Search This Blog
Powered by Blogger.

Blog Archive

Labels

About Me

Load More
Trendy Right Now

Popular Posts

Showing posts with label MySQL. Show all posts
Website
4Chan Ad Tech AI vulnerabilities Cyber Breach Cyber Security Cyberhackers CyberThreat MySQL Website

Unexpected 4Chan Downtime Leads to Cybersecurity Speculation

 


There has been a significant breach of security at 4chan recently, which has been widely reported. According to several online sources, a hacker may have managed to penetrate the platform's internal systems after successfully infiltrating the platform's anonymous and unmoderated discussions. This may represent the beginning of what appears to be a significant cybersecurity incident. 

Early reports indicate that the breach occurred when a section of the website that was inactive suddenly became active, displaying prominent messages such as "U GOT HACKED", a clear indication that the site had been hacked. This unexpected reactivation was the first indication that unauthorised access had been achieved. There was also growing speculation as a result of several online posts claiming the perpetrator behind the breach was leaking sensitive information, including personal information about the site moderators and their identities. 

The nature of the claims has sparked widespread concern about the possibility of data exposure and wider cybersecurity vulnerabilities for the platform, even though the platform has not yet released an official statement verifying the extent of the compromise. In this instance, it underscores the growing threat landscape facing digital platforms, particularly those that operate with minimal moderation and host large volumes of user-generated content, as the story unfolds. 

As cybersecurity experts and digital rights advocates continue to follow the story closely for confirmation and implications of the alleged breach, cybersecurity experts are closely monitoring developments. According to reports on social media platforms, 4chan was experiencing prolonged periods of downtime, which was widely reported by users across social media platforms, indicating the alleged breach of the website.

As of this writing, the website remains largely inaccessible. It appears that the disruption has been caused by a targeted and prolonged cyber intrusion, as suggested by independent observations, including those cited by TechCrunch. One user of a competing message board seemed to be revelling in the incident, with another claiming that the attacker had been able to use 4chan's systems for more than a year after gaining covert access through a user-created account. It is believed that numerous screenshots, purported to depict the administrative interface of the site, were circulated online as evidence of these claims. 

The images depicted what appeared to be internal tools and infrastructure, including moderation templates, user banning policies, and the source code of the platform, all of which would normally belong to the moderation team of the site. The most disturbing aspect of the leak has to do with a document that allegedly gives the identities of some 4chan moderators, as well as "janitors," who are users with limited administrative rights. 

In contrast to janitors, who are capable of removing threads and posts, moderators possess a more powerful set of capabilities, including the ability to view the IP address of users. This disclosure could have serious security and privacy implications if verified, especially given 4chan's history of hosting political, sometimes extreme content that is frequently unethical, oriented and extremist. 

Among other things, cybersecurity analysts warn that such a leak could compromise not only individual safety but could also give us a clearer picture of how one of the most polarising online communities functions. There have been reports of widespread service disruptions at 4chan, which were first reported early Tuesday, when thousands of users documented their experiences on Downdetector, a platform for monitoring website outages, reporting that 4chan's service has been disrupted. 

Since then, 4chan’s site has been intermittently accessible, with no official acknowledgement or explanations from its administrators, leaving a void that has quickly been filled by speculation. The narrative that has circulated, albeit unverified, points to a significant security breach. Multiple sources suggest that a hacker may have infiltrated the back-end infrastructure of 4chan and may be able to gain access to sensitive data, including moderator email addresses, internal communications and internal communications, among others. 

According to some users, the alleged vulnerability may be the result of outdated server software, which has been reported not to have been patched for more than a year. An even more detailed analysis was provided on the imageboard soyjack Party, a rival imageboard, where one user claimed the intruder had been able to access 4chan's administrative systems secretly for over a year. 

By these posts, the hacker eventually published portions of the platform's source code, as well as internal staff documentation, which led to a 4chan administrator taking it offline to prevent further exposure, as a result of the leak. As well as these allegations, many users on Reddit have shared screenshots of moderator login interfaces, private chat logs, as well as fragments of leaked code, as well as other claims that users echo. 

It is important to note that, while none of these allegations have been independently verified, cybersecurity professionals warn that if the breach is authentic, it can have serious repercussions for the site's operational security as well as the privacy of its users and employees. There has long been a reputation for 4chan as a place where controversial content is posted and politically sensitive discourse is conducted, and any breach of personal data, especially that of moderators, raises concerns about the possibility of identity theft, doxxing, and targeted harassment, as well as broader cyber exploitation. 

