Monday, July 4, 2022

Hackers claim they've stolen the data of 1B Chinese citizens/British Army social media accounts hacked/Ukraine arrests hackers who stole $3M

Inside.com

Part of Network

July 04, 2022

Presented by

Hackers are claiming to have stolen the data of 1B Chinese citizens. If true, the attack would represent the biggest cybersecurity incident in the country's history.

More:

Binance's CEO Changpeng Zhao stated that the security team in Binance had noticed that someone was selling the data of over 1B citizens of an Asian country.
The data stolen includes names, addresses, mobile numbers, health records, etc.
A government staff member is believed to have accidentally written his log-in credentials among a few lines of code, causing the data to be leaked.
The seller is asking for 10 Bitcoins as payment while claiming that they have over 23TB worth of data. The Chinese government has not released a statement regarding these claims yet, while other researchers are also investigating the case.

Zoom Out:

The country is believed to have at least 100K hackers who are at the government's disposal, while there are tens of other hacker groups who are related to authorities.
Chinese-backed hacker groups were recently found to have conducted a cyber espionage operation that went on for at least five years. The operation targeted countries in the Indo-Pacific region and was carried out by Naikon, a group notorious for targeting government institutions.

The British Army's social media accounts were breached by an unknown threat actor. The government is still investigating the attack that led the army's Youtube and Twitter accounts to advertise crypto scams.

More:

The breach lasted around four hours, with hackers changing the profile picture of the British Army's Twitter account to a Possessed NFT. This attack sparked the reaction of industry researchers as well as policymakers, with Conservative MP Tobias Ellwood stating his concern regarding the attack and claiming that there needs to be action taken against the threat actor.
Threat actors made the pages look as if Elon Musk and Cathie Wood were having a live stream about cryptocurrency.
Hackers encouraged the viewers to scan a QR code that would direct them to a cryptocurrency wallet address. After donating to that address, viewers promised to receive double the amount they donated back. It is unknown how many people donated, but over 20K people participated in the live streams. A major threat vector for the hackers was a phishing link that was sent to viewers. After being clicked, breachers likely gained unauthorized access.

Zoom Out:

Santander bank recently claimed that crypto scam cases were up 87% compared to last year.
Hackers have previously scammed people out of millions of dollars by using Elon Musk's image.

A message from ASHCROFT CAPITAL

With the housing market the way it is these days, it seems impossible to invest in real estate right now – except for apartments.

Why invest in multifamily apartments?

Because most investors are looking for passive income or growth opportunities to add to their portfolio but multifamily private placements provide both in one investment. Multifamily allows investors a unique opportunity to collect monthly cash flow (passive income) and participate in the equity (growth) as the property appreciates in value.

Here lies the advantages of investing in multifamily private placements:

you don’t have to manage a property
you don’t have to worry about repairs or renovations
you don’t even have to find your own deals

However, before you invest in any private placement, you still need to take the time to understand the terms. You can learn how to make informed decisions when investing in real estate by downloading this free Private Offering Guide.

Download Now

For accredited investors only. The guide is for informational purposes only and is not intended for any other use. Not an offer to sell securities.

Ukrainian law authorities have arrested the hackers responsible for stealing over $3M in fake phishing websites. The websites convinced Ukrainian citizens to sign up for financial aid while stealing all of the funds raised.

More:

The unknown hacker group was comprised of nine individuals who created over 400 different fake websites. The websites were filled with false European Union credentials, convincing Ukrainians that once they fill their bank details, the EU would send financial aid to their bank accounts.
All of the individuals were arrested by the Ukrainian Cyber Police in cooperation with the National Bank and face 15 years in prison.
The hackers are known to have scammed over 5K Ukrainians so far, while the exact details of the attack are still being uncovered. The threat vector through which the group breached the victims is a phishing link.

Zoom Out:

Only a few days ago, Russian hackers attempted to breach Ukraine's largest energy company.
A few weeks ago, over 70 Ukrainian government websites were breached, as the country has sustained thousands of cyberattacks since the war began this year.

A threat actor has taken credit for hacking Stanford University and IBM. The method used to breach the two targets is expected to become more common in the near future.

More:

The threat actor stated that it used Jenkins to achieve its goal of breaching the accounts. According to researchers, this threat actor is known for selling access credentials on the internet.
In order to breach the victims, the hacker may have used search engines like Shodan to target the company's port 9443. Shodan enables users to scalp metadata from servers, allowing them to leverage this data. Afterward, the actor may have used a private script to bypass security protocols and gain unauthorized access.
While the initial reports are considered unreliable, this method could be used by other threat actors to specifically move laterally across networks and use the same way to brute force other passwords. This could be effective if the user does not change their password on different accounts.
Government accesses shown by the threat actor's breach have affected countries such as the UAE, Indonesia, Pakistan, Kenya, etc.

