STE WILLIAMS

The Award for Most Dangerous Celebrity Goes To …

A new study highlights which celebrities are associated with the most malicious websites, making them risky search subjects.

Many fans of Australian actress Ruby Rose, known for her roles as Batwoman and in “Orange is the New Black,” find themselves on malicious websites when they search for her online.

Rose is the “most dangerous celebrity,” according to a new McAfee study, which annually researches famous individuals to see who generates the riskiest search results that could send fans to malicious websites. The 2018 study, McAfee’s 12th, places reality television star Kristin Cavallari at No. 2, followed by actress Marion Cotillard, actress and original Wonder Woman Lynda Carter, actress Rose Byrne, and “Will and Grace” star Debra Messing (#6).

McAfee’s report highlights the risk of clicking malicious links when researching celebrities online, a common practice that cybercriminals often exploit by tricking users into downloading malware or entering their personal information or credentials on malicious websites.

Web users are advised to stick to official websites when researching their favorite stars and musicians, apply system and application updates as they roll out, and browse with security protection. This includes parental controls – after all, kids are fans of celebrities, too.

Read more details here.

 

 

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/threat-intelligence/the-award-for-most-dangerous-celebrity-goes-to-/d/d-id/1332950?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Hacker ‘AlfabetoVirtual’ Pleads Guilty to NYC Comptroller, West Point Website Defacements

Two felony counts each carry a maximum 10-year prison sentence.

A California man has pleaded guilty to computer fraud charges for hacking and defacing the websites of the US Military Academy’s Combating Terrorism Center, in West Point, N.Y., and the Office of the New York City Comptroller. 

Billy Ribeiro Anderson, 41, also known by his hacker handles “Anderson Albuquerque” and “AlfabetoVirtual,” hacked into and defaced over 11,000 US military, government, and business websites worldwide from 2015 through March 2018. He exploited a vulnerable plug-in application running on the NYC Comptroller site, and a cross-site scripting flaw on the West Point site.

The two felony counts each carry a maximum 10-year prison sentence; Anderson’s sentencing hearing will be held on Feb. 13, 2019.

Read more here

 

Black Hat Europe returns to London Dec 3-6 2018  with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier security solutions and service providers in the Business Hall. Click for information on the conference and to register.

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: https://www.darkreading.com/cloud/-hacker-alfabetovirtual-pleads-guilty-to-nyc-comptroller-west-point-website-defacements/d/d-id/1332952?_mc=rss_x_drr_edt_aud_dr_x_x-rss-simple

Students swap data for coffee at cashless cafe

How much is the personal data of young people worth?

Stop. We know what you’re thinking. You’re thinking it’s worth about as much as a large pizza.

Sorry, but no – that’s circa 2016 thinking, when 42% of 13- to 17-year-olds said they’d rather give away their personal data than work at a job to earn $20.

But since February, personal data has been worth a cup of coffee. News of the devaluation comes with the opening of Shiru Cafe, which now has a branch in Providence, RI, near Brown University.

The University’s staff and faculty have to shell out $1 for their beverage, but students caffeinate in exchange for nothing more than a college ID… and their names, phone numbers, email addresses, majors, dates of birth, professional interests, “IT skills,” “previous internships,” and the size of “company the student is interested in”. As the BBC reports, the students fill that personal data into an online form.

By doing so, they agree to receive information – via logos, apps, digital ads displayed in stores and on mobile devices, signs, surveys and well-briefed baristas – from the corporate sponsors who pay for those roasting beans.

At any rate, all that will theoretically come to pass as soon as Shiru Providence actually has corporate sponsors. Keith Maher, the manager of Shiru’s Providence locations, told NY Magazine that for now, the cafe’s screens are just showing ads for internship positions at Shiru, until the company manages to recruit actual, paying sponsors.

The college ID can be from any college. But without that ID, unaffiliated patrons are gently being told to hit the highway – being a completely cashless cafe, the general public or privacy-conscious students don’t even have the option to buy a coffee at the normal price.

The Providence location is Shiru’s first US store, but it’s also planning to open cafes near Harvard University, Yale University, Princeton University, and Amherst College. It’s already running more than 20 locations across Japan and India’s most prestigious universities, including Tokyo University and the Indian Institutes of Technology.

