Chinese Hackers Eavesdropping European Diplomats Before G20 Summit

Researchers At FireEye Found -Chinese Hackers Snitching  Europeans Before G20 Summit 

Story of cyber espionage by Chinese hackers used to remain one of most highest pick of breakneck. Yet again another breathtaking issue of  eavesdropping by Chinese hackers get spot light, when  California-based renounced computer security firm FireEye Inc have figured out that a group of Chinese hackers eavesdropped on the computers of five European foreign ministries before last September's G20 Summit, which was dominated by the Syrian crisis. From the detailed analysis we came to know that the hackers have infiltrated the ministries' computer networks by sending emails to staff containing tainted files with titles such as "US_military_options_in_Syria," which sells virus fighting technology to companies. Whenever the targeted recipients opened those documents, they loaded malicious code on to their personal computers. Researchers of FireEye said that they were able to monitor the "inner workings" of the main computer server used by the hackers to conduct their reconnaissance and move across compromised systems for about a week in the late August. But suddenly they lost access to the hackers after they moved to another server shortly before the G20 Summit in St. Petersburg, Russia. 

Though the company has declined in open press to identify the nations whose ministries were hacked, although it said they were all members of the European Union. But FireEye informed the FBI about the whole issue in details. FireEye also confirmed that the hackers where from China, but they did not find evidence which may link those hackers to the Chinese government. Not surprisingly and obviously like earlier the Chinese government has distanced itself from any claim that it might have hacked foreign governments for data. FireEye also successfully monitor several dozen hacking groups operating in China, most of which they suspect of having ties to the government. The firms also suspect the hacking groups of stealing intellectual property for commercial gain. The researchers had been following the hackers behind the Syria-related attack for several years, but this is the first time the group's activities have been publicly documented. The company calls the group "Ke3chang," after the name of one of the files it uses in one of its pieces of malicious software. "The theme of the attacks was U.S. military intervention in Syria," said FireEye researcher Nart Villeneuv. 

On reaction Chinese Foreign Ministry spokesman Hong Lei said- "U.S. internet companies are keen on hyping up the so-called hacker threat from China, but they never obtain irrefutable proof, and what so-called evidence they do get is widely doubted by experts. This is neither professional nor responsible," 

While talking in this story of Chinese eavesdropping, I also want to dig some points from decent parts where we all became very habituated of seeing Europe & U.S. countries blaming China for engaging cyber attacks; and China also do the same for accusing U.S. like vice versa. I am reviving your memories of last few years where If you look at the story of major cyber attacks of this year we will find that the name of China has been involved several times for engaging cyber attacks against several high profile websites and organization of U.S. including New York Times, Twitter, NBC and so on. And if you refresh our memory then then we will find the scenario of big cyber attack and espionage by Chinese hackers have been spotted several times. In 2012 Chinese hackers had  breached Telvent's corporate network & gained control of US Power Grid. Also in the middle of last year, we have seen that Chinese hackers have broken into Indian Navy's Computer System & stolen sensitive data. Few months before this hack, Tokyo based computer security firm Trend Micro confirmed that Chinese hackers were responsible for biggest cyber-espionage in India, Japan & Tibet. Also the director of National Security Agency (NSA) General Keith Alexander confirmed that hackers from China was responsible for the serious attack on one of the leading IT security & cyber security company RSA. Also in 2011 China was responsible behind the attack on US Chamber of Commerce, Satellite System of U.S, Nortel Network & so on.  But few days ago National Computer Network Emergency Response Coordination Center of China (CNCERT/CC), China's primary computer security monitoring network claimed that China fallen victim of one of biggest cyber attacks originated from US, Japan & South Korea. We must have to say that this statement is truly irrelevant. Cyber crime investigator have found that China was directly responsible for the hack into Japan's Biggest Defense Contractor Mitsubishi, Japan Aerospace Exploration Agency (JAXA) & Parliament of Japan. In case of South Korea  more than 13 Million of MapleStory players data has been stolen, there also hackers from China was responsible.  

Before I conclude, I request you to closely look at the above mentioned stories, you will find China majorly responsible for eavesdropping & security breach. On the same side China also been effected by the same way. So in conclusion, we cant put a full stop in this chain of cyber attacks, hacking & eavesdropping, as it comes from both end. So this exciting episode will be continued like it does. If you want to stay updated then don't forget to stay tuned with VOGH. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Chinese Hackers Eavesdropping European Diplomats Before G20 Summit "https://www.voiceofgreyhat.com/2013/12/china-eavesdropping-europeans-before-G20-summit.html</a>

Security Breach Invaded 8,500 Recipients of Unemployment Insurance Agency Michigan (UIA)

Michigan Unemployment Insurance Agency (UIA) Hacked! 8,500 Recipients Personal Data Leaked

