Hacking website with brute-force type attack on a local machine

I have already written about the danger to your website caused by insecurely stored back up files. However, it was a case when I was able to find FTP credentials used by Updraft backup WordPress plugin stored in the back up of the database. I think this is the most straightforward hacking technique ever and it doesn’t require specialised knowledge or software to perform the hack. But today I will tell you about the more sophisticated method.

So, let’s begin with the very first step of this hacking method. As I mentioned in the previous post, some Google dorks could lead you to websites with unprotected backup files due to the open directory listing. Trust me, there are hundreds if not thousands of such sites, and you can find them by applying various dorks since various WordPress backup plugins have different file naming scheme.

Insecure WordPress backup files

OK, now when you have a potential list of vulnerable websites, it’s time to pick up one and proceed with other steps. We are looking for sites with backups of the database which you can use on your local machine. Download the WordPress database file, and you’re ready to start the hack. Continue reading Hacking website with brute-force type attack on a local machine

Q Brainstorm Software hacked and this endangers their customers

Recently I was making research on hacked websites of hotels. And step by step I reached out the website of Q Brainstorm Software company. Q Brainstorm Software is an IT company from India, established in 2004. This company offer an extensive range of various services based on several programming languages, website development, mobile app development and even SEO services. Briefly, “We do everything”. But they attracted my attention not because of their services, but because of their products.

Q Brainstorm Software products

Looking at the product page, I see the list of several products:

  • Hotel Desktop – Available in three different versions, ultimate hotel management solution for small and medium accommodation facilities.
  • Hotel web – Hotel Pro desktop version can be further enhanced with a web module where you can manage your reservations and view the calendar using just a web browser.
  • Hotel Mobile – Hotel mobile app is a comfortable way of managing your reservations from any place in the world. Only a mobile phone or tablet is required.
  • Channel Manager – Hotel can be synchronised with the most popular channel managers in the world such as YieldPlanet, Octorate or WuBook.
  • Online Booking Engine – Allow customers to make reservations directly through your website with a modern, fully customizable online booking engine.
  • Advanced Functionalities – Accounting, statistics, logbook, customizable documents, automated emails, rate plans, services, meals management and more!

These products are business oriented, which is a little frightening to me and I’ll tell you why.

If you’re looking for a software to power up your business one of the primary requirements is the safety of the software. The vulnerable software may endanger business in various ways. Now let’s think about whether you can trust your business to the company and its products if the website of the company itself is hacked? Yes! Hacked. Continue reading Q Brainstorm Software hacked and this endangers their customers

One third of all websites may be under the DoS attack at any time

Houston, we have a problem! A serious problem that theoretically can affect one-third of all websites on the Internet. Recently Israeli security researcher Barak Tawily found a WordPress vulnerability that can lead to a massive DoS attack. DoS attack is a type of cyber-attack when an attacker drains network or server resources by flooding it with an enormous amount of requests. Every request needs some resources, but if you’re capable of making a lot of these requests or you find a way to drain more resources with fewer requests you’ll finally make the network or server inaccessible for the time of the attack.

Do not confuse DoS attacks with DDoS attacks, DoS (denial-of-service attack) attacks run from a single source of requests and DDoS (distributed denial-of-service attack) need more than one request sources. In this case, we are talking about attacks that are possible to execute from a single request source (for example one computer). The success of a DoS attack is directly dependent on how many requests a hacker can generate and how much it consumes server or network resources. Usually, DDoS attacks are more efficient than DoS attacks. But in this case, a single attacker could make a significant load on the server and create the real denial-of-service situation.

Continue reading One third of all websites may be under the DoS attack at any time

Exploitation of hacked websites for cryptocurrency mining gains popularity

Exploitation of hacked websites for cryptocurrency mining is a new thing, and it gets more popular day by day. Hacking websites for fun or other reasons like spamming, other exploitation is a thing of the past. All previous exploitation methods of hacked sites are outdated, have low-profit margins (except stealing of CC credentials and similar data) and incompatible with the modern trends. Now everyone wants cryptocurrencies, everyone obsessed about crypto money and everyone is ready to do anything to get it.

Coinhive JavaScript miner for the Monero Blockchain

Coinhive offers a JavaScript that anyone can easily embed to websites. This Javascript is a Monero Blockchain miner that uses the CPU power of website visitor PC for predefined calculations. You turn your PC into cryptocurrency mining machine when you visit the website equipped with Coinhive JavaScript mining.

Continue reading Exploitation of hacked websites for cryptocurrency mining gains popularity

Sensitive data theft from Lithuanian plastic surgery clinic

Sensitive data leakage is a significant problem in the modern world. The most commonly stolen data contains personal identification data, logins to electronic banking accounts, etc. But the recent data theft case in Lithuania has caused great public resonance. One of the Lithuanian plastic surgery clinics suffered a hacker attack. Surgery clinic personnel did not detect the attack on time. Data loss discovered when hackers posted a part of the stolen data on the Darknet site.

It appears that hackers managed to download the whole database with personal data of all clinic clients. More than twenty-four thousand customers listed in this database. The database includes names, surnames, personal identification numbers, phone numbers, addresses, emails, all plastic surgery, and medical data. Moreover, the database contains all photos made before and after plastic surgeries. It made this security breach way more dramatic.

Continue reading Sensitive data theft from Lithuanian plastic surgery clinic