Students’ reactions have been mixed. A few months before the Providence Shiru opened, two Brown students wrote a letter calling for a boycott, not on privacy grounds, but on the ethics of sponsoring companies:

Brown should send a clear message rejecting the cafe’s stated desire to draw smart and talented people to work for large corporations, whose principles are frequently at odds with those of our community.

On the other hand, some students shrug.

The data’s already out there, the thinking goes, given things like the Cambridge Analytica/Facebook data-sharing scandal, the 50 million Facebook accounts recently breached, the fact that we’ve given our phone numbers to Facebook for security purposes only to have them used to advertise at us, and all the other, non-Facebook-related breaches in recent years. Plus other social media. Plus LinkedIn. You get the idea.

The cafe asks that students drink their coffees in the shop – all the better to drizzle sponsorship all over them and encourage them to connect to the cafe’s wifi.

But hey, the coffee comes in disposable cups. Students who don’t savor the taste of sponsorship propaganda, or who dislike the possible privacy risks of signing up and ordering via smartphone, or who don’t like ads on their phones, are picking up the coffee and walking out.

Maher, the manager of the Shiru in Providence, told NY Mag that the store is collecting only the data it asks for on the intake forms, and that it’s only going to share it in anonymized form with sponsor companies.

‘Anonymized’

The “it’s anonymized” line is a familiar one, and it’s one that Big Data researchers love to skewer by doing things like pinpointing people after looking at a bunch of supposedly anonymized credit card transactions.

Sarah Ferris, assistant manager at the Providence Shiru, told the BBC that the company is “good about keeping everyone’s information close. They don’t sell it, they don’t do anything of that sort.”

Indeed, Shiru’s privacy policy states that it may “disclose aggregate information about our users and information that does not identify any individual without restriction.”

Unfortunately, once a company has a wealth of valuable data, good intentions don’t always stop it from selling that hot commodity.

Free coffee: it would be an irresistible idea, if not for the fact that nothing’s really free, particularly when you’re talking personal data.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/PmGcDpLjs_I/

Suspect forced to unlock iPhone with his face

An investigation into a chain of paedophiles has revealed the first known case of law enforcement forcing a (living) suspect to unlock his iPhone by using his face with Apple Face ID facial recognition technology.

Forbes dug the case out of an affidavit for a search warrant issued on 19 September that mentioned using Face ID to unlock an Ohio man’s iPhone X.

Forbes staffer Thomas Brewster notes that this isn’t just a first for US law; this is a first for any law enforcement outfit in the world.

The iPhone X belongs to Grant Michalski, 28 – one of six Ohio men who, according to the Department of Justice (DOJ), met on Craigslist to talk about the sexual abuse of at least two 10-year-old girls. In August, the six were charged with crimes related to producing sexual abuse images and repeated sexual abuse of at least those two girls.

Larry McCoy, a task force officer with the FBI, had begun the investigation in January 2018 by posting a Craigslist ad titled “Taboo Dad chat.” Posing as a recently divorced father, McCoy’s ad said he was looking to chat with others regarding “taboo stuff.”

He got a response from somebody later identified as William G. Weekley, 34, of Newark, NJ – one of the men mentioned in the DOJ’s announcement from August. Weekley allegedly proceeded to send McCoy child abuse images via the Wickr messaging app. He was arrested in January and admitted to communicating with others on Craigslist. According to the affidavit, the suspects also used the chat app Kik Messenger to discuss abuse of minors.

Craigslist and Gmail provided investigators with enough information to find Michalski, allegedly one of Weekley’s correspondents.

With search warrant in hand, investigators searched Michalski’s house on 10 August, demanding that Michalski use Face ID to unlock the iPhone X that they found. He complied, which gave the FBI access to photos, videos, correspondence, emails, instant messages, chat logs, web cache information and more on the iPhone.

Or, at least, that’s what the search warrant authorized investigators to seize. However, they couldn’t get everything that they were after before the phone locked. A device can be unlocked by using Face ID, but unless you know the passcode, you can’t do a forensic extraction. The clock starts ticking down, and after an hour, the phone will require a passcode.

During that window of time, investigators could manually look through files and folders and take photos of what they found, but it was slow going. Hooking up a phone to a computer and using a passcode would have enabled faster, more complete forensic data download, including of the data within apps and even deleted data.

That doesn’t mean the data is now entirely out of investigators’ reach. As the FBI noted in the affidavit, there are “technological devices that are capable of obtaining forensic extractions from locked iPhones without the passcode,” and Ohio law enforcement agencies have access to them – specifically, the Columbus Police Department and the Ohio Bureau of Investigation.

In Apple’s 11.4.1 update, which it delivered in July, users could turn on USB restricted mode in response to those techniques, which are believed to be used by GrayShift and Cellebrite to bypass the iOS lock screen. That option is turned on by default in iOS 12, but users who enabled automatic updating could have had it two months prior to that.

Michalski’s lawyer, Steven Nolder, told Forbes that the FBI wanted to use Cellebrite tools to get more data from his client’s phone, but in spite of using Face ID unlock, they haven’t been successful. Hence, the bureau hasn’t found contraband, his client didn’t suffer as a result of being forced to unlock his phone using this particular biometric feature and as such, there’s no need to challenge the warrant’s inclusion of it.

However, Nolder told Forbes that the cops were now using boiler plate language in warrants to allow them to access iPhones via Face ID:

Law seems to be developing to permit this tactic.

If precedence is any guide, Fifth Amendment challenges to compelled face unlocking would likely have little luck. As it is, biometrics tend to be interpreted as constituting “what you are,” versus passcodes, which constitute “what you know,” and that’s a crucial distinction when it comes to Fifth Amendment protections.

Courts have tended to lean toward granting Fifth Amendment protection against self-incrimination when it to the contents of our minds – as in, our passcodes. When it comes to our biometrics, courts have tended to consider biometrics to be outside of the scope of the Fifth Amendment.

Weekley and Michalski are still awaiting dates for the start of their trials.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/4U7uwbE3888/

Lock screen bypass already discovered for Apple’s iOS 12

Apple’s well-received iOS 12 is barely out of the gates and already someone has found a way to beat its lock screen security to access a device’s contacts, emails, telephone numbers, and photos.

As bypasses go, this one’s elaborate, requiring two Apple devices, 16 steps to be executed in the correct sequence to view contacts, numbers and emails, plus a further 21 steps to view photos (and Face ID to be either turned off or taped over).

That immediately rules out a casual or opportunist attack – anyone wanting to exploit the weakness would need physical access to the device, plenty of time, and step-by-step instructions.

The weakness

The flaw was revealed to the world in a Spanish-language video from a researcher, Jose Rodriguez, who has built a reputation for finding at least two other iOS lock screen bypasses.

One of Siri’s helpful features is the ability to do all sorts of things even when an iPhone or iPad are locked, including phone people, send a text message, and tell users about their meetings. From the description, it is this which makes the bypass possible, albeit via a convoluted route.

An annoying pattern

According to third parties, the latest bypass proof-of-concept sequence seems to work on all Apple devices running iOS 12 (and the iOS 12.1 beta), including the new XS.

It’s been a running theme going back to iOS 6 in 2013, when Rodriguez discovered his first lock screen bypass in a version of iOS which had supposedly patched a previous one.

Two years later, he was back with another one in iOS 9, followed by several discovered in later versions in 2016.

The pattern is easy to spot – Apple releases a new version of iOS and has to patch it for a lock screen flaw not long after. Things quieten down until the next annual release and the cycle starts again. While bypasses have become tougher for researchers to find over time, find them they have.

This reinforces why iOS 12’s default to allow automatic security updates is a good idea. In the meantime, the bypass can be mitigated by disabling Siri’s lock screen access: Settings Face ID Passcode or Settings Touch ID Passcode disable Allow access when locked.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/54UoOpZk2pk/

Hackers demand ransom from hijacked Instagram influencers

Hackers are taking over high-profile Instagram users’ accounts and holding them to ransom, it was revealed this week. At least four influencers have lost control of their accounts and received demands to send bitcoin for their return, but in some cases the attackers retained control or deleted the accounts.

Motherboard reported that Los Angeles-based fitness Instagram influencer, Kevin Kreider, lost control of his Instagram account and more than 100,000 followers after falling victim to a phishing scam. The account hijackers sent him a fraudulent email offering a sponsorship deal with French Connection that took him to a fake Instagram portal which then stole his account details.

Cassie Gallegos-Moore, who used the Instagram handle theadventurebitch, blogged about losing her account to hackers who changed the email used to access it. They temporarily blocked the account and demanded a ransom, threatening to delete the account entirely within three hours if she did not pay. Gallegos-Moore, who had 57,000 users on her account, sent them $122 in bitcoin.