A major security breach has invaded Unemployment Insurance Agency of Michigan, widely known as UIA. Sources revealed that the attack was placed in between mid of July to mid of September which affected more than 8,500 unemployment insurance recipients in Michigan with leak of social security numbers, bank account numbers, passwords, phone numbers & few other sensitive data. This security breach was first detected Sept. 17 by contractor JP Morgan Chase. In his reaction the director of the Unemployment Insurance Agency, Shaun Thomas said -“The UIA is deeply concerned about this incident.” But due to some untold reason state official were not notified until this December first week. Dan Lohrmann, the state’s chief security officer in the Department of Technology, Management and Budget, said he has “worked closely with JP Morgan Chase to share our concern about the delayed notification and to ensure that the state receives immediate notice of future problems. “We work around the clock to keep citizen information and data protected, and I feel confident that everyone involved in this event understands the importance of protecting personal information.” Chase, which handles the debit cards Michigan uses to pay unemployment insurance benefits to some recipients, said those who accessed the bank’s website between mid-July and mid-September may have been affected. The 8,500 claimants in Michigan are among about 465,000 cardholders nationwide who may have been affected, the bank said. So far the identity of the hackers & their reasons behind this attack is not been identified, but Chase has notified law enforcement and both the bank and the state will be notifying claimants whose information was potentially compromised. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Security Breach Invaded 8,500 Recipients of Unemployment Insurance Agency Michigan (UIA) "https://www.voiceofgreyhat.com/2013/12/unemployment-insurance-agency-hacked.html</a>

Cartoon Network (CN) Official Website is Vulnerable to XSS Attack

XSS Vulnerability Found in Cartoon Network's (CN) Official Website By Dr41DeY 

After the successful breach of 'DY365 TV' yet again the hacker going by the name of Dr41DeY from Nigerian Cyber Army targeted another TV network. Guess what, this time he caught even a bigger fish. Unlike defacement or breach this time the hacker did something what it called ethical or can be categorized in white-hat list. Okey now without pulling the intro more longer lets directly come to the story -and that is the official website of Cartoon Network is vulnerable of cross site scripting attack also known as XSS attack. Cartoon Network mostly known as CN is the worlds leader in broadcasting  animated programming, ranging from action to animated comedy & many more. This satellite channel is the most preferred channel for the children and teenagers between the ages of 7 to 5 among the whole of the world. So it is quit indisputable that the official website of Cartoon Network (CN) is indeed a valuable website which have large number of traffic everyday. But it is unclear that being such a big and popular brand name, why CN committed such a massacre while leaving XSS vulnerability in their official portal. Dr41DeY shared with VOGH, that the search box in the home page of CN poses non persistent XSS vulnerability. The above screen shots was taken as a proof of the story. I on behalf of Team VOGH has already contacted CN authorities, and knocked them about this issue. Hopefully they will take appropriate steps with out doing any further delay. For updates in this story and also other hot cyber issues, just stay tuned with VOGH.  

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Cartoon Network (CN) Official Website is Vulnerable to XSS Attack "https://www.voiceofgreyhat.com/2013/12/cartoonnetworkvulnerable2-xss.html</a>

WikiLeaks Revealed Two New Documents of Trans Pacific Partnership Agreement (TPP)

WikiLeaks Revealed Two New Documents of Confidential Trans Pacific Partnership Agreement (TPP)

Last month WikiLeaks has published  the draft of secret Trans Pacific Partnership Agreement (TPP), uncovering the United States' covert international push for stronger intellectual property rights. Now just a month later two more breathtaking documents of TPP has been revealed by the whistle blower, that show the state of negotiations as the twelve TPP countries began supposedly final negotiations at a trade ministers’ meeting in Singapore this week. This leaks come at a particularly inconvenient time for negotiators, as they enter into their fourth day of talks in Singapore amid growing criticism. The talks are premised on secrecy, allowing countries to push for particular proposals without having to justify their positions publicly, but the continued pressure from WikiLeaks has brought unintended attention to the proceedings.

According to official release of WikiLeaks -One document describes deep divisions between the United States and other nations, and "great pressure" being exerted by the US negotiators to move other nations to their position. The other document lists, country-by-country, the many areas of disagreement remaining. It covers intellectual property and thirteen other chapters of the draft agreement. This suggests that the TPP negotiations can only be concluded if the Asia-Pacific countries back down on key national interest issues, otherwise the treaty will fail altogether. The above described two documents are dubbed as TPP Salt Lake Extracts & TPP Salt Lake Positions. For additional information about this issue click Here.  For further updates on TPP and also other hot WikiLeaks stories & cyber issues, just stay tuned with VOGH. 

