We have compiled the most significant cybersecurity news of the week.
Staff at the Beijing Institute of Forensic Science decrypted Apple device logs for the AirDrop feature, gaining access to user personal data, according to Bloomberg.
Residents of China use AirDrop to send files bypassing state censorship. Researchers became interested in the feature after a group used it to distribute “unacceptable information” in the Beijing subway.
Using rainbow tables, they decrypted logs to reveal the device name, phone number, and email address of the sender.
This led to the identification of several suspects in illegal distribution.
The Ukrainian hacker group KibOrg released the full database of Russia’s Alfa-Bank to the public.
According to the hackers, the table contains 115,217,571 records with data on 24 million people who used the bank’s services, including their full names, birth dates, phone numbers, card and account numbers. Data on 13 million organizations is also available. The earliest records date back to 2004.
The publication “Important Stories” confirmed that the leaked information pertains to real residents of Russia. Alfa-Bank has not commented on the situation.
Hackers accessed this data in October 2023, initially releasing part of the information. At that time, the bank dismissed the leak as “fake.”
Dutch police identified and arrested the operator of the Tortilla ransomware, a variant of Babuk, in Amsterdam.
The perpetrator attacked Microsoft Exchange servers using ProxyShell exploits.
Law enforcement collaborated with Cisco Talos researchers, who also managed to obtain a decryptor after extracting its keys from the executable file.
The AI-based chatbot Chattr allowed unauthorized users to access its backend, used by fast-food franchises for hiring automation. This was reported by a group of researchers led by programmer Paul Bruh.
Using a special script, they discovered a vulnerable Firebase server configuration linked to the KFC network.
Researchers used it to access the database, allowing them to view names, phone numbers, email addresses, branch locations, messages, work schedules, and some passwords. The data pertained to franchise managers, job applicants, and Chattr employees.
Additionally, experts accessed the admin panel listing organizations using the chatbot, with options to accept or reject job candidates and refund payments made in Chattr.
The vulnerability was disclosed on January 9, and the Chattr team resolved the issue the following day.
The creator and former administrator of the now-defunct hacker forum BreachForums, Conor Brian Fitzpatrick, was jailed for violating bail conditions.
Under a plea deal, he was prohibited from accessing the internet from devices without special monitoring software and using VPN services. Now, Pompompurin will remain in custody until January 19, when a court hearing is scheduled.
Fitzpatrick is accused of stealing and selling confidential personal information, conspiracy to commit fraud, and possession of child pornography. The former admin previously pleaded guilty to all three charges and posted a $300,000 bail.
He faces up to 40 years in prison, a $750,000 fine, and at least five years under government supervision after release.
The hacker group Blackjack claimed to have hacked the major Moscow internet provider M9com, stealing confidential information from the company.
As proof, they shared a Tor URL for three ZIP archives containing employee and client credentials, including full names, logins, email addresses, unencrypted passwords, and 50 GB of call data.
The hackers also defaced the official M9com website.
Blackjack described the attack as “a continuation of a series of warm-up acts of retribution” for the hack of “Kyivstar.”
Ukrainian cyber police, with Europol’s assistance, arrested a hacker who infected servers of a U.S. e-commerce company with a hidden miner.
According to case materials, since 2021, a 29-year-old resident of Mykolaiv brute-forced 1,500 accounts of a subsidiary firm. Using them, he gained control over the target service.
The hacker then infected server equipment with a mining virus and created a botnet of over a million virtual computers.
Over two years, the malware transferred about $2 million in cryptocurrencies to controlled wallets. Europol helped Ukrainian colleagues block these addresses.
Law enforcement seized computer equipment, flash drives, bank cards, and SIM cards from the suspect’s apartment.
Criminal proceedings have been initiated for unauthorized interference with information systems. Possible accomplices are being identified.
Also on ForkLog:
Explore the biggest DeFi segment hacks of 2023 in our year-end article:
