola and Pentagon. He pleaded guilty to seven counts of fraud that included wire fraud, computer fraud and of illegally interception a wire communication. After five years of incarceration that included eight months of solitary confinement, Mitnick now has started afresh. However, his knack with the computers is still reminisced and was even depicted on celluloid in the films Takedown and Freedom Downtown.

8. Anonymous

The concept of being a “digital Robin Hood” was far from being conceived, but in the computer age, it is very likely that someone somewhere has bagged this title. A “hacktivist group” called Anonymous are known with the penname of being the “digital Robin Hood” amongst its supporters. Identified in public by wearing a Guy Fawkes Masks, Anons, as they are widely known, have publicized themselves by attacking the government, religious and corporate websites. The Vatican, the FBI, the CIA, PayPal, Sony, Mastercard, Visa, Chinese, Israeli, Tunisian, and Ugandan governments have been amongst their targets. Although, Anons have been arguing whether to engage in a serious activism or a mere entertainment, many of the group members have clarified their intent which is to attack internet censorship and control.

9. Astra

Astra, a Sanskrit word for weapon was the penname of a hacker who dealt in the weapon stealing and selling. A 58-year-old Greek Mathematician hacked into the systems of France’s Dassault Group, stole vulnerable weapons technology data and sold it to different countries for five long years. While the real identity of the ASTRA remains untraced, officials have said that he had been wanted since 2002. Astra sold the data to approximately 250 people from around the globe, which cost Dassault $360 millions of damage.

10. Albert Gonzalez

How safe is internet banking? When we browse through the profile of this mastermind, we are certain that one ought to use the World Wide Web with immense care. For two long years, Albert Gonzalez, stole from credit cards of the netizens. This was recorded to be the biggest credit card theft in the history of mankind. He resold approximately 170 million credit cards and ATM numbers. He did so by installing a sniffer and sniffing out the computer data from internal corporate networks. When arrested, Gonzalez was sentenced to 20 years in Federal prison.