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">WikiLeaks Revealed Two New Documents of Trans Pacific Partnership Agreement (TPP) "https://www.voiceofgreyhat.com/2013/12/2-new-leak-of-tpp-by-wikileaks.html</a>

Anonymous Hacker Denied Bail in Singapore, Accused For Hacking Prime Minister Website

Anonymous Hacker Denied Bail in Singapore, Accused For Hacking Prime Minister Website

A Singapore court in this week has denied bail of accused anonymous hacker charged for hacking high value government websites. Last month a Singaporean hacker named James Raj was extradited from Malaysia. He was charged for hacking the Ang Mo Kio district website, whose MPs include Prime Minister Lee Hsien Loong, under the banner of worlds most dangerous hacktivist community Anonymous. The alleged hacking was among a string of cyber attacks that have also targeted the websites of Premier Lee and President Tony Tan as well as pro-government media, in a row over Internet freedom in the city state. This 35 years old hacker was deeply linked with Anonymous and he was covered himself with nickname "The Messiah".  District Judge Soh Tze Bian said Raj, posed a flight risk because he previously jumped bail and fled to Malaysia after being slapped with illegal drugs consumption charges in 2011. 

Police have previously said Raj was also linked to other hacking attacks, including on the website of a charity associated with the ruling People's Action Party. Two Singaporean men have so far been charged with defacing the president's website. Police have said that there are no links between Raj and these suspects. 

The round of attack from Raj took place three days before a self-proclaimed spokesperson for Anonymous appeared in a video on October 31 to demand the scrapping of a recent Singapore law requiring news websites to obtain annual licences. The Internet licensing rules, which came into effect in June, have sparked anger among bloggers and activists who say they are designed to muzzle free expression. Singapore strictly regulates the traditional media, but insists the recent licensing rules do not impinge on Internet freedom. 

-Source (Global Post)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Anonymous Hacker Denied Bail in Singapore, Accused For Hacking Prime Minister Website"https://www.voiceofgreyhat.com/2013/12/anonymous-hacker-denied-bail-in-singapore.html</a>

Microsoft Along With FBI & EC3 Shattered The Notorious ZeroAccess Botnet

Microsoft Along With FBI & EC3 Shattered The Notorious ZeroAccess Botnet Responsible For Infecting More Than 2 Million Computers

Redmond based software giant Microsoft yet again got a huge success against a big racket of cyber criminals while shattering one of the world's largest and most rampant botnets named 'ZeroAccess'. The Sirefef botnet, also known as ZeroAccess, is responsible for infecting more than 2 million computers, specifically targeting search results on Google, Bing and Yahoo search engines, and is estimated to cost online advertisers $2.7 million each month. Tech giant Microsoft working alongside the Federal Bureau of Investigation (FBI), Europol's European Cybercrime Centre (EC3) have successfully disrupted this notorious botnet. This is Microsoft’s first botnet action since the Nov. 14 unveiling of its new Cybercrime Center — a center of excellence for advancing the global fight against cyber crime — and marks the company’s eighth botnet operation in the past three years.

“This operation marks an important step in coordinated actions that are initiated by private companies and, at the same time, enable law enforcement agencies around Europe to identify and investigate the criminal organizations and networks behind these dangerous botnets that use malicious software to gain illicit profits,” said Troels Oerting, head of the EC3. “EC3 added its expertise, information communications technology infrastructure and analytic capability, as well as provided the platform for high-level cooperation between cyber crime units in five European countries and Microsoft.”

Due to its botnet architecture, ZeroAccess is one of the most robust and durable botnets in operation today and was built to be resilient to disruption efforts, relying on a peer-to-peer infrastructure that allows cyber criminals to remotely control the botnet from tens of thousands of different computers. ZeroAccess is used to commit a slew of crimes, including search hijacking, which “hijacks” people’s search results and redirects people to sites they had not intended or requested to go to in order to steal the money generated by their ad clicks. ZeroAccess also commits click fraud, which occurs when advertisers pay for clicks that are not the result of legitimate, interested human users’ clicks, but are the result of automated Web traffic and other criminal activity. Research by the University of California, San Diego shows that as of October 2013, 1.9 million computers were infected with ZeroAccess, and Microsoft determined there were more than 800,000 ZeroAccess-infected computers active on the Internet on any given day.

How It Happened:- 

Last week, Microsoft filed a civil suit against the cyber criminals operating the ZeroAccess botnet and received authorization from the U.S. District Court for the Western District of Texas to simultaneously block incoming and outgoing communications between computers located in the U.S. and the 18 identified Internet Protocol (IP) addresses being used to commit the fraudulent schemes. In addition, Microsoft took over control of 49 domains associated with the ZeroAccess botnet. A10 Networks provided Microsoft with advanced technology to support the disruptive action.

