Archive for June 27, 2014

South Korean Bank Customers targeted by Android Malware


A Mobile software company Cheetah Mobile has identified a malicious piece of Android malware that replaces the legitimate banking apps with fake versions.

According to the Cheetah Mobile report, the Trojan disguises itself as popular game or application on third party android application markets in Korea and tricks users into installing the app.

Once it is installed, the Trojan searches for the official online banking applications of south Korean Banks including Nong Hyup Bank, Sinhan Bank, Woori, Kookmin, Hana N Bank, Busan Bank and Korean Federation of Community Credit Cooperatives.

If one of these banking apps is found to be installed on the victim's device, the malware displays an alert saying that the banking app needs to be updated.  Once the update is approved,  the legitimate banking app will be replaced with the fake one.

The fake version then asks victims to enter the password to their security certificate(which is required by the South Korean government in order to access many online services).

The app then asks victims to provide their bank account number, passwords and bank security number.

At the end, the malware simply displays a fake error message informing victims that there is no Internet connection.  The malware then deletes itself from the device.

"With the information that they stole, the hackers can apply for a new certificate, which they then use to freely access the victim's bank account."says Cheetah Mobile.

The company said more than 3,000 devices have been infected in the last week alone.

Syrian Electronic Army hacks Reuters


Reuters, the international news agency, was reportedly been hacked by the Syrian Electronic Army - a hacking group who support the government of Syrian President Bashar al-Assad and attack news organizations.

Anyone who try to visit articles on the Reuters website were being redirected to the official website of the Syrian Electronic Army.

" Hacked by Syrian Electronic Army

Stop publishing fake reports and false articles about Syria!

UK government is supporting the terrorists in Syria to destroy it, Stop spreading its propaganda." The message posted in hacker's website reads.

According to rederic Jacobs reports, the Reuters wasn't directly compromised in this attack.  Instead, the group hacked into a third-party ad provider Taboola -which is used by Reuters to display ads.

This is not the first time the group has used such an approach to hack the websites.  Few days back, the group managed to redirect users of The Sunday Times website to their website, after they compromised a third-party server used by both sites.

Last year, the group managed to hack into the Outbrian and redirect the visitors of CNN, WashingtonPost and other news organizations to hackers' website.

Alleged "NullCrew" Hacker arrested by FBI

FBI has arrested a 20-year-old Tennessee man for allegedly conspiring to launch cyber attacks on a number of businesses and educational organizations.

Timothy Justin French, known online as 'Orbit', is believed to be part of the famous hacking group "NullCrew".  The group is best known for its hacking attacks against World Health Organization and PBS.  Earlier this year, the group also hacked into Bell Canada website.

According to the DOJ, the FBI with the help of 'confidential witness' approached members of the Nullcrew Team on Skype, Twitter and CryptoCat.

After gaining their trust, Fed's inside man engaged them in conversations that includes discussions on past,present and future attacks and their hacking techniques.

The FBI used the information gathered by witness to track the IP address of one of the computers used in some of the NullCrew attacks.

"The computer hacking charge in this case carries a maximum sentence of 10 years in prison and a $250,000 fine. If convicted, the court must impose a reasonable sentence under federal statutes and the advisory United States Sentencing Guidelines."

Dominos Pizza hacked, details of 650k customers stolen

Hackers who claimed to have compromised the database server of Domino's Pizza have demanded a ransom of €30,000 to prevent the public disclosure of customer's data.

The hacker group going by the name of Rex Mundi said they hacked into the servers of Domino's Pizza France and Belgium.

The hackers have managed to download more than 592,000 customer records from Dominos France and 58,000 records from Belgian website.

They claim the compromised database contained sensitive information such as customer's full names, addresses, phone numbers, delivery instructions, email IDs and passwords.

The group gave a deadline of 8PM CET for Dominos to pay them.

"If they do not do so, we will post the entirety of the data in our possession on the Internet." The group said.

Domino's France posted a series of tweets in which it acknowledged the hack and recommended users to change their passwords.

Schools Kids hacked BMO ATM using Operators manual found online

A couple of school kids from Winnipeg has managed to hack into a Bank of Montreal's (BMO) ATM operating system during their lunch break.

Matthew Hewlett and Caleb Turon, the grade 9 students, used an ATM operators manual they found online to get into the machine's operator mode, according to Toronto Sun.

The operator mode asked them to enter password.  However, the kids were successfully able to guess the six-digit password on the first try.   The machine has used a common default password.

The kids reported about the issue to a nearby BMO Branch.  However, Bank staff didn't believe them.  So, the kids asked the staff "Is it alright for us to get proof".

They headed back to the ATM to get a proof and come back with the printout of how much money the ATM is currently having.  They even changed the ATM's Greeting Message to "Go away. This ATM has been hacked."

This time, staff took them seriously and the Branch Manager to contacted Head security to take steps to fix the issue.


Ralph Marranca, Spokesperson for BMO said no customer information and accounts and the contents of the ATM were never at risk and are secure.