While Kreider eventually managed to regain control of his account, Gallegos-Moore was still without hers at the time of writing. Instead, she renamed a backup account to her original adventurebitch handle, but had fewer than 100 followers at last count. She lambasted Instagram for its approach to the hack.

While it isn’t clear how she lost her account, Instagram account hacking has become commonplace.

In August, the company blogged in response to reports that hundreds of accounts were being hacked. One piece of advice in that blog post may offer a clue:

Our current two-factor authentication allows people to secure their account via text, and we’re working on additional two-factor functionality with more to share soon.

SMS-based two-factor authentication (2FA) renders the user vulnerable to an attack known as SIM swapping, in which hackers socially engineer cellular carrier employees to switch a cellphone’s number to a new SIM. This enables attackers to access the SMS texts used in 2FA authentication and gain access to the account. NIST deprecated SMS texts as a form of 2FA in 2016.

Celebrity Instagram hacks have happened before. Selena Gomez, who had 125m followers at the time, had her account hijacked in August 2017, and someone with far too much time on their hands posted naked pictures of her ex-boyfriend Justin Bieber on it.

A couple of days later, Instagram confirmed that hackers had stolen personal information from high-profile user accounts by exploiting a bug in its system that exposed telephone numbers.

Hackers had already exploited the bug to harvest personal information on up to six million Instagram accounts, revealed the Daily Beast. They created a database of the information, which included all the Instagram accounts with over a million followers, and charged $10 per search.

Use app-based authentication to secure your account

Many people invest so much time and effort in their social media accounts that these hacks can affect their online brand and their ability to generate revenue. With attacks like phishing and SIM swapping now rife, enhanced protections are more important than ever.

Instagram announced an improvement on its SMS-based 2FA with enhanced security with support for mobile app-based authentication earlier this year,

Here’s how to set up your Instagram account to use a third-party authenticator app:

  • Go to your profile.
  • Tap the Menu icon.
  • Select Settings.
  • Choose Two-Factor Authentication.
  • Select Authentication App.
  • If you’ve already installed an authentication app, Instagram will automatically find it and send it a login code. In that case…
  • Go to the app, retrieve the code, and enter it on Instagram. That will automatically turn on 2FA.
  • If you haven’t already installed an authentication app, Instagram will shuffle you on over to Apple’s App Store or Google Play to download the app of your choosing (Sophos has you covered here: consider downloading Sophos Authenticator which is also included in our free Sophos Mobile Security for Android and iOS). Once you’ve installed your chosen authenticator, return to Instagram to continue setting up 2FA.


Twitter added support for FIDO Universal 2nd Factor (U2F) security keys this summer, and Facebook also supports mobile authentication apps.


Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/kJ-tF77Ei3U/

Ever used an airport lounge printer? You probably don’t know how blabby they can be

Privacy consultant and former Internet Architecture Board president Christian Huitema has said he reckons hotspot users should be given better privacy protection.

In an informational draft for the Internet Engineering Task Force published yesterday, Huitema explained that DNS Service Discovery (DNS-SD), the protocol that lets users of a public hotspot find (for example) the printer, also exposes them to “serious privacy problems”. His collaborators on the draft were Apple’s zeroconf pioneer Stuart Cheshire and crypto-engineer Chris Wood.

Huitema wrote: “The DNS-SD messages leak identifying information such as the instance name, the host name or service properties.”

For example, he wrote, someone wanting to print a document in an airline lounge will, without knowing it, be using a DNS-SD service to make that connection.

“In that scenario, the server is public and wants to be discovered, but the client is private,” he wrote. “The adversary will be listening to the network traffic, trying to identify the visitors’ devices and their activity. Identifying devices leads to identifying people, either just for tracking people or as a preliminary to targeted attacks.”

That’s unacceptable, the draft stated: “Discovery activity should not disclose the identity of the client.”

Things are even worse if two hosts in a conversation are supposed to be private (for example, two people using the hotspot for a direct file exchange).

“The server wants to be discovered by the client, but has no desire to be discovered by anyone else,” the draft read – but if the client software is using DNS-SD, that’s just what would happen.

