 |
|
| node: | Re[4]: 16.05.2023-13:21:39 |
| template: | 4 |
| parent: | Re[3]: 16.05.2023-13:21:39 |
| owner: | drakh |
| viewed by: | |
| created: | 18.05.2023 - 14:30:30 |
|
cwbe coordinatez: 101 63540 63590 5734320 9063541 9063815 9063832 9064202 9064209 ABSOLUT KYBERIA |
| permissions | |
| you: | r, |
| system: | public |
| net: | yes |
total descendants::3
total children::2
https://arstechnica.com/information-technology/2023/03/hackers-drain-bitcoin-atms-of-1-5-million-by-exploiting-0-day-bug/
https://www.generalbytes.com/en/news/general-bytes-statement-on-the-security-incident-that-occurred-on-march-18-2023
v skratke:
hackeri poskenovali digitalocean a nasli si ipcky a servicy ktore im patria
nasli endpoint ce ktory sa uploadovali videa a obrazky na identifikaciu usera
cez tento endpoint vedeli nahrat vlastnu java aplikaciu, a spustit(toto je velike wtf)
tymto to viacmenej nakompletku pwnli
This resulted in the following:
- Ability to access the database.
- Ability to read and decrypt API keys to access funds in hot wallets and exchanges.
- Send funds from hot wallets.
- Download user names and their password hashes and turn off 2FA.
- Ability to access terminal event logs and scan for any instance where customers scanned private keys at the ATM. Older versions of ATM software were logging this information.
cele to bol vraj 0day exploit. A danu zranitelnost predtym neodhalili ziadne pentesty (este vacsie WTF)
akoze ked takuto chybu ala diery v PHP aplikaciach z roku 2000 pentest neodhali tak to je ze total lamerina. ak teda tie pentesty ozaj davali robit.
https://www.generalbytes.com/en/news/general-bytes-statement-on-the-security-incident-that-occurred-on-march-18-2023
v skratke:
hackeri poskenovali digitalocean a nasli si ipcky a servicy ktore im patria
nasli endpoint ce ktory sa uploadovali videa a obrazky na identifikaciu usera
cez tento endpoint vedeli nahrat vlastnu java aplikaciu, a spustit(toto je velike wtf)
tymto to viacmenej nakompletku pwnli
This resulted in the following:
- Ability to access the database.
- Ability to read and decrypt API keys to access funds in hot wallets and exchanges.
- Send funds from hot wallets.
- Download user names and their password hashes and turn off 2FA.
- Ability to access terminal event logs and scan for any instance where customers scanned private keys at the ATM. Older versions of ATM software were logging this information.
cele to bol vraj 0day exploit. A danu zranitelnost predtym neodhalili ziadne pentesty (este vacsie WTF)
akoze ked takuto chybu ala diery v PHP aplikaciach z roku 2000 pentest neodhali tak to je ze total lamerina. ak teda tie pentesty ozaj davali robit.