Zoom Out:

The University of California was similarly hacked last year, leading to thousands of students having their data leaked.
Two years ago, over 20 U.K., U.S., and Canadian universities were breached, with some of them being forced to pay a ransom.

An employee of HackerOne was caught stealing customer data with the intention of personally benefiting by selling them. HackerOne is a platform that companies use to find out about vulnerabilities in their systems.

More:

The breach was first noticed by a client of HackerOne. Once the company investigated the event, it noticed that a user had logged in several times and tried to send multiple vulnerability reports to customers. The reports contained the same information and were intended to be sold for a profit.
This event happened between April 4th and June 22nd. The former employee attempted to convince one of the clients that they had been a victim of a significant breach, but the client was alarmed by that statement, triggering them to contact HackerOne. The company managed to notify all of the 7 clients whom the former employee had tried to breach.
HackerOne claims that it did not find any other signs of data abuse and that it has added several layers of security. The company aims to improve its ability to detect inside threats, protect data, communicate possible threats with its customers, etc.
An online account with the username Rzlr stated that the issues noted by the employee had been tracked officially within the internal company's system, but HackerOne's tracking system is inaccessible from the outside.

Zoom Out:

Numerous companies have struggled with internal data leaks this year. Many prototypes and future products of the company were publicized without the company's consent.
In 2016, Snapchat was hit with a phishing attack that asked for financial information from more than 700 of the company's employees.
The Equifax hack remains one of the largest in history, with over 140 million U.S. citizens having their data leaked.

Quick Hits:

End your expense reporting nightmares; get $100 to see how dreamy it can be.
German pharmaceutical company Bayer has announced that it will launch a cybersecurity company division in Israel. The news was announced after top executives from the $45B company concluded a visit to the country.
A researcher has found several flaws in the security protocols that the U.S police uses in one of its software products.
A new variant of the Astra Locker ransomware has been tracked by researchers. The variant differs from other ransomware in that it moves to immediately encrypt the files and lock them away from the user.

Upcoming events at Inside:

July 20 - The Rise of Metaverse Gaming (Register Here)
August 17 - Build Your Diversified Portfolio: How To Invest in Bear Markets (Register Here)
September 14 - Are Electric Cars Worth It? (Register Here)

Arbër is an Inside writer who also has experience in entrepreneurship. He has experience covering Consumer Tech, Venture Capital, NFTs, Crypto, etc. Arbër holds a Bachelor's degree in Business from XAMK University in Finland. When he is not reading(and writing) business news, he chooses to watch sports or anime...and then read news about sports or anime.

Editor

Gregory Bridgman is a writer and researcher with an academic background in politics and the philosophy of science and technology. He holds a BA from the University of Cape Town, an MS from University College London, and is currently completing a PhD at the University of Cambridge. He is interested in climate issues, technological changes, and the implications of the fourth industrial revolution. Please feel free to contact me at gregory@inside.com!

Learn how to invest in real estate without managing properties, making repairs, or finding deals.

767 Bryant St. #203, San Francisco, CA 94107
Copyright © 2022 Inside.com

Did someone forward this email to you? Head over to inside.com to get your very own free subscription!
You received this email because you subscribed to Inside Security. Click here to unsubscribe from Inside Security list or manage your subscriptions.

Bitcoin's Worst Month in 11 Years

July 4, 2022

The biggest crypto news and ideas of the day

Was this newsletter forwarded to you? Sign up here.

Supported by

Welcome to an abbreviated version of The Node. Happy July 4 to those who celebrate.

In today's edition: Celsius lays off ~150 employees as 3AC files for Chapter 15 bankruptcy in New York. Meta (FB) shutters Novi as execs alight from Cosmos' Ignite. And bitcoin sees worst month trading in 11 years.

– Daniel Kuhn

Today's must-reads

Top Shelf

VOYAGER, 3AC: Voyager Digital (VYGVF), a publicly traded crypto broker, suspended all trading, deposits and withdrawals and temporarily deactivated its crypto-backed debit card on Friday, citing market volatility.

The company, which previously disclosed it had significant exposure to failed hedge fund Three Arrows Capital (3AC), had received a $200 million loan from Sam Bankman-Fried's Alameda Research to safeguard Voyager's customer assets.
Meanwhile, 3AC filed for Chapter 15 bankruptcy in the Southern District of New York on Friday, a move that could help protect its U.S. assets from those liquidated by a British Virgin Islands court order.
Though 3AC had billions under management and likely owes money to a number of failing crypto lenders (including BlockFi, Celsius and Babel Finance) an obscure, Singapore-based trading unit called TPS Capital is still aggressively trading.
Finally, American-Israeli crypto lender Celsius laid off some 150 employees as it faces possible insolvency.

BITCOIN'S BAD MONTH: Was June bitcoin's worst trading month ever? Not quite: The cryptocurrency slid almost 38% in June to record its second-biggest monthly loss since its debut in 2009. Outlook for the asset has changed amid poor macroeconomic conditions, fears of inflation and systemic risks from the crypto market. Traders are now searching for a bottom.

