Vulnerable Disclosures: Botnet

Showing posts with label Botnet. Show all posts

Tuesday, April 28, 2015

EARLIER REPORT CONFIRMED: See Mailing List for POS Malware Post

Subscribe to our news feeds mailing list for specifics on a new POS Malware variant that we have tied to an earlier attack we detected in late March. The IP of that attack was 80.82.64.201 and since we are noting carding and Point of Sales malware activity to this address.

This is the same post that angered many security professionals but as you can see in a recent Government investigations that the incident has been confirmed. In addition specific IOC's for the POS malware were released and specifically named the IP address listed in our previous post.

Friday, November 14, 2014

BOTNET Wall of Shame - This will be an ongoing feature of the blog

The following host were detected during our last review. These are the results out of the first 100 in the list. There are over 7600 in the full list. We will put these out there as we have time to review.

Of interest here is activity coming from DoD Network Information Center and DFN Systems. Most of the other records are the ISP and not the organization but we will post the raw information as our honeypot sensors pick up the traffic.

11-14-2014,167.15.41.2,Munich Reinsurance America, Inc.
11-14-2014,67.222.114.236,Transwave Communications Systems, Inc.
11-14-2014,216.117.191.22,Advanced Internet Technologies, Inc.
11-14-2014,162.243.234.167,Digital Ocean, Inc.
11-14-2014,38.84.134.199,PSINet, Inc.
11-14-2014,72.80.31.179,Verizon Online LLC
11-14-2014,199.87.232.185,eSited Solutions
11-14-2014,11.38.64.251,DoD Network Information Center
11-14-2014,204.152.209.74,QuadraNet, Inc
11-14-2014,23.19.39.19,Nobis Technology Group, LLC
11-14-2014,71.183.67.163,Verizon Online LLC
11-14-2014,74.116.128.15,DFN Systems
11-14-2014,162.219.179.101,Amanah Tech Inc.
11-14-2014,209.190.42.138,eNET Inc.
11-14-2014,54.68.211.27,Amazon Technologies Inc.
11-14-2014,50.63.35.1,GoDaddy.com, LLC
11-14-2014,192.210.53.49,Psychz Networks

Wednesday, October 8, 2014

DISCLOSURE: Citigroup, E*Trade Said to Be Breached by JPM Hackers

Don't say we didn't tell you earlier in the week:

Citigroup Inc., E*Trade Financial Corp., Automatic Data Processing Inc. and Regions Financial Corp. were attacked by the same hackers that breached JPMorgan Chase & Co., according to a person familiar with the matter.

SOURCE: http://www.bloomberg.com/news/2014-10-08/citigroup-e-trade-said-to-be-breached-by-same-hackers-as-jpm.html

Monday, October 6, 2014

BREACH: Flinn Scientific

Science education website Flinn Scientific is notifying customers of a card payment data breach incurred by malware over the last several months.

Disclosure Letter

Type: Card Payment Data
Area: Scientific
First Noted: 5 Oct 2014
Location: NA
Total Records: Unknown
Status: Not Monitoring for Follow Up (Not a client of SLC Security Services LLC)

Thursday, September 25, 2014

BOTNET ACTIVITY: Related to Bash Vulnerability (UPDATED)

We are getting reports of various attacks. Look for this traffic. Chances are if you see traffic going to these 2 host you are probably infected.

89.238.150.154 port 5
162.253.66.76 port 53

We will post additional information as we find out more. The first host appears to be offline now but it may be a good idea to check for outgoing connections on port 5 anyway.

Infected machines may try and connect to 185.31.209.84 on port 443 which is hosting an IRC server for C+C on channel.

UPDATE: As of 10:30AM EST all of the identified servers have been taken offline. We will continue to monitor this situation.

About SLC Security

The driving factor in us deciding to provide this service to consumers is the growing cost of cybersecurity defense and notification systems. We are providing an RSS feed of content as a public service. It is our policy to only release the full details of data breach information directly to the companies or entity that was the target of the breach or attack. If you need assistance researching the source of the breach or leak please visit SLC Security Services LLC to obtain assistance.

NOTICE: All information posted to this blog is derived from open source intelligence systems developed by SLC Security Services LLC. The OSINT-X platform is available via subscription and via a paid RSS Feed. The OSINT-X system only maintains 90 days but this timeframe may and will change without notice depending on the amount of data we are processing. We also provide a delayed RSS feed that may not contain all feed sources. The public RSS feed is on this page on the right hand side and is provided without charge. The moderators of this site are all volunteers and are not paid for their services.

If your company needs a TSCM Sweep or Vulnerability assessment feel free to contact us through the contact form on this page or call us at (717) 831-TSCM to schedule an audit.

NOTICE: Starting in January 2015 we will only discuss issues on the blog or in our feeds with the clients directly. We receive upward of 200+ calls per day requesting information. It is impossible for our volunteers to field that number of calls and still get our work done. While we would love to help every person that calls remember we are a for profit business and answering calls takes time. If we are not busy you may get in touch with us. The best approach is to email us at soc@slcsecurity.com instead of calling. Please include your name, telephone number and a brief reason for the call or communication and we will get back to you as soon as possible time permitting.

About this Page

The purpose of this page is to provide awareness to individuals and organizations that are leaking information and the information of their customers. The entities listed on this site are verified to be leaking personal information sometimes without the company even being aware. We will include information on what type of information is being leaked but we will not release the methods in which the information is being leaked unless we are under non-disclosure agreements with the organization. The information posted on this site will contain scrubbed information if we release it to protect the information source and to ensure that the person or persons being affected are not farther harmed by the disclosure of their personal information.

Before a breach is reported it is reported to the entity affected and we normally wait at least 5 days for a response. We only post disclosures whenever there have been no response by the organization or when it involves confirmed leaks or we can verify that the security issue has not been resolved by the organization. Certain items will remain on the blog if they are a major release or new information is being posted frequently concerning the incident.

We do NOT maintain data on the leaked information as we would not want to create a second incident. Reports are submitted by security researchers, patients, clients, corporations and through open source identification as well as through passive monitoring of open source systems and proprietary algorithms.

The information on this site is provided by SLC Security Services LLC a leading cyber security and investigation company located in Raleigh, NC. If your company appears on this list and you would like additional information you may contact us by mail at 2664 Timber Dr Suite 342 Garner NC 27529 or by email via the contact form available at www.slcsecurity.com or by phone at (717)831-8726.

The Stats

Reporting Stats are available upon written request.

Please report all known security issues to soc@slcsecurity.com. We will review each report manually whenever possible. Please note that not all reports will be published to the disclosure list. Also you can specifically request that the data NOT be posted during your submission.

RSS OSINT-X FEED PERMALINK
Feed Delayed 30-60 Minutes
Not all sources we monitor are in this RSS feed. This feed contains mostly news sites but does not include IRC, Darknet or File Dump site monitoring that our commercial products monitor for your organization. This feed is limited in scope. For full access you must be a customer under a service contract. If interested in a full service contract call (919)441-7353 to inquire about pricing and services available.

TWITTER FEED