A definitive identification of the person responsible for the alleged 4chan breach has not been made yet, as conflicting reports and a lack of verifiable evidence continue to obscure the exact origins of the alleged attack. However, some emerging theories suggest that individuals connected with the Soyjak.party community, which is formally called the “Sharty” group, may have been involved in the incident. 

According to the allegations of these attackers, they are suspected to have exploited longstanding vulnerabilities in the backend architecture of 4chan, specifically outdated PHP code and deprecated MySQL functions, and gained access to a previously banned discussion board known as /QA/, as well as exposed some email addresses of the moderators of the platform. It remains unclear about the motives of the group. 

In recent weeks, certain users on X (formerly Twitter) have suggested that it might have been a retaliatory act resulting from the controversial removal of the /QA/ board in 2021. Although these assertions have been widely circulated, they have not been verified by credible sources. A comparison has also been made to previous breaches, including one which was revealed by 4chan's founder Christopher Poole in 2014, in which an attacker allegedly compromised moderator accounts due to his grievances. 

The incident at that time ended without any clarity as to who was responsible for the incident. It is clear that securing anonymous platforms, especially those that have a complex legacy and a volatile user base, continues to present several challenges, especially when layered with historical precedent and fresh suspicions. There will likely remain questions regarding accountability and intent until a formal investigation produces conclusive findings. 

It is likely, however, that if the breach is authenticated, it will significantly damage both 4chan's credibility and the privacy of its users. In addition to the possibility of exposing moderator emails and internal communications, leaked materials are allegedly showing evidence of deep system access, as well. According to these materials, user metrics, deleted posts and related IP addresses are exhibited alongside internal administrative documentation as well as portions of the platform's underlying source code assets. 

These materials, if genuine, may pose considerable security threats to users in the future. Even though WIRED is not able to independently verify the leaked content, there has been some controversy surrounding the situation since at least a few elements of the breach have been acknowledged as authentic by a moderator on the forum. Several concerns have been raised regarding 4chan's infrastructure since this incident, particularly allegations that the outdated and unpatched legacy software could have led to vulnerabilities ripe for exploitation. 

It is clear that these concerns have been around for nearly a decade; in 2014, following a previous security incident, the site's founder, Christopher Poole (also known as "moot"), made public a call for proactive measures in cybersecurity. In retrospect, it seems as though those early warnings went mostly unanswered. 

As a professor at the University of California Riverside who has a keen interest in digital discourse, online subcultures, and digital discourse, Emiliano De Cristofaro commented on the wider implications of the data breach, stating, “It seems that 4chan hasn’t been properly maintained in years,” he noted, noting that a failure to modernize and secure its infrastructure could now have exposed the site to irreversible consequences.
Read more »
MySQL
Cyber Security FBI Iranian hackers Log4j MySQL

FBI Warns of Hack Operations From Iranian Hackers

The FBI cautions that the Iranian threat group Emennet Pasargad may conduct hack-and-leak activities against US interests, precisely the November midterm elections, despite the group's primary focus on attacking Israeli leaders.

The US Treasury announced penalties over five Iranians and Emennet Pasargad, the firm they worked for, in November 2021 after the US issued a warning in November 2020 that Iranian hackers had taken advantage of known weaknesses to acquire voter registration data.

According to the information from the FBI, Emennet has been targeting organizations, primarily in Israel, with cyber-enabled information operations since at least 2020. These operations included an initial intrusion, data theft, and subsequent leak, followed by attenuation through online and social media forums, and in some cases, the implementation of destructive encryption malware.

The gang also targets businesses with PHP-powered websites or MySQL databases that can be accessed from the outside. The FBI claims hackers frequently launch attacks using open-source software for penetration testing.

The Bureau claims that Emennet executes false-flag attacks against Israel using online personas like hacktivists or cybercriminal groups. It warns that the company may use the same strategies to target US entities. The majority of the measures mentioned in the report were ones the group employed in the 2020 U.S. Presidential election.

The FBI issued a warning, stating that the gang would 'probably' target popular content-management tools like Drupal and WordPress. The infamous Log4j vulnerability has also been used by Emennet in cyberattacks on at least one U.S.-based company.

Seyyed Mohammad Hosein Musa Kazemi and Sajjad Kashian, two Iranian consultants who started working for Emennet Pasargad, initiated several operations intended to sow discord and undermine voters' confidence in the American electoral process, were the subject of a $10 million reward offered by the U.S. State Department in February.