As Microsoft executed the order filed in its civil case, Europol coordinated a multijurisdictional criminal action targeting the 18 IP addresses located in Europe. Specifically, Europol worked with Latvia, Luxembourg, Switzerland, the Netherlands and Germany to execute search warrants and seizures on computer servers associated with the fraudulent IP addresses located in Europe. This is the second time in six months that Microsoft and law enforcement have worked together to successfully disrupt a prevalent botnet. It demonstrates the value coordinated operations have against cyber criminal enterprises. For more information about this botnet operation click here

ZeroAccess is counted as a very sophisticated malware, blocking attempts to remove it, therefore recommended for every Microsoft user to click Here for detailed instructions on how to remove this threat. As Microsoft found that the ZeroAccess malware disables security features on infected computers, leaving the computer susceptible to secondary infections, it is critical that victims rid their computers of ZeroAccess by using malware removal or antivirus software as quickly as possible. 

In conversation with press David Finn, executive director and associate general counsel of the Microsoft Digital Crimes Unit said -“Microsoft is committed to working collaboratively — with our customers, partners, academic experts and law enforcement — to combat cybercrime. And we’ll do everything we can to protect computer users from the sinister activities and criminal networks that victimize innocent people and businesses around the world.” 

While talking about ZeroAccess botnet take down, I would like to remind you that in Match, last year Microsoft has successfully shutdown two command and control (C&C) server of world's of the most dangerous banking trojan Zeus.

-Source (Microsoft Official Blog)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">Microsoft Along With FBI & EC3 Shattered The Notorious ZeroAccess Botnet"https://www.voiceofgreyhat.com/2013/12/microsoft-shattered-zerozccess-botnet.html</a>

'PayPal 14' Culprits Enter Guilty Pleading Over Pro-WikiLeaks DDoS Attack Versus PayPal

Accused 'PayPal 14' Culprits of Anonymous Enter Guilty Pleading Over Pro-WikiLeaks DDoS Attack Versus PayPal

I am quite sure that all of your regular readers still remember the devastating cyber attack from Anonymous against PayPal, the attack was conducted under the banner of Operation PayPal (#OpPayPal). The infamous hacker community stated a reason for this mass protest as the online payment company suspending the account of WikiLeaks. #OpPayPal is considered as one of the most demolishing cyber attack ever taken in cyber space. PayPal with law enforcement agencies immediately taken steps and start investigation, in the primary step PayPal sent 1000 IP address of Anonymous hacker who was linked on that attack to FBI. As expected the hackers who were behind that attack was serially busted by the police. And finally the accused anonymous hacker appeared in federal court in California on Thursday and will be formally sentenced in one year. Eleven of the so-called “PayPal 14” members each pleaded guilty in court to one felony count of conspiracy and one misdemeanor count of damaging a computer as a result of their involvement in a distributed denial-of-service (DDoS) attack waged by Anonymous in late 2010 shortly after PayPal stopped processing donations to the anti-secrecy group WikiLeaks. Prosecutors say the defendants used a free computer program called the Low Ion Orbit Cannon, aka LOIC, to collectively flood PayPal’s servers with tremendous amounts of illegitimate internet traffic for one week that winter, at moments knocking the website offline as a result and causing what PayPal estimated to be roughly £3.5 million in damages. 

Pending good behavior, those 11 alleged Anons will be back in court early next December for sentencing, atpleading guilty to the misdemeanor counts only, likely removing themselves from any lingering felony convictions but earning an eventual 90 day jail stint when they are finally sentenced. A fourth defendant, Dennis Owen Collins, did not attend the hearing due to complications involving a similar case currently being considered by a federal judge in Alexandria Virginia in which he and one dozen others are accused of conspiring to cripple other websites as an act of protest during roughly the same time.

which point the felony charges are expected to be adjourned. Two of the remaining defendants cut deals that found them. In his press reaction defense attorney Stanley Cohen said the terms of the settlement were reached following over a year of negotiations, “based upon strength, not weakness; based upon principle, not acquiescence.” In the courtroom all the accused hacker stood up and said, ‘We did what you said we did . . .We believe it was an appropriate act from us and we’re willing to pay the price.’ 

On the other hand Cohen, who represented PayPal 14 defendant Mercedes Haefer in court, said one of the hacktivists told him after Thursdays hearing concluded that "This misdemeanor is a badge of honor and courage." When media questioned Michael Whelan, a lawyer for one of the defendants, he declined to comment on the plea. 

-Source (RT)

SHARE OUR NEWS DIRECTLY ON SOCIAL NETWORKS:-
<a href=">'PayPal 14' Culprits Enter Guilty Pleading Over Pro-WikiLeaks DDoS Attack Versus PayPal"https://www.voiceofgreyhat.com/2013/12/PayPal14-ofanonymous-enter-guilty-ple.html</a>