BTC traded over $31,000 on June 1 and dropped to as low as $17,700 mid-month, pushing it below 2017's highs – dashing hopes that the asset could never fall below previous bull markets' high water marks.
Dispelling another rumor, a new Coinbase report claims that crypto miners selling coins has a limited impact on price. This comes as miners and other firms begin offloading digital assets previously held on their balance sheet to cover expenses amid falling profits.
Speaking of, Hong Kong-listed software firm Meitu notched approximately a $90 million loss in the value of its crypto holdings for the first half of 2022.

REBRANDS → REORGS: Meta (FB) will shut down Novi, the social media company's stablecoin pilot, on Sept. 1, in what appears to be a final blow to its ill-fated Libra project. When announced, Libra was an ambitious attempt at creating a non-nation-state-backed global currency, but was scaled back and renamed (just like its parent company, Facebook, did) after regulatory pressure.

Novi allerted users to remove funds from its test-ready wallet and claimed that the technology developed would be repurposed for future products, including its metaverse initiative, in an announcement.
Separately, following a contentious rebranding and reorganization, Cosmos-builder Ignite (nee Tendermint) has laid off more than 50% of its workforce. The news follows CEO Peng Zhong's departure on Friday.
Last, Singapore-based crypto lender Vauld is looking at restructuring options, after previously laying off staff and limiting withdrawals.

ACQUISITIONS: The Kevin O'Leary-backed WonderFi (WNDR.TO) closed a $30 million acquisition of licensed Canadian crypto trading platform Coinberry on Monday, following its "uplisting" to the Toronto Stock Exchange last week.

Though this follows a 20% staff reduction at both WonderFi and Bitbuy, a crypto trading platform WonderFi acquired in January, WonderFi said it is on the lookout for more acquisitions amid the crypto market rout.
Separately, CoinShares (CS) has purchased Napoleon Asset Management, allowing the New Jersey-based digital asset manager to offer products and services across the European Union. CoinShares agreed to purchase the broader Napoleon Group late last year for $14.5 million in cash and stock.

STABLECOIN SALVATION? Following the resignation Saturday of Argentina's economy minister Martin Guzmán amid an economic crisis, Argentines purchased between two and three times as many stablecoins as they do on a typical weekend, crypto companies in the country told CoinDesk.

Three major crypto exchanges said that consumers were looking to hedge against a potential devaluation of the Argentine peso (ARS), whose buying power has plummeted over the past year as inflation skyrockets.
This comes as India's controversial crypto tax went into effect beginning July 1 (to roll out over the coming three months).

Strong Fundamentals, Higher Insurance

In today's market conditions, uncertainty can be overwhelming. That's why having a strong fundamental layer as a base for our business model has always been essential for Nexo. Strict over-collateralized lending, a real-time audit, prudent risk management, global licensing, and fully-automated processes, are the pillars that ensure the robustness of our products and the safety of your funds at all times.

As a security-first platform, we recently increased our total insurance on custodial assets to $775 million. These additional protections come through our years-long collaborations with BitGo, Ledger Vault, Bakkt, and other industry-renowned custodians via the most prestigious underwriters, including Lloyd's of London, and Marsh & Arch.

Nexo's fundamentals are in place to keep your funds safe and to provide you with confidence that regardless of market conditions you can rely on your assets. We urge you to read more about these features and our sustainable practices on our Security page.

What others are writing

Off-Chain Signals

Circle CEO Says USDC Stablecoin Provider Is in 'Strongest Position' Ever (Decrypt)
British Army's Twitter and YouTube accounts hacked to promote cryptocurrency scams (CNBC)
Despite crypto ban, China's tech talent rides the global web3 wave (TechCrunch)
Here's how undercover Feds got a drug ring near Boston to send $1M in bitcoin (Protos)
Singapore regulators mulling more restrictive crypto policies (The Block)

Even with worsening market conditions, crypto remains a hotspot for employment. CoinDesk's "Future of Work Week" takes a look at the jobs market, offers advice on landing a role, and explores how crypto itself could change how we work, including through decentralized autonomous organizations (DAOs). Stay tuned for features, profiles and op-eds throughout the week.

DAOs Are the New Way of Impact Work

"Impact DAOs" are at the forefront of new culture of work that asks us to move towards aligning our values with our actions, says the co-founder of Gitcoin.

Why Brands Should Adopt a 'Hybrid DAO' Model

Crypto allows brands to give customers a voice, leading to stronger communities and products.

Filling the Knowledge Gap: CryptoStudio's Independent Comparison and Education Hub Promises to Help Crypto Adoption Go Mainstream*

A lack of knowledge remains the single biggest roadblock to crypto adoption. CryptoStudio is solving that problem by offering educational resources and tools that are empowering investors to make informed decisions and helping to enhance trust across the whole digital-assets space.

Continue reading here

*This is sponsored content from CryptoStudio.

The Chaser...