Although still at large, Kazemi and Kashian are thought to be in Iran. The FBI's list of cyber criminals wanted now includes the two as well. The FBI also provides organizations with advice on how to reduce the risk posed by Emennet and a list of tactics, methods, and procedures (TTPs) related to the group.


Read more »
Zero- day vulnerability
Malicious Code MySQL PHP SQL Injection Vulnerabilities and Exploits. Zero- day vulnerability

PrestaShop Sites Hit by Severe Security Flaw

 


Hackers are using a blend of known and undiscovered security flaws to insert malicious software into e-commerce websites running the PrestaShop platform, according to an urgent advisory from PrestaShop. There are currently 300,000 stores using PrestaShop, which is available in 60 different languages.

Operation objective:

Hackers exploit businesses that are utilizing out-of-date software or modules, susceptible third-party modules, or a vulnerability that has not yet been identified. The store must be vulnerable to SQL injection attacks for the attack to succeed. PrestaShop versions 1.6.0.10 and later and versions 1.7.8.2 and after running modules susceptible to SQL injection are also affected by the vulnerability.

The repeating method is stated in the PrestaShop security bulletin as follows:
  • A POST request is made by the hacker to a vulnerability endpoint to SQL injection.
  • The hacker sends a GET request to the homepage without any parameters after around a second.
  • This triggers the creation of a PHP file with the name blm.php at the root of the shop's directory.
  • The attacker now sends a GET request to the newly constructed file, blm.php, enabling them to carry out any command.
The hackers likely exploited this web shell to insert a scam payment form on the store's checkout page and steal payment card information from customers. To keep the site owner from learning that they had been compromised, the remote threat actors erased their trails after the attack.

Security measures 

Ensure that the site is updated to the most recent version, as well as all of its modules. Compromise site managers may discover entries in the web server's access logs for clues that they were compromised if the hackers weren't careful with the cleanup of evidence.

The addition of malicious software to files through file modifications and the activation of the MySQL Smarty cache storage, which is a component of the attack chain, are additional indications of compromise.

Because of the exploit's intricacy, there are various techniques to use it, and hackers might also try to cover their traces. To ensure that no file has been edited or malicious software has been installed, think about hiring a professional to conduct a thorough audit of the website.



Read more »
SQL
Chinese Hackers Cobalt Strike Google Microsoft Internet Explorer keylogger malware MySQL RAT SQL

Gh0stCringe Malware Recently Attacked Insecure Microsoft SQL and MySQL Servers

 

Hackers are deploying the Gh0stCringe remote support trojans on vulnerable computers by inadequately targeting secured Microsoft SQL and MySQL database servers. 

Gh0stCringe, also known as CirenegRAT, is a Gh0st RAT malware variant that was most recently used in Chinese cyber-espionage activities in 2020, however, it has been around since 2018. The malware has several instructions and functionalities which can be activated after the malware connects to its command and control server, or through data stored in the virus's settings. 

Attackers can use Gh0stCringe to download payloads like crypto miners from C2 servers, access specified websites via the Internet Explorer web browser, and even wipe the start-up disk's Master Boot Record (MBR). The malware includes a keylogger, which records input data in the Default. key file in the Windows System directory if it is activated. 

Threat actors are infiltrating database servers and writing the malicious'mcsql.exe' executable to disc utilizing the mysqld.exe, mysqld-nt.exe, and sqlserver.exe processes. These assaults are comparable to the Microsoft SQL server attempts, which used the Microsoft SQL xp cmdshell command to drop Cobalt Strike beacons. In addition to Gh0stCringe, AhnLab's study notes the presence of numerous malware samples on the investigated servers, implying potentially competing threat actors are infiltrating the same servers to drop payloads with its own operations.

Gh0stCringe RAT is a strong virus that can connect to a C2 server to receive custom commands or exfiltrate stolen data to the enemies. For an endless loop, the keylogging component uses the Windows Polling method (GetAsyncKeyState API) to ask the state of each key. This otherwise dependable recording mechanism carries the risk of very high CPU utilization, however, this is unlikely to cause issues for threat actors on poorly maintained servers. The malware will also record keystrokes for the previous three minutes and send them to the infection's command and control servers along with basic system and network information. 

Threat actors will be able to steal login passwords and other sensitive information that logged-in users entered on the device using these logged keystrokes. CirenegRAT has four operational modes: 0, 1, 2, and a specific Windows 10 mode which the threat actor can choose from during deployment.