Even watches could expose their owners through DNS-SD, Huitema wrote, because “David’s” watch looking for his phone will identify specific devices, which the adversary might know have a vulnerability.

The way the service is designed, the draft noted, would even let a savvy adversary build a device fingerprint. As it’s now written, DNS-SD messages include a list of services published by a device, “which can be retrieved because the SRV records will point to the same host name” – attributes describing services, service port numbers, as well as “priority and weight attributes in the SRV records”.

In other words, since there are too many ways in which client, server and user identities can leak, DNS-SD is sorely in need of a do-over.

The good news is that Huitema is working with the University of Konstanz’s Daniel Kaiser on a draft, progressing through an IETF working group, to hide that information. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/10/02/dns_service_discovery_privacy_draft/

MIMEsweeper maker loses High Court patent fight over 15-year-old bulletin board post

A commercial rival of email virus-scanning software firm Glasswall has lost its High Court attempt to use a bulletin board post from 2003 written by a former MessageLabs “imagineer” to have a patent declared invalid.

The full judgement, which dismissed the application for the revocation of the patent, was handed down on Friday at the High Court of Justice in London.

Clearswift, purveyor of the MIMEsweeper software, had sued Glasswall alleging that one of its ideas patented in 2013 was not, in fact, patentable, on the grounds that it lacked an “inventive step”.

The case boiled down to Clearswift claiming that the idea at the heart of a Glasswall-owned patent titled “resisting the spread of unwanted code and data” (European Patent EP 1 891 571 B1) was not novel enough to be patented because it had already been publicly described. If Clearswift was right, this would allow it to copy the patent’s function without getting stung for intellectual property infringement.

As evidence for this, Clearswift cited a previous 2005 US patent* describing email scanning as well as what deputy High Court judge David Stone described in his judgment as “a series of posts on an Internet bulletin board” under the subject line ‘Avecho Glasswall Anti virus technolog?’ [sic]” which can be found here.

Email content scanners normally dismantle, parse and regenerate emails before dropping them into recipients’ mailboxes, occasionally deleting attachments or body text if something malicious is detected by a threat filter, as well as inserting the boilerplate “This email has been scanned by Product X” wording. The patent disputed by Clearswift described how MIME emails can be dismantled and parsed by a virus scanner, including attachments to those emails.

Dismissing Clearswift’s argument that the 2005 US patent covered the same thing (parsing and regeneration of attachments) as Glasswall’s patent, the judge said: “I do not accept that it would have been obvious to the skilled addressee to apply a bypass whitelist only to files which had otherwise failed the parsing/regeneration process.”

As for the bulletin board thread from 2003, the key seventh post referred to by Clearswift was written by Alexander Shipp, a one-time anti-malware “imagineer” (PDF) for MessageLabs, who these days is chief techie of Equine Register Ltd. The judge ruled that the thread “is a mix of third party comments based on using the software, and the software producer’s advertising about what the software can do. It was agreed that the discussion would be of particular interest to the skilled person, including because of the claims made for the software, and the reputation of the people who wrote the posts.”

Clearswift argued that Shipp’s post reviewing the email-scanning software in 2003 more or less described the same functions as Glasswall’s patent – pre-dating their filing by 12 years and therefore making it invalid. Unfortunately for Clearswift, Judge Stone disagreed, ruling that the post “does not disclose a number of teachings of the Patent”, including its essential features of removing unwanted code and regenerating the email, or “parsing to content level”, though it did infer that a threat filter similar to that used by Glasswall’s IP had been in use at the time.

The full judgment is available on the BAILII website. Judge Stone does not appear to have been impressed by the “628 paragraphs” of expert evidence produced for Clearswift by Shipp, or the “40 exhibits, only one of which I was taken to during the trial”, waspishly commenting: “It was probably not necessary for much of it to be before the Court.” ®

* United States patent application 2005/0081057A1, titled “Method and system for preventing exploiting an email message”, published on 14 April 2005.

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/10/02/clearswift_glasswall_patent_lawsuit_bulletin_board_post/

Haven’t updated your Adobe PDF software lately? Here’s 85 new reasons to do it now

Adobe has posted an update to address 85 CVE-listed security vulnerabilities in Acrobat and Reader for both Windows and macOS.

The PDF apps have received a major update that includes dozens of fixes for flaws that would allow for remote code execution attacks if exploited. Other possible attacks include elevation of privilege flaws and information disclosure vulnerabilities.