Update your server software to install the most recent security upgrades, which can help you avoid a variety of attacks to make use of known flaws. It's also critical to use a secure admin password that can't be brute-forced. The most important step is to put the database server behind a firewall to only allow authorized devices to connect to it.
Read more »
XSS
MySQL Vulnerabilities and Exploits WordPress WordPress Plugin WP Fastest Chache Plugin XSS

WordPress WP Fastest Cache Plugin Discovered With Multiple Vulnerabilities

 

WP Fastest Cache is among a handful of WordPress plugins meant to improve the performance of a website. It seeks to reduce the frequency of database queries necessary to render the website and related server load by producing and maintaining a static replica of the articles and webpages. 

JetPack security experts uncovered several vulnerabilities in the popular WordPress plugin WP Fastest Cache that might enable an attacker to fully exploit admin rights. Outcomes have an impact on over a million WordPress installations. 

There are several flaws that have been discovered by the researchers, two of the many are: 

  • Authentic MySQL Injection 

Using an authenticated MySQL injection login, users can gain access to administrator-level data in the system. A MySQL injection vulnerability is a cyberattack on a database server that stores website components such as credentials and usernames. An effective MySQL injection attack might result in a total website takeover. 

“If exploited, MySQL injection bugs can give attackers access to privileged information from the affected site’s database (such as username and hash password). This can only be exploited if the Classic Editor plugin is also installed and activated on the site,” stated The Jetpack Security Bulletin. 

XSS was stored through cross-site request forgery 

XSS (cross-site scripting) flaws are rather widespread and stem from flaws in website input correction. If somehow the user inserts something into the website, such as a contact form, and the data is not deleted, the user may be attacked by XSS. 

Sanitization entails limiting what may be submitted to a single intended input, such as text, rather than a script or command. A faulty input enables the attacker to insert malicious scripts, which might also subsequently be used to target administrators who visit the site and install malicious files into their browsers; appears as though they are loading or blocking their credentials. 

Whenever an intruder convinces a user, such as a login administrator, into accessing the site and executing different actions, it is referred to as a cross-site application forgery. 

Such vulnerabilities are difficult to exploit since they rely on the traditional editor plugin being loaded and the attacker having some type of user verification. However, these flaws are still significant, and JetPack advises that customers must update their WP Fastest Cache plugins to at least version 0.95, which was released on October 14, 2021. 

According to the jet pack: “If exploited, MySQL injection bug attackers can gain access to privileged information from the affected site’s database (such as username and hash password). Successful exploitation of the vulnerabilities of CSRF and Stored XSS can allow bad actors to login to the administrator on the targeted site.”
Read more »
SQL
CMS Data Breach database MySQL SQL

SQL Triggers Used by Hackers to Compromise User Database

 

Over the past year, a broader pattern of WordPress malware with SQL triggers has occurred within infected databases to mask intrusive SQL queries. Whenever the trigger condition is fulfilled, these queries insert an admin-level user into a contaminated database. Users can use a MySQL database to store essential data, including CMS settings and a common CMS is used on their website (such as WordPress). Something that might change the MySQL database is whether injecting harmful code or removing the content of your Website, could also do severe harm to the website. 

Potential for protection is one factor why the MySQL database has its own unique username and password, which will deter someone from checking the MySQL database manually without the required login details. Unfortunately, if attackers have unauthenticated access, they can also read a wp-config.php file to understand the website's database authentication credentials — which can then be used to connect to the database using code from the attacker and malicious adjustments. 

An intruder with unwanted access to a website, who would like to create a permanent loophole if the files of the Website are washed, is indeed an example from real life.

An intruder's approach is to set an admin user in the CMS database of the website. Usually, these can be conveniently found in the administrative dashboard or SQL client. The unauthorized admin account is a loophole outside of the website and in the directory of the webserver. This knowledge is critical since owners of a compromised website will also forget the index. However, the exclusion of suspected users from the database of the website does not entail the removal of any potential backdoors. 

A SQL trigger is an automatically stored process that runs when certain database modifications are introduced. While there have been several useful implementations, that bad actors use SQL triggers to retain unwanted access after a compromise. To achieve this, attackers are placing a SQL trigger in a compromised website database and malicious activity is performed if specific conditions have been reached or an incident happens.

If attackers breach a site, they will bet on any database passwords that are stored in wp-config or other CMS configuration files — and once the hacker has obtained the data at any post-infection period, it can be extremely hard to identify if the hacker has harvested any valuable information. Users must change passwords, including the databases if a breach occurs. Failure to pursue this post-hack phase will allow an attacker to enter and change the website even after the user has assumed the infection was removed.
Read more »
Subscribe to: Posts (Atom)