Fortunately, Adobe said that none of the bugs was currently being targeted in the wild – yet.

adobe

Whoa, is it Patch Tuesday already? No, just an unexpected critical Photoshop fix

READ MORE

For Mac and Windows Acrobat/Reader DC users, the fixes will be present in versions 2019.008.20071. For those using the older Acrobat and Reader 2017 versions, the fix will be labeled 2017.011.30105.

Because PDF readers have become such a popular target for email and web-based malware attacks, users and admins alike would do well to test and install the updates as soon as possible. Exploit-laden PDFs have for more than a decade proven to be one of the most reliable ways to put malware on someone’s machine.

In total, Adobe credited 19 different researchers with discovering and reporting the vulnerabilities. Among the more prolific bug hunters were Omri Herscovici of CheckPoint Software, who was credited for finding and reporting 35 CVE-listed bugs, and Ke Liu and Tencent Security Xuanwu Lab, who was credited with finding 11 of the patched Adobe vulnerabilities. Beihang University’s Lin Wang was given credit for nine vulnerabilities.

While we’re on the subject of massive security updates, both users and admins will want to mark their calendars for a week from Tuesday. October 9 is slated to be this month’s edition of the scheduled ‘Patch Tuesday’ monthly security update.

In addition to the normally hefty Microsoft load of fixes for vulnerabilities in Windows, Edge, Internet Explorer, and Office, the Patch Tuesday dump also usually includes a number of fixes from Adobe for products like Flash Player. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/10/02/adobe_acrobat_reader_patch/

100,000 home routers recruited to spread Brazilian hacking scam

A DNSchanger-like attack first spotted in August on D-Link routers in Brazil has expanded to affect more than 70 different devices and more than 100,000 individual piece of kit.

Radware first identified the latest campaign, which started as an attack on Banco de Brasil customers via a DNS redirection that sent people to a cloned Website that stole their credentials.

Now, Quihoo’s Netlab 360 folk have warned that the attack, which they’ve dubbed GhostDNS, is “starting to ramp up its effort significantly with a whole bunch of new scanners.”

bank robbery

Brazilians whacked: Crooks hijack bank’s DNS to fleece victims

READ MORE

The attackers were trying to get control of the target machines either by guessing the web admin password, or through a vulnerable DNS configuration CGI script (dnscfg.cgi). If they get control of a device, they change the router’s default DNS server to their own “rogue” machine.

Netlab 360’s post added that as well as redirecting a victim’s default DNS, the GhostDNS campaign uses three DNSChanger variants running as a shell, a JavaScript program, or a Python program.

But wait, there’s more, the post said: “The GhostDNS system consists of four parts: DNSChanger module, Phishing Web module, Web Admin module, Rogue DNS module.”

The shell DNSChanger module works on 21 router models, the post said; the JavaScript module can infect six models; and the Python version has been installed on 100 servers, mostly on Google’s cloud.

At this stage, the post said, the redirection campaign is heavily weighted towards Brazilian Websites, nearly 88 per cent of the compromised devices are also in Brazil, and the rogue DNS servers operated on Hostkey, Oracle, Multacom, Amazon, Google, Telefonica, Aruba, and OVH.

Compromised kit has also been spotted in Bolivia, Argentina, Saint Maarten, Mexico, Venezuela, the US, Russia and a few others.

OVH, Oracle and Google have kicked the attackers off their infrastructure, and the post said others are “working on it”.

Vendors the Netlab 360 researchers have also listed 3Com*, A-Link, Alcatel / Technicolor, Antena, C3-Tech, Cisco, D-Link, Elsys, Fiberhome, Fiberlink, Geneko, Greatek, Huawei, Intelbras, Kaiomy, LinkOne, MokroTik, MPI Networks, Multilaser, OIWTECH, Perfect, Qtech, Ralink, Roteador, Sapido, Secutech, Siemens, Technic, Tenda, Thomson, TP-Link, Ubiquiti, Viking, ZTE, and Zyxel as vulnerable (* Yes, we know 3Com is a name long gone from the shelves; The Register speculates that since the vendor list is compiled by querying the compromised device, 3Com’s name survives in some HP devices’ firmware).

The Russian-authored Wive-NG router firmware has also been exploited, the post said. ®

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2018/10/02/ghostdns_router_hacking/